Author Topic: Can't remove Win32.Downloader.gen  (Read 23834 times)

0 Members and 1 Guest are viewing this topic.

Jim Flagarty

  • Guest
Can't remove Win32.Downloader.gen
« on: March 14, 2013, 02:02:19 AM »
This morning, Avast notified me that I needed to update a few of my programs, Utorrent being one of them.  After I went through with the updating, I opened Utorrent and didn't like their new layout.  So I did a Google search "previous Utorrent version" and found a website called "oldapps(.)com".  Avast Webreputation Alert said it had a good rating, so I went to the site, downloaded "uTorrent-3.2.2_build_285705" and went through with the installation.  During which, I was given the option to download their toolbar, which I denied by unchecking the appropriate box. 

All went well, that is until the installation completed.  Moments later, my Firefox browser closed and restarted with the Utorrent toolbar installed, and a random pop-up window appeared.  Avast didn't notify me of any problems, so I ran Spybot Search & Destroy and it found "Win32.Downloader.gen".

Unfortunately, it couldn't immediately remove the virus, saying I needed to run Spybot again after a reboot.  After the reboot and scan, it appeared to remove the virus, but when I ran a third scan, an hour later, the virus once again showed up in the scan results.  This time, I was unable to remove it.  I then ran an Avast Full system scan, but it didn't find any problems.  Although, I did scan the infected file "uTorrent-3.2.2_build_285705" on https://www.virustotal.com/en-gb/ and it found the virus I mentioned.  As of now, I don't know what to do and would appreciate any help I can get. 

Thanks for taking the time to read my post.
« Last Edit: March 14, 2013, 02:31:37 AM by Jim Flagarty »

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: Can't remove Win32.Downloader.gen
« Reply #1 on: March 14, 2013, 02:54:54 AM »
Update avast, MBAM, Spybot, and download and install and update SuperAntiSpyware and run your computer in safe mode. Hope this time it will work? Report back if it finds anything?
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

augustus

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #2 on: March 14, 2013, 03:53:27 AM »
http://www.spywareremovaltoolkit.com/all-detail/Win32.Downloader-gen.Trj.html#
download and update and scan
and if you may, in this forum I see a lot of win32.downloader.gen, or win32.malware.gen or win32....opt for win8 it will not be infected by these viruses

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: Can't remove Win32.Downloader.gen
« Reply #3 on: March 14, 2013, 04:06:35 AM »
Windows 8 is not listed under the infected system, but just to be on the safe side it's best to remove it.
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

augustus

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #4 on: March 14, 2013, 04:21:24 AM »
yes that's the point staticguy it is not listed under the infected system, and from my experience win8 users do not complain about any sort of win32....malwares

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: Can't remove Win32.Downloader.gen
« Reply #5 on: March 14, 2013, 05:03:23 AM »
Oh okay fair enough. Based on your experience you do wat u know it's best  :)
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37506
  • Not a avast user
Re: Can't remove Win32.Downloader.gen
« Reply #6 on: March 14, 2013, 07:57:44 AM »

Spybot - Search & Destroy 2.0
http://www.pcmag.com/article2/0,2817,2412372,00.asp

Quote
" In testing, it proved almost 100 percent ineffective

Jim Flagarty

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #7 on: March 14, 2013, 06:17:11 PM »
Thanks for replying, everyone.

I've done a number of safe-mode scans, avast and MBAM weren't able to detect anything.  I then downloaded, updated and did a full scan with SuperAntiSpyware and it while it removed 78 adware cookies, it didn't even find the Win32 thing.  From there, I scanned yet again using Spybot, and it detected the virus, removed it, but it came back when I restarted my laptop.

One thing I didn't mention before is that since yesterday, every time I turn on my laptop a window will pop-up for about 30 seconds, warning me of "compatibility issues" that I'm positive is fake.  I'll upload a screencap.



