Recurring File Anti Virus Warning

Prior22 · 11-02-2006, 04:17 PM

I keep on recieving this same file anti virus warning from Kaspersky: not-a-virus:AdWare.Win32.BHO.ba. I've rebooted the computer just like Kaspersky says and the pop up still happens. The location of the file is: C://windows/system32/windexserv.dll

My question is whether or not this adware is serious and how do I delete it. Thanks.

dorts · 11-02-2006, 05:53 PM

Hi,

Please do the following to do a manual deletion.

Safe Mode

Restart your computer.
Before the Windows logo appear, tap F8 repeatedly. In some systems, this may be the F5 key.
A menu should appear, select Safe Mode from the menu using your arrow keys and then hit Enter on your keyboard.
This will take a while than usual, so just wait.
After it loads, Login on your usual account.

Unhide Files

Go to My Computer->Tools->Folder Options->View tab:

Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Also make sure there is no checkmark beside Hide file extensions for known file types
Click Yes to confirm and then click OK.

File Deletion

Delete the following File.

C:/WINDOWS/system32/windexserv.dll

Reset hidden/system files and folders

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View tab.
Deselect the Show hidden files and folders option.
Select the Hide file extensions for known types option.
Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

After that, you should not receive anymore pop-ups from Kaspersky.

dorts · 11-02-2006, 05:57 PM

If you would like to make sure you are really clean of malware,

Please follow MicroBell's 5 Step process outlined here

After running through all the steps, best thing to do is have one of the HijackThis helpers take a look at a log.

Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\

Double click on HijackThis.exe to run the program.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless.

Prior22 · 11-02-2006, 06:33 PM

Before I perform all the steps you mentioned I was just curious if this piece of adware was serious. So far I havent recieved one popup or anything else that would alert me that its affecting my computer.

Ried · 11-02-2006, 07:30 PM

Hello Prior22,

It very well may be that the file deleted is the only piece of malware on your system, but malware rarely comes alone.

While deleting the file may have stopped your pop ups, there may be other pieces of it, or others, still lurking about your system that would eventually work their way back up and cause problems.

I would simply suggest you download HijackThis and post a log in the HijackThis forum--where we can give you more tailored instructions.

11-02-2006, 04:17 PM	#1 (permalink)
Prior22 Registered User Join Date: May 2006 Posts: 128 OS: XP	Recurring File Anti Virus Warning I keep on recieving this same file anti virus warning from Kaspersky: not-a-virus:AdWare.Win32.BHO.ba. I've rebooted the computer just like Kaspersky says and the pop up still happens. The location of the file is: C://windows/system32/windexserv.dll My question is whether or not this adware is serious and how do I delete it. Thanks.

11-02-2006, 05:53 PM	#2 (permalink)
dorts Analyst, Security Team Join Date: Mar 2006 Location: Singapore Posts: 1,599 OS: Windows XP SP2 My System	Hi, Please do the following to do a manual deletion. Safe Mode Restart your computer. Before the Windows logo appear, tap F8 repeatedly. In some systems, this may be the F5 key. A menu should appear, select Safe Mode from the menu using your arrow keys and then hit Enter on your keyboard. This will take a while than usual, so just wait. After it loads, Login on your usual account. Unhide Files Go to My Computer->Tools->Folder Options->View tab: Under the Hidden files and folders heading, select Show hidden files and folders. Uncheck the Hide protected operating system files (recommended) option. Also make sure there is no checkmark beside Hide file extensions for known file types Click Yes to confirm and then click OK. File Deletion Delete the following File. C:/WINDOWS/system32/windexserv.dll Reset hidden/system files and folders Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View tab. Deselect the Show hidden files and folders option. Select the Hide file extensions for known types option. Select the Hide protected operating system files option. Click Yes to confirm. Click OK. After that, you should not receive anymore pop-ups from Kaspersky. __________________ If you think TSF have helped you, please kindly donate to TSF and help keep this site free to all. Last edited by dorts; 11-02-2006 at 05:55 PM.

11-02-2006, 05:57 PM	#3 (permalink)
dorts Analyst, Security Team Join Date: Mar 2006 Location: Singapore Posts: 1,599 OS: Windows XP SP2 My System	If you would like to make sure you are really clean of malware, Please follow MicroBell's 5 Step process outlined here After running through all the steps, best thing to do is have one of the HijackThis helpers take a look at a log. Please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\ Double click on HijackThis.exe to run the program. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless. __________________ If you think TSF have helped you, please kindly donate to TSF and help keep this site free to all.

11-02-2006, 07:30 PM	#5 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,038 OS: WinXP and Vista	Hello Prior22, It very well may be that the file deleted is the only piece of malware on your system, but malware rarely comes alone. While deleting the file may have stopped your pop ups, there may be other pieces of it, or others, still lurking about your system that would eventually work their way back up and cause problems. I would simply suggest you download HijackThis and post a log in the HijackThis forum--where we can give you more tailored instructions. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul." Last edited by Ried; 11-02-2006 at 07:32 PM.

11-02-2006, 06:33 PM	#4 (permalink)
Prior22 Registered User Join Date: May 2006 Posts: 128 OS: XP	Before I perform all the steps you mentioned I was just curious if this piece of adware was serious. So far I havent recieved one popup or anything else that would alert me that its affecting my computer.