NEED HELP!! My computer caught a virus!!

[legacy927]

Hi guys,

Unfortunately, I caught a virus on my desktop at work. So I can't take it home to fix it. Stupid IT guy doesnt want to help. I've used Symantec Anti Virus and Windows Defender...both is not working for me.

I found the virus on WINDOWS/SYSTEM32, I cant delete iehelper.dll manually...

I've tried googling, but nothing seem to work. Any ideas? I would format it myself, but the IT guy is being such an ass, he said he'll look for the drivers when he's free...when hes not even doing shit at work...

Thanks in advance.....

[airforceone451]

Do you know what the virus name is? sometimes you can find specific anti virus programs that just delete that virus and its associated files. Also, I recommend AVG or NOD32. Windows defender is pos :)

[legacy927]

i believe the virus is called IEHelper.dll (supposely its a trojan) but i did find the file on the windows/system32 folder, but it wont allow me to delete it...

[legacy927]

i also tried to unregister / uninstall through command prompt, but it doesnt seem like its working at all...thats all i found on google...im about to download something off Cnet..

[CrimsonRockett]

Should've got a mac.

:keke:

I'll see if my friend can help out with this.

He works in IT.

[legacy927]

^^^this company is too cheap for a MAC...i have a stupid Dell that still uses 512MB...LOL

[Bubbles]

Trojan.

It's always a trojan.

[legacy927]

im downloading AVG as per AF1 recommended...see what happens...

[thurman548]

Discovered: January 20, 2005
Updated: February 13, 2007 12:50:06 PM
Also Known As: PWSteal.Tarno.L
Type: Trojan Horse
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP


The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as Infostealer.Tarno.L.
Delete the value that was added to the registry.

For specific details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
"How to disable or enable Windows Me System Restore"
"How to turn off or turn on Windows XP System Restore"

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, re-enable System Restore by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.


2. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:
Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted daily. You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.


3. To scan for and delete the infected files
Start your Symantec antivirus program and make sure that it is configured to scan all the files.
For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."
Run a full system scan.
If any files are detected as infected with Infostealer.Tarno.L click Delete.

Note: If your Symantec antivirus product reports that it cannot delete an infected file, Windows may be using the file. To fix this, run the scan in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode." Once you have restarted in Safe mode, run the scan again.

After the files are deleted, restart the computer in Normal mode and proceed with section 4.


4. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Click Start > Run.
Type regedit

Then click OK.


Navigate to the key and delete the following values:

HKEY_CLASSES_ROOT\IEHlprObj.IEHlprObj
HKEY_CLASSES_ROOT\IEHlprObj.IEHlprObj.1
HKEY_CLASSES_ROOT\CLSID\{FD8953C6-823F-46ab-8669-3B2BBF3A9210}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper\{FD8953C6-823F-46ab-8669-3B2BBF3A9210}
HKEY_CLASSES_ROOT\TypeLib\{A17C62F9-907A-4C34-B52A-11B55D190901}
HKEY_CLASSES_ROOT\Interface\{4988321C-EEC5-4EE7-BDE5-986823C4868B}


Exit the Registry Editor.

[thurman548]

Tell your IT guy he sucks azz!

[serris]

According to this link: What is iehelper.dll? - iehelper explanation. (http://www.what-is-exe.com/filenames/iehelper-dll.html)

you can stop the task and delete the file.

To get to the Task Manager, hit Ctrl+Alt+Del or right click the task bar and click on Task Manager.

Next, go to the Processes tab and look for iehelper.dll. Click on it and then click on End Process.

Go to the file location and then delete it. However, if none of that works, download Malwarebytes and install it on the computer. Run that and it should clean out the adware for you. If that doesn't work, reboot into Safe Mode and delete the file and do a scan in that mode.

I don't think formatting will be necessary unless all of the above doesn't work.

Good luck!

Or you can do what thurman548 posted. If you feel comfortable editing the registry. Just make sure you back up the registry before you edit it, in case something goes wrong (i.e. programs won't work, Windows errors out, etc.)

