IMMLNR.DLL infected with a Trojan Virus...help me..

mlsnet43 · 06-19-2006

Alright..I logged on this morning and kaspersky tells me this:

Attention! An infected object is detected!

Access to the object C:\WINDOWS\SYSTEM32\IMMLNR.DLL is blocked. Object is infected with a virus Trojan-Downloader.Win32.Con..... You are advised to delete this object.

I try to delete it, and my computer shuts down.

Help? Fast?

Thanks..

mlsnet43 · 06-19-2006

It also has now infected winlogon.exe...lmao...

here is hijack this, let me restart to do ewido..

mlsnet43 · 06-19-2006

oh and genie..I have yahoo messenger if you want..mlsnet43

joe5 · 06-19-2006

Originally Posted by mlsnet43

It also has now infected winlogon.exe...lmao...

here is hijack this, let me restart to do ewido..

Could you follow the instructions in order as listed , and make/post the hjt log after having run ewido?

mlsnet43 · 06-19-2006

Didn't think about that. Sorry

Here are both of them..

joe5 · 06-20-2006

First look for Starware in add/remove programs and uninstall it if present.

Then boot youre pc in safemode again , and then fix these with hjt:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=w...DsnJKz/X5XzroW 6QQxBBx0IetoltOOXNSbEayg/IBYs3H59gxfrt0CVJgu3OOEJ5Y2lCccCckJUgEd9KMj51JNyne aCsj/ 69CnubGGPE5i5ns2s1a1g7MjEue4zIQttNsF6caZbXsvGr0WJO exjmk5fuPZknDAwtA
O2 - BHO: (no name) - {07e9e8a5-a0e9-4f10-b792-20b4dee42034} - C:\WINDOWS\system32\IMMlnr.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O20 - Winlogon Notify: IMMlnr - C:\WINDOWS\SYSTEM32\IMMlnr.dll

Then delete the file in bold , reboot , and post a new hjt log please.

mlsnet43 · 06-22-2006

Oh, yes, I got rid of it myself. I was waiting for you guys, and I fixed the problem. Oh well, lol. thanks though.

06-19-2006	#1
mlsnet43 Bronze Member Join Date: May 2006 Posts: 12	IMMLNR.DLL infected with a Trojan Virus...help me.. Alright..I logged on this morning and kaspersky tells me this: Attention! An infected object is detected! Access to the object C:\WINDOWS\SYSTEM32\IMMLNR.DLL is blocked. Object is infected with a virus Trojan-Downloader.Win32.Con..... You are advised to delete this object. I try to delete it, and my computer shuts down. Help? Fast? Thanks..

06-19-2006	#4
joe5 Elite Member Join Date: Jun 2005 Location: Netherlands Posts: 9,025	Originally Posted by mlsnet43 It also has now infected winlogon.exe...lmao... here is hijack this, let me restart to do ewido.. Could you follow the instructions in order as listed , and make/post the hjt log after having run ewido? __________________ - PCHF Team. - (NL) - Mal-ware Eradicator! - - Online AV Scans - HijackThis! - Bootdisk.com - ATF-Cleaner - Stinger - 'Prework' - 'Afterwork' - PCHF Rules - Donate to PCHF. And get>

06-20-2006	#6
joe5 Elite Member Join Date: Jun 2005 Location: Netherlands Posts: 9,025	First look for Starware in add/remove programs and uninstall it if present. Then boot youre pc in safemode again , and then fix these with hjt: R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=w...DsnJKz/X5XzroW 6QQxBBx0IetoltOOXNSbEayg/IBYs3H59gxfrt0CVJgu3OOEJ5Y2lCccCckJUgEd9KMj51JNyne aCsj/ 69CnubGGPE5i5ns2s1a1g7MjEue4zIQttNsF6caZbXsvGr0WJO exjmk5fuPZknDAwtA O2 - BHO: (no name) - {07e9e8a5-a0e9-4f10-b792-20b4dee42034} - C:\WINDOWS\system32\IMMlnr.dll O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) O20 - Winlogon Notify: IMMlnr - C:\WINDOWS\SYSTEM32\IMMlnr.dll Then delete the file in bold , reboot , and post a new hjt log please. __________________ - PCHF Team. - (NL) - Mal-ware Eradicator! - - Online AV Scans - HijackThis! - Bootdisk.com - ATF-Cleaner - Stinger - 'Prework' - 'Afterwork' - PCHF Rules - Donate to PCHF. And get> Last edited by joe5; 06-20-2006 at 12:59 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

06-22-2006	#7
mlsnet43 Bronze Member Join Date: May 2006 Posts: 12	Oh, yes, I got rid of it myself. I was waiting for you guys, and I fixed the problem. Oh well, lol. thanks though.