win32.downloader.gen

[littlesqueak7]

[attachment=4596]
[attachment=4595]

I am too much of a newbie to try anything on my own to remove win32.downloader.gen myself. I am hoping an expert here can help me get rid of it for good please!

Thanks for any help :huh:

 

[Fiery]

Hi littlesqueak7 and welcome to MalwareTips!

I'm Fiery and I would gladly assist you in removing the malware on your computer.

PLEASE NOTE: The first 3 posts of ALL new members require approval by mods/admins. Please be patient if you don't see your post immediately after submitting it.

Before we start:

• Note that the removal process is not immediate. Depending on the severity of your infection, it could take a long time.
• Malware removal can be dangerous. I cannot guarantee the safety of your system as malware can be unpredictable. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system. Therefore, I would advise you to backup all your important files before we start.
• Please be patient and stay with me until I give you the green lights and inform you that your PC is clean.
• Some tools may be flagged by your antivirus as harmful. Rest assure that ALL the tools we use are safe, the detections are false positives.
• The absence of symptoms does not mean your PC is fully disinfected.
• If you are unclear about the instructions, please stop and ask. Following the steps in the order that I post them in is vital.
• Lastly, if you have requested help on other sites, that will delay and hinder the removal process. Please only stick to one site.

<hr>

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
O4 - HKLM..\Run: [SearchProtectAll] C:\Program Files (x86)\SearchProtect\bin\cltmng.exe (Conduit)
O4 - HKCU..\Run: [SearchProtect] C:\Users\Liberte\AppData\Roaming\SearchProtect\bin\cltmng.exe (Conduit)
[2013/05/25 21:07:33 | 000,000,000 | ---D | C] -- C:\Users\Liberte\AppData\Roaming\SearchProtect

:Files
C:\Program Files (x86)\SearchProtect
ipconfig /flushdns /c

:Commands
[EMPTYTEMP]

Then click Run Fix. Let your PC reboot to normal mode. A new log will be created automatically, post the content in the next reply.

Next, Download Malwarebytes Anti-Rootkit from here to your Desktop

• Unzip the contents to a folder on your Desktop.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
• After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
• When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool(For Vista or Windows 7, right-click and select Run as Administrator to start)
• Click delete
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt

Download & SAVE to your Desktop RogueKiller or from here

• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select Run as Administrator to start
• Wait until Prescan has finished, then click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• Click delete and wait until it saids deleting finished
• Click on "Report" and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
  Exit/Close RogueKiller+

 

[littlesqueak7]

Hi littlesqueak7 and welcome to MalwareTips!

I'm Fiery and I would gladly assist you in removing the malware on your computer.

PLEASE NOTE: The first 3 posts of ALL new members require approval by mods/admins. Please be patient if you don't see your post immediately after submitting it.

Before we start:

• Note that the removal process is not immediate. Depending on the severity of your infection, it could take a long time.
• Malware removal can be dangerous. I cannot guarantee the safety of your system as malware can be unpredictable. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system. Therefore, I would advise you to backup all your important files before we start.
• Please be patient and stay with me until I give you the green lights and inform you that your PC is clean.
• Some tools may be flagged by your antivirus as harmful. Rest assure that ALL the tools we use are safe, the detections are false positives.
• The absence of symptoms does not mean your PC is fully disinfected.
• If you are unclear about the instructions, please stop and ask. Following the steps in the order that I post them in is vital.
• Lastly, if you have requested help on other sites, that will delay and hinder the removal process. Please only stick to one site.

<hr>

Open OTL. Under custom scan/fixes, copy and paste the following:

:OTL
O4 - HKLM..\Run: [SearchProtectAll] C:\Program Files (x86)\SearchProtect\bin\cltmng.exe (Conduit)
O4 - HKCU..\Run: [SearchProtect] C:\Users\Liberte\AppData\Roaming\SearchProtect\bin\cltmng.exe (Conduit)
[2013/05/25 21:07:33 | 000,000,000 | ---D | C] -- C:\Users\Liberte\AppData\Roaming\SearchProtect

:Files
C:\Program Files (x86)\SearchProtect
ipconfig /flushdns /c

:Commands
[EMPTYTEMP]

Then click Run Fix. Let your PC reboot to normal mode. A new log will be created automatically, post the content in the next reply.

