Computer help Win32

JustJay · Postby **JustJay** » December 26th, 2008, 7:11 am

Hello everyone.

I am getting an error message in window$ that says something like, "Host Process for Win32 has encountered an error and needs to close, sorry for the inconvenience."

Everytime I go to windows update, it redirects me to M$n.com's home page. I just tried to go to windows update here at work and it is working fine.

Could I have an adware problem or Maleware issue?

Can anybody help me?
Thanks

Tim Elston · Postby **Tim Elston** » December 26th, 2008, 9:08 am

Others know better than I do, but the first thing I would do is clear the browser file and cookie cache (IE > Tools > Interet Options > different tabs and buttons, depending on version) and delete any suspicious objects from "c:\windows\downloaded program files". Then close all instances of IE and try again.

If that doesn't help, then you may need to apply a hotfix specific to your Service Pack 1, SP2, or SP3 installation (whichever you have; Control Panel > Add or Remove Programs). To find out whether a hotfix might help, type the exact error message into google and see whether you find a page that directs you to one.

That's where I'd start. If that doesn't help, Googling and trying other solutions to the specific error might lead you to a resolution.

beckrl · Postby **beckrl** » December 26th, 2008, 3:07 pm

JustJay

You may have tried this already "system restore" If that doesn't work.

It would seem you are infected by Zlob Torjan. That is the redirection.
For this go to http://www.bleepingcomputer.com/combofi ... e-combofix
Download combofix and run it a stand alone.

To help with drive cleanup use ATF Cleaner it a stand alone which means you do'nt have to install.
http://majorgeeks.com/ATF_Cleaner_d4949.html

The second thing is Win32 error:
http://support.Micro$oft.com/kb/931852/

Hope all this helps, take your time and report back.

JustJay · Postby **JustJay** » January 5th, 2009, 8:17 am

Beck

Thanks. The Combo-fix did the thing. It deleted a bunch of dll's from Facebook.

turbotim · Postby **turbotim** » January 5th, 2009, 10:02 am

beckrl wrote:It would seem you are infected by Zlob Torjan. That is the redirection.
For this go to http://www.bleepingcomputer.com/combofi ... e-combofix
Download combofix and run it a stand alone.

Thanks for this information.. I may be having a similar problem. I was following this one that you have suggested. I drug the back-up icon to dropped it in the combo fix icon. It started scanning but detected the AVG anti virus and said I should disable it or something How do I do that?

Thanks

turbotim · Postby **turbotim** » January 5th, 2009, 10:52 am

Got it thanks...

turbotim · Postby **turbotim** » January 5th, 2009, 11:29 am

Beck...

After I did all the combo fix, I was able to finally install Spybot. And yep, it detected the Zlob Trojan. Got rid of it and all is right with it.

Thank you, thank you, thank you..... God bless you...

beckrl · Postby **beckrl** » January 5th, 2009, 2:05 pm

turbotim wrote:Beck...

After I did all the combo fix, I was able to finally install Spybot. And yep, it detected the Zlob Trojan. Got rid of it and all is right with it.

Thank you, thank you, thank you..... God bless you...

Glad to hear it helped :wink:

You were right to scan with another software for anything that combofix may not have a database for. It's like anyother software it needs to be updated.

I drug the back-up icon to dropped it in the combo fix icon

Yea, You can even write a code on notepad and drop it into combofix's icon and it will run that code and delete. This is if you know what code you what to delete. but that's for another time.

turbotim · Postby **turbotim** » January 5th, 2009, 3:18 pm

Tim wrote: I drug the back-up icon and dropped it in the combo fix icon

Yea, You can even write a code on notepad and drop it into combofix's icon and it will run that code and delete. This is if you know what code you what to delete. but that's for another time.

I saved the code on the notepad at the end. But I didn't know what to do with it. It's on my storage device. What would I do with it?

Before the combofix, I could not download spybot or windows defender or the others I tried. It kept saying it couldn't find the server. It was maddening.. But I was so excited when I read this thread and tried what you suggested. It was some work, but I am so glad it's working now. I had to shut the wi-fi off b/c being on the internet was a pain. I worked offline, but an error would pop up and then it would say it was shutting down in 59 seconds. And it did...

Thanks again.. What did the trojan do to my computer?

beckrl · Postby **beckrl** » January 5th, 2009, 4:07 pm

Thanks again.. What did the trojan do to my computer?

Perform various malicious actions on the compromised computer.

http://www.symantec.com/security_response/writeup.jsp?docid=2005-042316-2917-99

Quote:
Yea, You can even write a code on notepad and drop it into combofix's icon and it will run that code and delete. This is if you know what code you what to delete. but that's for another time.

I saved the code on the notepad at the end. But I didn't know what to do with it. It's on my storage device. What would I do with it?

What to do with the combofix log file "delete." The file is generated for a help file. In that your pc is ok, there is no need for it.

Do not use in this manner unless told
What I was referring to was a script that can be cut and pasted into notepad for more help.

Do not use in this manner unless told

Again glad I could help.

JustJay · Postby **JustJay** » January 5th, 2009, 4:35 pm

Beckrl,
I am now working on a friend's desktop and it is doing the same thing, except extremely worst. It won't recognize the d:/ so I can't put combo fix on that way. It won't go to that site so I can download it. I can't even email it to myself on yahoo cause the file has to be "downloaded" and it blocks that.

What to do oh great one? :lol:

How about a USB memory stick?

turbotim · Postby **turbotim** » January 5th, 2009, 4:54 pm

beckrl wrote:
Thanks again.. What did the trojan do to my computer?

Perform various malicious actions on the compromised computer.

http://www.symantec.com/security_response/writeup.jsp?docid=2005-042316-2917-99

Quote:
Yea, You can even write a code on notepad and drop it into combofix's icon and it will run that code and delete. This is if you know what code you what to delete. but that's for another time.

I saved the code on the notepad at the end. But I didn't know what to do with it. It's on my storage device. What would I do with it?

What to do with the combofix log file "delete." The file is generated for a help file. In that your pc is ok, there is no need for it.

Do not use in this manner unless told
What I was referring to was a script that can be cut and pasted into notepad for more help.
Do not use in this manner unless told

Again glad I could help.

Told by whom? I read where it said to post it for a helper to read. So i just saved it.

Postby **Pastor Gary** » January 5th, 2009, 5:18 pm

Cough - cough... *** (AHEM) *** Cough - cough...

turbotim · Postby **turbotim** » January 6th, 2009, 10:30 am

Pastor Gary wrote:Cough - cough... *** (AHEM) *** Cough - cough...

That's funny..

But it's not mine, it belongs to the school where I teach. :lol:

beckrl · Postby **beckrl** » January 6th, 2009, 1:19 pm

turbotim wrote:
beckrl wrote:
Thanks again.. What did the trojan do to my computer?

Perform various malicious actions on the compromised computer.

http://www.symantec.com/security_response/writeup.jsp?docid=2005-042316-2917-99

Quote:
Yea, You can even write a code on notepad and drop it into combofix's icon and it will run that code and delete. This is if you know what code you what to delete. but that's for another time.

I saved the code on the notepad at the end. But I didn't know what to do with it. It's on my storage device. What would I do with it?

What to do with the combofix log file "delete." The file is generated for a help file. In that your pc is ok, there is no need for it.

Do not use in this manner unless told
What I was referring to was a script that can be cut and pasted into notepad for more help.
Do not use in this manner unless told

Again glad I could help.

Told by whom? I read where it said to post it for a helper to read. So i just saved it.

To whom? Me :wink:

or gone to http://www.bleepingcomputer.com/forums/

Jude 2