[airforceone451]

Well, this is what I found...
First go to control+alt+delete and go to the processes tab.
Then find the process: tsadbot.exe
Then go to start>run>type in cmd
In the command prompt type in: cd\ - This will go to root directory, in this case probably your C:\ Drive
Next type in: regsvr32 /u iehelp02.dll
Hit enter
Then type in: regsvr32 /u iehelper02.dll
Hit enter
Then type in: regsvr32 /u iehelp~1.dll
Hit enter
Then type in: exit
Then go to start>run>regedit - This will bring up a new window
Find these registry entries
HKEY_CLASSES_ROOT\clsid\{748a5d0a-68d3-11d4-a67e-00e098823a80}
HKEY_CLASSES_ROOT\clsid\{b3eccac9-c7fa-462c-894b-8e9930a70e14}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b3eccac 9-c7fa-462c-894b-8e9930a70e14}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\browser helper objects\{b3eccac9-c7fa-462c-894b-8e9930a70e14}

and delete them.
The program file from what I understand is called Kugoo, so try deleting that folder under program files under C:\

[thurman548]

I forgot to tell you. if you logged onto any accounts online that is important change your password now (on a safe computer)! this is a password stealer. It would suck to have to deal with id theft or your bank info being compromised.

[legacy927]

I forgot to tell you. if you logged onto any accounts online that is important change your password now (on a safe computer)! this is a password stealer. It would suck to have to deal with id theft or your bank info being compromised.

crap.....imma change the passwords when i get home..i hope its not too late...

[legacy927]

Well, this is what I found...
First go to control+alt+delete and go to the processes tab.
Then find the process: tsadbot.exe
Then go to start>run>type in cmd
In the command prompt type in: cd\ - This will go to root directory, in this case probably your C:\ Drive
Next type in: regsvr32 /u iehelp02.dll
Hit enter
Then type in: regsvr32 /u iehelper02.dll
Hit enter
Then type in: regsvr32 /u iehelp~1.dll
Hit enter
Then type in: exit
Then go to start>run>regedit - This will bring up a new window
Find these registry entries
HKEY_CLASSES_ROOT\clsid\{748a5d0a-68d3-11d4-a67e-00e098823a80}
HKEY_CLASSES_ROOT\clsid\{b3eccac9-c7fa-462c-894b-8e9930a70e14}
HKEY_LOCAL_MACHINE\software\classes\clsid\{b3eccac 9-c7fa-462c-894b-8e9930a70e14}
HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\explorer\browser helper objects\{b3eccac9-c7fa-462c-894b-8e9930a70e14}

and delete them.
The program file from what I understand is called Kugoo, so try deleting that folder under program files under C:\


Downloaded AVG, nothing...

I was also looking for Kugoo under program files, nothing either.

I searched all above in registry entries, found nothing. Im not sure if Symantec did anything earlier..but its stopped popping up..but the stupid "warning" from spyware protect 2009 kept on popping up...so i know the virus is still there..

[mazersx]

just reformat it!

[legacy927]

According to this link: What is iehelper.dll? - iehelper explanation. (http://www.what-is-exe.com/filenames/iehelper-dll.html)

you can stop the task and delete the file.

To get to the Task Manager, hit Ctrl+Alt+Del or right click the task bar and click on Task Manager.

Next, go to the Processes tab and look for iehelper.dll. Click on it and then click on End Process.

Go to the file location and then delete it. However, if none of that works, download Malwarebytes and install it on the computer. Run that and it should clean out the adware for you. If that doesn't work, reboot into Safe Mode and delete the file and do a scan in that mode.

I don't think formatting will be necessary unless all of the above doesn't work.

Good luck!

Or you can do what thurman548 posted. If you feel comfortable editing the registry. Just make sure you back up the registry before you edit it, in case something goes wrong (i.e. programs won't work, Windows errors out, etc.)

Tried this also, "iehelper.dll" is not in the process tab..

[legacy927]

just reformat it!

i wanted to...but the stupid ass IT guy is not giving me the drivers...

[silviaguy240]

if its a work computer, back up all your stuff you need to disks then have the it guy come reformat the hard drive.

[lflkajfj12123]

damn crimson beat me to it :/

[SochBAT]

System restore point.

If that doesn't work, let it steal all your work data.

Then blame it on the IT guy.

You DID ask him to help, he declined. Fuck him.

Shitty IT FTL.

[orion::S14]

Try Malwarebyte's Anti-Malware...Google it.

Worked for me, I had a few similar issues.

??? - Brian

[legacy927]

okay, before I left work, I schedule a scan with AVG and Symantec overnight. When I came in this morning, AVG flagged all the trojans. So i deleted all of them. Symantec didn't catch anything. So I restarted the computer and since then, nothing popping up. I hope I removed all of it. I'm doing another scan just to double check.

I would like to thank all you guys for the advices...btw, the IT guy is a dick when I purposely asked if he bought the drivers in..he said he forgot!! what a dick!

[FaLKoN240]

I like adaware, malware bytes, spybot S&D and Eusing Registry Cleaner, shit is legit IMO.