Next, Download Malwarebytes Anti-Rootkit from here to your Desktop

• Unzip the contents to a folder on your Desktop.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
• After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
• When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool(For Vista or Windows 7, right-click and select Run as Administrator to start)
• Click delete
• Please post the content of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt

Download & SAVE to your Desktop RogueKiller or from here

• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select Run as Administrator to start
• Wait until Prescan has finished, then click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• Click delete and wait until it saids deleting finished
• Click on "Report" and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
  Exit/Close RogueKiller+

 

[littlesqueak7]

[attachment=4608]
[attachment=4606]

Fiery:
Thank you so much for offering to help me get rid of win32.downloader.gen and other malware on my computer. i am grateful there are people like you who are knowledgeable and have tools to help.

I followed your instructions and am attaching the logs as advised. No Malware was found using the Malwarebytes Anti-Rootkit, so there is no log.
=============================================
OTL Log:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtectAll deleted successfully.
C:\Program Files (x86)\SearchProtect\bin\cltmng.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect deleted successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\bin\cltmng.exe moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\ffprotect folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\Dialogs\spsd\images folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\Dialogs\spsd folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\Dialogs\spbd\images folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\Dialogs\spbd folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\Dialogs\lib folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\Dialogs folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect\bin folder moved successfully.
C:\Users\Liberte\AppData\Roaming\SearchProtect folder moved successfully.
========== FILES ==========
C:\Program Files (x86)\SearchProtect\ffprotect folder moved successfully.
C:\Program Files (x86)\SearchProtect\Dialogs\spsd\images folder moved successfully.
C:\Program Files (x86)\SearchProtect\Dialogs\spsd folder moved successfully.
C:\Program Files (x86)\SearchProtect\Dialogs\spbd\images folder moved successfully.
C:\Program Files (x86)\SearchProtect\Dialogs\spbd folder moved successfully.
C:\Program Files (x86)\SearchProtect\Dialogs\lib folder moved successfully.
C:\Program Files (x86)\SearchProtect\Dialogs folder moved successfully.
C:\Program Files (x86)\SearchProtect\bin folder moved successfully.
C:\Program Files (x86)\SearchProtect folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Liberte\Downloads\Malware Bytes LOGs\cmd.bat deleted successfully.
C:\Users\Liberte\Downloads\Malware Bytes LOGs\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Liberte
->Temp folder emptied: 100121012 bytes
->Temporary Internet Files folder emptied: 113264008 bytes
->Java cache emptied: 2302171 bytes
->FireFox cache emptied: 449802061 bytes
->Google Chrome cache emptied: 874063 bytes
->Apple Safari cache emptied: 36864 bytes
->Flash cache emptied: 60765 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 812451 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46463554 bytes
RecycleBin emptied: 1907320 bytes

Total Files Cleaned = 683.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 05272013_164216
======================================

 

[Fiery]

You're welcome

Are you still getting the win32.downloader.gen pop up?

Download Kaspersky Virus Removal Tool <a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow">from here</a></> <em>(Download Version 11. You'll have to enter your email address and name)</em>
<ol>
<li>Double-click the file and follow the on-screen prompts until it is installed</li>
<li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:
<ul>
<li><span style="color: #ff0000;">System Memory</span></li>
<li><span style="color: #ff0000;">Hidden startup objects</span></li>
<li><span style="color: #ff0000;">Disk boot sectors</span></li>
<li><span style="color: #ff0000;">Computer</span></li>
<li><span style="color: #ff0000;">Local Disk (C: )</span></li>
</ul>
</li>
<li>Click on <>Automatic Scan</></li>
<li>Now click the <>Start Scanning</> button, to run the scan</li>
<li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>
<li>Click <>Detected threats</> on the left</li>
<li>Now click the <>Save</> button, and save it as <>kaslog.txt</> to your <>Desktop</></li>
<li>Please attach kaslog.txt in your next reply.</li>
</ol>

 

[littlesqueak7]

Fiery:

I downloaded Kaspersky Virus Removal Tool and let it scan overnight. This morning it says "23 hours left" and 24% done, so I won't have an answer for you until tomorrow, it looks like. I never got a "pop up" before from Kaspersky regarding win32.downloader.gen, so I don't know what it looks like. I'll get back to you when Kaspersky is finished! Thanks for your patience....

Update 5/29/13 at 0445 hrs:
Kaspersky is still scanning! "No Threats Detected" and 60% done with 20 hours remaining, it says. Will check again this evening....