After trying all your advice, I'm out of ideas. 
« Last Edit: March 14, 2013, 10:17:01 PM by Jim Flagarty »

Jim Flagarty

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #8 on: March 14, 2013, 10:21:40 PM »
http://www.spywareremovaltoolkit.com/all-detail/Win32.Downloader-gen.Trj.html#
download and update and scan
and if you may, in this forum I see a lot of win32.downloader.gen, or win32.malware.gen or win32....opt for win8 it will not be infected by these viruses

Sorry, I forgot to try the link you provided.  I'm downloading it right now, will do a scan in a moment. 

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove Win32.Downloader.gen
« Reply #9 on: March 14, 2013, 10:26:25 PM »
Hi lets have a look .. As you may have noticed a lot of these automatic removal tools do not see it .  I would not use a tool from the web that advertises they can clean it, as you may get more toolbars or be asked to pay for the removal

Download OTL  to your Desktop
Secondary link
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.


  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT


  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Attach both logs

Jim Flagarty

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #10 on: March 14, 2013, 11:23:49 PM »
Hey, I hope these help. 

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove Win32.Downloader.gen
« Reply #11 on: March 14, 2013, 11:38:16 PM »
Let me know if this works

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:OTL
SRV - [2013/03/06 09:36:52 | 000,093,984 | ---- | M] (Conduit) [Auto | Running] -- C:\Program Files\SearchProtect\bin\CltMngSvc.exe -- (CltMngSvc)
IE - HKLM\..\URLSearchHook: {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-79315306-941780379-3646258439-1000\..\URLSearchHook: {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentControl_v6 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3289075&CUI=UN10905751483721047&UM=2&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "uTorrentControl_v6 Customized Web Search"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3289075&SearchSource=2&CUI=UN10905751483721047&UM=2&q="
[2013/03/13 12:49:12 | 000,001,013 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\xt9ip9ut.default\searchplugins\conduit.xml
O2 - BHO: (uTorrentControl_v6 Toolbar) - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentControl_v6 Toolbar) - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [SearchProtectAll] C:\Program Files\SearchProtect\bin\cltmng.exe (Conduit)
O4 - HKU\S-1-5-21-79315306-941780379-3646258439-1000..\Run: [SearchProtect] C:\Users\Ryan\AppData\Roaming\SearchProtect\bin\cltmng.exe (Conduit)
[2013/03/14 17:40:58 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\SearchProtect
[2013/03/13 12:49:44 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2013/03/13 12:49:12 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Local\CRE
[2013/03/13 12:49:01 | 000,000,000 | ---D | C] -- C:\Program Files\SearchProtect
[2013/03/13 12:48:21 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Local\Conduit

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Jim Flagarty

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #12 on: March 15, 2013, 12:30:49 AM »
Alrighty, here is the log from the quick scan.  When the computer rebooted after the "run fix" scan, the "compatibility issues" pop-up appeared again, so I think I still have the virus. 

Oh, I can't believe I didn't think to do this earlier, but I just went to Control Panel and in the list of programs, I see that I have something called "Search Protect by conduit" that was installed yesterday.  Should I try to uninstall it? 
« Last Edit: March 15, 2013, 12:35:18 AM by Jim Flagarty »

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove Win32.Downloader.gen
« Reply #13 on: March 15, 2013, 01:39:31 PM »
The popup is a genuine windows one, just place a tick in the box "do not show this again"

Yes uninstall search protect, but you will probably get a popup saying it can't be uninstalled (it has already gone)
Go yes to remove from the uninstall list

How is the computer otherwise ?

Jim Flagarty

  • Guest
Re: Can't remove Win32.Downloader.gen
« Reply #14 on: March 15, 2013, 06:56:53 PM »
It's gone! 

Sure enough, the conduit thing was already removed, all I had to do was delete it from the list. 

And I'll take your word that the compatibility pop-up is genuine, I just found it weird how it only showed up after getting the virus, 2 days ago.  I clicked "don't show this again" so that should be the end of that. 

One more thing, I'm sure this isn't a big deal but since I ran the OTL fix/reboot, 2 desktop.ini files are on my desktop.  From what I read, they're nothing to worry about but I thought I'd mention it. 

But yeah, thanks so much for your help!  This is the first virus I ever got so I'm glad it wasn't a bad one.  I got careless and downloaded a program from a random site, I'll make sure to never do that again.

Have a nice day :)