Posted 29 July 2008 - 03:32 PM
I've got that WinCtrl32 problem on my PC (Win XP Pro, SP2), after clicking on something nasty from the web.
I've run Spybot multiple times, and it seems to have eradicated most of the bad stuff, including Zlob, Vista Anti-Virus, and Virtumonde malware. But it also keeps finding something else called Win32.Banker.aipy.rtk and has eradicated multiple files under that. Now it's down to finding only three files:
-- Win32.Banker.aipy.rtk: [SBI $F565C0D5] Settings (Registry key, nothing done)
-- Win32.Banker.aipy.rtk: [SBI $AD7B69FD] Settings (Registry key, nothing done)
-- Win32.Banker.aipy.rtk: [SBI $4443B172] Library (File, nothing done)
But each time I use Spybot to delete them, the same three files reappear the next time I run Spybot, either with or without rebooting.
There are two files (WinCtrl32.dll and WinCtrl32.dl_) on my main hard drive (E:\WINDOWS\system32) that I've tried deleting but can't.
Ad-Aware (free) finds nothing.
I also have HijackThis, but haven't run it yet because I can't figure out what it does.
-- I see "VIRUS ALERT!" in place of PM or AM in Date/Time, and it has switched from a 12-hour clock to a 24-hour clock. This VIRUS ALERT! text reappears in all other programs where I use time stamps (emails in Outlook, appointments in Lotus Organizer).
-- When Windows launches, I get a message saying "You may be a victim of software counterfeiting" and urging me to activate Windows Genuine Advantage, which I refuse to do since I have a legit copy of Windows XP.
-- The Start menu no longer shows Control Panel, Help & Support, Run, Search, etc.
-- When Windows launches at startup and my desktop comes up, I get a My Computer window opening automatically that shows the E:\WINDOWS\system32 folder contents. This never happened before.
Oh, man -- I hope you guys can help me out of this mess…