I've got infected file in avast! virus chest, but...

17 years ago

Hello, everyone!

I recently did a virus scan (using avast!) and an infected file was found. The file, named pebapehe.dll, was moved to the "virus chest."

Now, however, when I start my computer, I get 2 error messages. One says "Error loading c:\windows\system32\pebapehe.dll" and the other says "Error loading c:\windows\system32\modubelo.dll."

If I go ahead and close the error messages, the computer continues to boot up and perform normally.

Any suggestions how to get rid of these error messages?

Thanks!

Sort by:Oldest

Comments (4)

zep516
17 years ago
last modified: 11 years ago
Lets see if there is anything else that Avast may have missed, This scan could take a while to complete:

Please download Malwarebytes' Anti-Malware to your desktop. Click here
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
Â If an update is found, it will download and install the latest version.
Â Once the program has loaded, select "Perform Full Scan", then click Scan.
Â The scan may take some time to finish,so please be patient.
Â When the scan is complete, click OK, then Show Results to view the results.
Â Make sure that everything is checked, and click Remove Selected.
Â When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
Â The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Â Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
mee_tooo
Original Author
17 years ago
last modified: 11 years ago
zep516 --

Thanks for the response. I followed your advice, downloaded the Malwarebytes' Anti-Malware, and ran the full scan. It found (and corrected) 19 PROBLEMS!! The error messages no longer appear at startup.

I'm going to download Malwarebytes' Anti-Malware to my other 2 computers and scan both of them, too.

Again, thanks a million for letting me know about the great software!

Below is the log which resulted from the scan:

Malwarebytes' Anti-Malware 1.39
Database version: 2424
Windows 5.1.2600 Service Pack 1

7/14/2009 12:13:04 AM
mbam-log-2009-07-14 (00-13-04).txt

Scan type: Full Scan (C:\:D:\:E:\:)
Objects scanned: 216142
Time elapsed: 1 hour(s), 32 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 4
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\(36890dc8-c0ea-4ec9-ae63-95ba567d7f60) (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\(36890dc8-c0ea-4ec9-ae63-95ba567d7f60) (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\(04a38f6b-006f-4247-ba4c-02a139d5531c) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\(ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4) (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\(2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\(3c2d2a1e-031f-4397-9614-87c932a848e0) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\(2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c) (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pivopizuhi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm53cc8936 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\(ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4) (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\davy\local settings\temp\e.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Davy\local settings\temporary internet files\Content.IE5\OPK5EVO1\load[1].php (Trojan.Downloader) -> Quarantined and deleted successfully.
Related Discussions
Got a Virus
Q
Comments (6)
Dee_can When you get a Virus in your computer that will not clean or fix. It is usually because it is in your System Restore folder. And the Virus scanner cannot remove it from that folder.The first step to clearing a virus is to ,, Turn off your System Restore folder. It will ask you if you are sure you want to do that. Click yes. Run your Virus scanner. It will remove the virus or Trojan. When done shut computer down. Reboot computer. Then make certain to turn System Restore back on . Run your Virus scanner again. You will see that the problem is gone. I am certain the others who answered your posting may have forgotten to clue you into this step. Since that is the first thing that is always suggested in this Forum. Good Luck Dian
...See More
My netbook got hit with a virus
Q
Comments (16)
Karla, I did the same thing. One of the screens which popped up looked just like AVG, which is my AV. It was running a scan but there were smaller windows which looked like Windows and said,'security alert! your computer has a virus, you must update your antivirus. It had the colors of a Windows warning with the red X and blue background. The AV scan was zipping along with these alerts popping up. I was so confused, luckily I didn't react immediately (which is what I tend to do), I sat and looked at the windows and realized the scan (which looked exactly like AVG) was not AVG. It was missing the 'G'. The top of the screen just said AV. When I saw that, I knew the other boxes weren't Windows. I couldn't X anything or stop the scan. I tried to open AVG but it wouldn't open. I tried Malwarebytes, no luck. I then tried to shut down the computer and the Start button wouldn't work. More pop-ups all over the place. I manually shut the computer off. When I restarted, I did the same as Karla. I clicked on Malwarebytes immediatelly before the other processes started. It instantly grabbed 3 items before it scanned (thought that was odd). After the scan it showed 7 items: Trojan horse Fake AV.CDC Virus identified Exploit PDF Trojan.Fraudepack AV Suite Rogue.AVSecurity Suite Temp Files IE5 Rogue AV Security Suite. I don't know how to show the log. I might reinstall Windows and be done with this. It was very upsetting. My netbook seems to work normally but the proxy settings were changed and it has frozen a few times. Jane
...See More
Odd Avast results & can't take action
Q
Comments (2)
Could it be that these were previously "hidden files" that you chose to make visible? I think Avast does not scan hidden files. If no infection was shown, I would not be concerned about those that were not scanned. I'm sure you also scan with other programs that search for malware, so don't be overly concerned. Just my opinion, of course.
...See More
Help! I've got the Think Point safe startup screen--what now?
Q
Comments (13)
Hi alisande, BBBluz (do we like BB King, BTW?) Actually that was a nickname given to me by my dearly departed grandfather because of my BIG blue eyes! But, yes! I do like BBKing! Love the blues! I'm glad you posted at LandzDown, I see you found out a few things that were needing attention. Corrine is one of the best in the field of Security. @ mike kaiser: Yes! I am a wannabe. But I've taken it one step further than wanting...I am a gonnabe! I want to be the best that I can be to help those who can't help themselves. I don't see how that would render one to be self-important. The one thing that I have found while helping others to solve their computer problems, is that not everyone is cut out for learning the Technology that is closing in on us and making our lives difficult. I am not here to help criticize the work of others, just to protect and teach those who are vulnerable to those who create malware and get rich at the expense of those who are unaware of such tyranny that we face while surfing the web. The Web of Trust add on does this very well. Even if you click on a familiar link that is good, there are "sub links" within links that are not so good. I have found many while researching and will do my best to protect and teach those who are not aware of this. That is my goal! Safe surfing and to teach others about the hazards there of. I am not here to criticize as you have in your post, but to teach and give of myself what others have given to me. I can tell that you are quite an educated man and I'm sure that is your goal as well. To be completely honest...your response had left me baffled! WOT definition: With over 13 million users worldwide, Web of Trust offers Internet users preventive protection against online threats and scams. WOT's patent-pending reputation management system computes ratings from individual users and trusted sources based on trustworthiness, vendor reliability, privacy, and child safety. Sophisticated algorithms guarantee objective reputation management, ensure reliability, and protect against manipulation.
...See More
ravencajun Zone 8b TX
17 years ago
last modified: 11 years ago
you had a few pretty nasty infections there, keep that malwarebytes updated and continue to run scans daily for a few days to see if anything else pops up. You can also do an online scan to see if it finds anything.

FREE Online Virus Scan
mee_tooo
Original Author
17 years ago
last modified: 11 years ago
Thanks for the suggestion, ravencajun.

I'll scan every day for awhile...

I've got infected file in avast! virus chest, but...

Comments (4)

zep516

mee_tooo
Original Author

Related Discussions

ravencajun Zone 8b TX

mee_tooo
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

I've got infected file in avast! virus chest, but...

Comments (4)

zep516

mee_toooOriginal Author

Related Discussions

ravencajun Zone 8b TX

mee_toooOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

mee_tooo
Original Author

mee_tooo
Original Author