Update 5/29/13 at 1840 hrs:
Kaspersky is still scanning! "No Threats Detected" and 79% done with 11 hours remaining, it says. Will check again tomorrow morning....

 

[Fiery]

It's taking ALOT longer than I expected :S

 

[littlesqueak7]

That's for sure...I didn't expect it to take this long either, but I did download from the site you linked to and selected the options you recommended. My computer is not a slow computer either, so not sure why it takes this long. I did install two new hard drives last year that increased the C-drive to 2 TB from 1 TB and another storage drive of 2 TB. This in addition to hot swap storage. Not sure if this is what makes it take so long, but it is otherwise a pretty normal computer.

The good news is no infections detected so far

 

[Fiery]

Thanks for the update. Usually it should only take a few hours only though I have had users say it ran for over 12 hours. You must be the current record holder

Let me know when it is done. Don't edit your post as I won't receive a notification from it, just make a new one

 

[littlesqueak7]

Looks like I set a record--three days! Now it is 89% finished and says 6 hrs left. Still no threats detected. Hopefully it will be done this evening and I'll let you know what it says. I hope the malware is gone after all this!

 

[littlesqueak7]

Fiery:

Finally, 3 days later and 6,234,418 objects scanned, there are NO THREATS DETECTED by the Kaspersky virus scan tool! I am hoping this means the win32.downloader.gen is gone! Can you tell me what to do next to verify, or is this the final test to make sure?

I ran Spybot S&D, the program that always was picking up win32.downloader.gen on my computer and this time, it did not detect anything.

Thank you again for your expert help & advice. I will certainly be using the tools I learned here to continue to scan my computer to prevent re-infection in the future.

 

[Fiery]

That took a while indeed!

One more scan and then we will clean up and i'll make some recommendations for you.

Run Eset NOD32 Online AntiVirus here

Note: You will need to use Internet Explorer for this scan.
Vista / 7 users: You will need to to right-click on the Internet Explorer icon and select Run as Administrator

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your current antivirus software. You can usually do this with its Notfication Tray icon near the clock.
• Make sure that the option "Remove found threats" is Un-checked, and the following Advance Settings are Checked
  • Scan unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Click Scan
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
• Save that text file on your desktop. Copy and paste the contents of that log in your next reply to this topic.
• The log can also be found in logfile located at C:\Program Files\ESET\Eset Online Scanner\log.txt

 

[littlesqueak7]

Fiery:

Whew! Glad the Eset NOD32 scan didn't take 3 days--only overnight I hope no new viruses appeared being my McAfee virus protection was disabled overnight....

YES, it FOUND THREATS! 20 of them, and cleaned them out too. Possibly win32.downloader.gen was among them? I saw references to win32, but unsure since logs are pretty cryptic to me in the first place. The log was long, so instead of pasting here, I am attaching the file (word doc.)
----------------------------------------
Note: I was unable to find it in the path as described: logfile located at C:\Program Files\ESET\Eset Online Scanner\log.txt

Also, I think the format of the scanner has changed, as not all of the elements appeared as described to set the parameters: Make sure that the option "Remove found threats" is Un-checked, and the following Advance Settings are Checked

Scan unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
----------------------------------------------
I was able to export the file via the scan logs, the copying the contents and pasting in a text file, but it is TOO BIG (1642kb) to attach or copy to this post I then put it on a Word Document and saved it, that file is 40 pages long, but apparently only 121 kb. I hope the word doc is sufficient for you to read the log :s

[attachment=4691]

 

[Fiery]

Thanks for letting me know, guess I will update my instructions And good to ehar that it didn't take 3 days!

And those threats are ok, no worries there. They were either quarantined or not threats at all, just false positives.

How is your PC?

 

[littlesqueak7]

Fiery:

I think it's OK so far and Spybot didn't find anything on the last scan (it was the one always finding win32.downloader.gen and not being able to remove it.)

So I hope this means my computer is malware free at this point? :heart:

Perhaps you can give me some suggestions as to how to keep my computer clean. Some of the programs you had me install were free to try but I will have to buy eventually. If you recommend I buy the full version, I will consider it. I still have the other programs like McAfee VirusScan Enterprise, Spybot S&D and Adaware running.

I also have storage drives in my home network--maybe they need to be scanned too??? Let me know what you recommend...

 

[Fiery]

Hi,

I have posted my recommendations below. I suggest you uninstall Ad-aware, spybot and mcafee. Spybot has passed it's prime and there are better substitutes for the programs you have installed.

