Tech Support Forum - View Single Post - Trojan found - xlibgfl254.dll infected by Generic Downloader.bt

Sempurna · 02-10-2007, 02:23 AM

Hi megan,

I see why Kaspersky couldn’t find the malware file. It was locked, so Kaspersky couldn’t scan it.

OK, here’s some additional instructions.

Please download the Killbox by Option^Explicit and save it to your desktop.

NOTE: In the event you already have Killbox, this is a new version that I need you to download.

Please double-click Killbox.exe to run it.
From the main Killbox window, select:
- "Delete on Reboot".
- "All Files".
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C:

C:\WINDOWS\system32\xlibgfl254.dll
Return to Killbox, go to the "File" menu, and choose "Paste from Clipboard".
This is pasted into the "Full Path of File to Delete" field.
There’s a little arrow (drop-down arrow) next to that field. If you expand it, the lines that you pasted must be there together (if the files are present!).
Click the button with the red circle and white X ("Delete File" button). Click "Yes" at the "Delete on Reboot" prompt. Click "No" at the "Pending Operations" prompt.

If your computer does not reboot automatically, please reboot it manually.

NOTE: If you receive a message such as, "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, CLICK HERE to download and run missingfilesetup.exe. Then try Killbox again.

NEXT:

Please reboot your computer normally into Windows and then please post the ComboFix log and a new HijackThis log.

How are things running now? Please let me know of any problems that still persist.

02-10-2007, 02:23 AM	#7 (permalink)
Sempurna Analyst, Security Team Join Date: Sep 2006 Posts: 1,302 OS: Windows XP SP2	Hi megan, I see why Kaspersky couldn’t find the malware file. It was locked, so Kaspersky couldn’t scan it. OK, here’s some additional instructions. Please download the Killbox by Option^Explicit and save it to your desktop. NOTE: In the event you already have Killbox, this is a new version that I need you to download. Please double-click Killbox.exe to run it. From the main Killbox window, select: "Delete on Reboot". "All Files". Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C: C:\WINDOWS\system32\xlibgfl254.dll Return to Killbox, go to the "File" menu, and choose "Paste from Clipboard". This is pasted into the "Full Path of File to Delete" field. There’s a little arrow (drop-down arrow) next to that field. If you expand it, the lines that you pasted must be there together (if the files are present!). Click the button with the red circle and white X ("Delete File" button). Click "Yes" at the "Delete on Reboot" prompt. Click "No" at the "Pending Operations" prompt. If your computer does not reboot automatically, please reboot it manually. NOTE: If you receive a message such as, "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, CLICK HERE to download and run missingfilesetup.exe. Then try Killbox again. NEXT: Please reboot your computer normally into Windows and then please post the ComboFix log and a new HijackThis log. How are things running now? Please let me know of any problems that still persist. __________________ Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum