I've got infected file in avast! virus chest, but...

17 years ago

Hello, everyone!

I recently did a virus scan (using avast!) and an infected file was found. The file, named pebapehe.dll, was moved to the "virus chest."

Now, however, when I start my computer, I get 2 error messages. One says "Error loading c:\windows\system32\pebapehe.dll" and the other says "Error loading c:\windows\system32\modubelo.dll."

If I go ahead and close the error messages, the computer continues to boot up and perform normally.

Any suggestions how to get rid of these error messages?

Thanks!

Sort by:Oldest

Comments (4)

zep516
17 years ago
last modified: 11 years ago
Lets see if there is anything else that Avast may have missed, This scan could take a while to complete:

Please download Malwarebytes' Anti-Malware to your desktop. Click here
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
Â If an update is found, it will download and install the latest version.
Â Once the program has loaded, select "Perform Full Scan", then click Scan.
Â The scan may take some time to finish,so please be patient.
Â When the scan is complete, click OK, then Show Results to view the results.
Â Make sure that everything is checked, and click Remove Selected.
Â When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
Â The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Â Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
mee_tooo
Original Author
17 years ago
last modified: 11 years ago
zep516 --

Thanks for the response. I followed your advice, downloaded the Malwarebytes' Anti-Malware, and ran the full scan. It found (and corrected) 19 PROBLEMS!! The error messages no longer appear at startup.

I'm going to download Malwarebytes' Anti-Malware to my other 2 computers and scan both of them, too.

Again, thanks a million for letting me know about the great software!

Below is the log which resulted from the scan:

Malwarebytes' Anti-Malware 1.39
Database version: 2424
Windows 5.1.2600 Service Pack 1

7/14/2009 12:13:04 AM
mbam-log-2009-07-14 (00-13-04).txt

Scan type: Full Scan (C:\:D:\:E:\:)
Objects scanned: 216142
Time elapsed: 1 hour(s), 32 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(36890dc8-c0ea-4ec9-ae63-95ba567d7f60) (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\(36890dc8-c0ea-4ec9-ae63-95ba567d7f60) (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\(04a38f6b-006f-4247-ba4c-02a139d5531c) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\(ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4) (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\(2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\(3c2d2a1e-031f-4397-9614-87c932a848e0) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\(2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pivopizuhi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm53cc8936 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\(ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4) (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\davy\local settings\temp\e.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Davy\local settings\temporary internet files\Content.IE5\OPK5EVO1\load[1].php (Trojan.Downloader) -> Quarantined and deleted successfully.
Related Discussions
I've got a real mess, please help
Q
Comments (28)
I don't see any Malware / virus. But we are only looking at a hijackthis log from Safe Mode, and Malwarebytes only ran for 14 Mins? I see an out of date computer. adobe 7! Java 1.5! IE6! Then McAfee is that up to date? For starters I would go into your add/remove programs list and remove Adobe. We can get you another reader later. Then remove all versions of Java from the add / remove programs. The only version there should be Version 6 u_18. Remove all others. Then install IE7, http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=en You said yourself your getting Internet Explorer is not responding errors Then I would download Avast 5.0, to the desktop, don't install it yet. http://www.avast.com/free-antivirus-download Now I would run the McAfee removal tool, http://service.mcafee.com/FAQDocument.aspx?id=TS100507 When that finishes double click the Avast that you downloaded before and install it AND SCAN WITH IT TOO. After we can remove some 04 entries in hijackthis log. Unnecessary Start ups. Up date Java , Get a reader program for pdf files. Run some cleaners, ccleaner ect. Good luck you have a lot to do. Don't surf The Internet in Safe Mode no Virus protection in that mode....Just go to links provided and get Avast installed after McAfee is removed.
...See More
XP: MSE out, avast! in (free version)
Q
Comments (28)
Azinoh "Maybe we had different download sites?" That's possible. I downloaded directly from www.avast.com. If you did not, who knows what you actually downloaded. Could possibly have something to do with your very slow download also. ========================== Sunday 04-13: My version is 2014.9.0.2013 and now there is a new; 2014.9.0.2016. Well updating from the interface update just didn't seem to go so I went to the Avast.com site to download the dot.exe file. Clicking on download takes you to CNET. I now realize my original download was therefore thru CNET. So much for getting Avast from Avast. From Google it would seem cnet hasn't got the best of reputations any more in fact lots of complaints about extra programs foisted off on ya. Guess so. I went to File Hippo for the 84.55M file. Then googled that and there seems to be problems with the 2014.9.0.2016 version. So I'll skip it for now. Maybe let it age a bit. FH seems to have a good rep but most mssgs I found about them were several years old.
...See More
My netbook got hit with a virus
Q
Comments (16)
Karla, I did the same thing. One of the screens which popped up looked just like AVG, which is my AV. It was running a scan but there were smaller windows which looked like Windows and said,'security alert! your computer has a virus, you must update your antivirus. It had the colors of a Windows warning with the red X and blue background. The AV scan was zipping along with these alerts popping up. I was so confused, luckily I didn't react immediately (which is what I tend to do), I sat and looked at the windows and realized the scan (which looked exactly like AVG) was not AVG. It was missing the 'G'. The top of the screen just said AV. When I saw that, I knew the other boxes weren't Windows. I couldn't X anything or stop the scan. I tried to open AVG but it wouldn't open. I tried Malwarebytes, no luck. I then tried to shut down the computer and the Start button wouldn't work. More pop-ups all over the place. I manually shut the computer off. When I restarted, I did the same as Karla. I clicked on Malwarebytes immediatelly before the other processes started. It instantly grabbed 3 items before it scanned (thought that was odd). After the scan it showed 7 items: Trojan horse Fake AV.CDC Virus identified Exploit PDF Trojan.Fraudepack AV Suite Rogue.AVSecurity Suite Temp Files IE5 Rogue AV Security Suite. I don't know how to show the log. I might reinstall Windows and be done with this. It was very upsetting. My netbook seems to work normally but the proxy settings were changed and it has frozen a few times. Jane
...See More
avast
Q
Comments (13)
urlee, According to the link below during the installation, avast! copies some critical system files into the Chest, under the "System files" category. Those files might cause the operating system to crash if they get infected by a virus. If needed, those files can be restored from the Chest to their original location. Should an unknown virus infect the computer despite the extensive protection from the avast! antivirus package and alter an important system file, it can then be easily restored to its original state. HTH. Terry Here is a link that might be useful: Avast Forum
...See More
ravencajun Zone 8b TX
17 years ago
last modified: 11 years ago
you had a few pretty nasty infections there, keep that malwarebytes updated and continue to run scans daily for a few days to see if anything else pops up. You can also do an online scan to see if it finds anything.

FREE Online Virus Scan
mee_tooo
Original Author
17 years ago
last modified: 11 years ago
Thanks for the suggestion, ravencajun.

I'll scan every day for awhile...

I've got infected file in avast! virus chest, but...

Comments (4)

zep516

mee_tooo
Original Author

Related Discussions

ravencajun Zone 8b TX

mee_tooo
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

I've got infected file in avast! virus chest, but...

Comments (4)

zep516

mee_toooOriginal Author

Related Discussions

ravencajun Zone 8b TX

mee_toooOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

mee_tooo
Original Author

mee_tooo
Original Author