Some of the programs you had me install were free to try but I will have to buy eventually. If you recommend I buy the full version, I will consider it.

I personally don't believe paid software means better. There are plenty of free software that can fully protect your PC (I listed them below). Malwarebytes you can keep as an on-demand scanner. Perform a quick scan every few weeks.

If you are no longer experiencing any other issues, your PC is now clean!

Double click on OTL to run it

• Click on the Cleanup button at the top.
• You will be asked to reboot the machine to finish the Cleanup process. Choose Yes
• This will remove itself and other tools we may have used.

Also, open adwCleaner and click Uninstall

---

Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.

For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link

---

Keep your system updated
Keeping your programs (especially Adobe and Java products) updated is essential. Outdated programs make your PC more vulnerable to future malware threats. To help you:

• Download and install Update Checker. It will notify you if any of your programs require an update.
• Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office product bugs and vulnerabilities.
• Please ensure you update your system regularly and have automatic updates on. You can learn how to turn Automatic Updates on here

---

I also recommend you to switch your antivirus program to a better one. Here are some suggestions:

• avast! 8 Free Antivirus
• Avira AntiVir Personal
• Microsoft Security Essentials

In addition to your antivirus, you need additional protection such as a firewall and behavioural blocker. However, adding one of these programs may slow down performance. It is for you to decide the trade off between more security and a faster PC.

• Online Armor
• Comodo Firewall - If you are an advance user
• ZoneAlarm Free Firewall

Other steps that you may want to do to further protect your system/files:

• Sandboxie - "Quarantines" your browser so anything that you do in it will be isolated from your system.
• Backup important files regulary to an external hard-drive or USB

Here are only a few suggestions that will improve your system security. Should you wish to allow us to make full recommendations and set your PC up with maximum security, please start a thread here. Our community of PC enthusiasts and experts will give you feedback and help you secure your system from future malware infections.

Should you want to try a product but don't know how it performs, here is a list of current reviews to help you decide.

---

Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.

Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.

• KeyScramber - Encrypts your keystrokes to protect you against keyloggers that steals personal & banking information
• AdBlock - Disable/blocks advertisements on websites so you won't accidentally click on a malicious ad.
• NoScript - Disables Flash & Java contents to avoid exploits or drive-by attacks
• Web of Trust - Shows the website rating by other users and blocks dangerous and poor-rated sites

Google Chrome is another good browser that is faster and more secure than Internet Explorer by having a sandbox feature. Additionally, you can add the following add-on to Chrome to heighten security.

• AdBlock

---

Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.

• CCleaner
• Malwarebytes Anti-Malware

Other than that, stay safe out there! If you have any other questions or concerns, feel free to ask

My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.
​

 

[littlesqueak7]

Fiery:

Thank you for the recommendations! I uninstalled the AdAware, Spybot & McAfee Enterprise. I just installed the free version of Avast and it's running now I don't know if I should use the other ones concurrently, as they might have conflicts? :huh:

I also use Firefox primarily and not IE. I already use CCleaner, and now that I downloaded Malware Bytes, I will also use that in addition to Avast. Should I pay for the full version of Avast? What should I do with the other programs I downloaded as part of your removal process that eventually will ask for a renewal? I don't want them to conflict with Avast either.

Thank you for your help--you have taught me and guided me in successfully getting rid of win32.downloader.gen and any other malware in my computer!

 

[Fiery]

Hi,

You're welcome!

I just installed the free version of Avast and it's running now I don't know if I should use the other ones concurrently, as they might have conflicts?

Use only one antivirus at a time. having more than one will lower security and can cause your system to crash.

Should I pay for the full version of Avast?

You don't have to. If you use avast, and sandboxie and possibly Online armor, you have sufficient protection.

What should I do with the other programs I downloaded as part of your removal process that eventually will ask for a renewal?

You can get rid of all the programs we have used.

 

[littlesqueak7]

Fiery:

OK! I installed the free version of Avast and also Sandboxie. I have not installed the firewall program yet, will think about it. I also got rid of the programs you had me install to get rid of the malware.

Thank you again for the recommendations and answers to my questions--it was great working with you and getting help removing the win32.downloader.gen from my computer and getting suggestions on what to us for future protection. I am so grateful!

I sent you a donation via Paypal. I will certainly recommend Malware Tips to help anyone I know who gets malware! Your organization is extremely professional, knowledgeable and helpful, esp for someone like me

 

[Fiery]

You're very welcome!

Thanks for the donation

Cheers