need assistance

Printable View

15.04.2009, 21:31
bilbo1941

Вложений: 1

need assistance

my computer is slowwwwwwwwwwwwwww
15.04.2009, 23:45
drongo

Disconnect from internet and disable your antivirus/firewall.
Execute the script: ( how-to: [URL]http://avptool.virusinfo.info/en/AVPTool_helpdesk_curescript.htm[/URL] )
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('D:\autorun.inf','');
QuarantineFile('C:\WINDOWS\bdoscandel.exe','');
QuarantineFile('C:\Poker\Titan Poker\casino.exe','');
DelBHO('{7E853D72-626A-48EC-A868-BA8D5E23E045}');
DelBHO('{6C469FEA-2155-48A3-926B-8D576C6A6822}');
QuarantineFile('C:\WINDOWS\system32\6to4svc6464.dll','');
DelBHO('{02478D38-C3F9-4efb-9B51-7695ECA05670}');
QuarantineFile('C:\WINDOWS\system32\wheels.scr','');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\tenCapture.sys','');
QuarantineFile('C:\WINDOWS\TEMP\mc21.tmp','');
QuarantineFile('C:\WINDOWS\system32\drivers\ikhlayer.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\ikhfile.sys','');
QuarantineFile('C:\WINDOWS\System32\drivers\509b1879.sys','');
QuarantineFile('C:\WINDOWS\system32\cpwmon2k.dll','');
QuarantineFile('C:\Documents and Settings\Compaq_Propriйtaire\Application Data\unobi.dll','');
QuarantineFile('C:\Documents and Settings\All Users\proto.dll','');
DeleteFile('C:\Documents and Settings\All Users\proto.dll');
DeleteFile('C:\Documents and Settings\Compaq_Propriйtaire\Application Data\unobi.dll');
DeleteFile('C:\WINDOWS\system32\6to4svc6464.dll');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
CreateQurantineArchive('C:\quarantine.zip');
RebootWindows(true);
end.
[/code]The computer will reboot automatically.
Upload file C:\[B]quarantine.zip [/B]by link [URL]http://virusinfo.info/upload_virus_eng.php?tid=43915[/URL]
Collect system information again and attach a new file avptool_syscheck.zip to your thread.
16.04.2009, 18:35
bilbo1941

Вложений: 1

my collect after script

This is the two files
16.04.2009, 20:24
Rene-gad

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in ManualCure
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('D:\autorun.inf','');
QuarantineFile('c:\program files\google\googletoolbar1.dll','');
QuarantineFile('C:\WINDOWS\system32\ntos.exe','');
QuarantineFile('C:\Documents and Settings\Compaq_Propriйtaire\Application Data\unobi.dll','');
QuarantineFile('C:\Documents and Settings\All Users\proto.dll','');
DeleteFile('C:\Documents and Settings\All Users\proto.dll');
DeleteFile('C:\Documents and Settings\Compaq_Propriйtaire\Application Data\unobi.dll');
DeleteFile('C:\WINDOWS\system32\ntos.exe');
DeleteFile('c:\program files\google\googletoolbar1.dll');
DeleteFile('D:\autorun.inf');
DelBHO('{2318C2B1-4965-11d4-9B18-009027A5CD4F}');
DelBHO('{aa58ed58-01dd-4d91-8333-cf10577473f7}');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual Cure
[code]begin
CreateQurantineArchive('c:\quarantine.zip');
end.
[/code]

After reboot:
- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat log file
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Attach log file to your new post..
16.04.2009, 20:51
bilbo1941

Вложений: 1

suite off the post

i make all you want lol
17.04.2009, 10:38
Rene-gad

[QUOTE=bilbo1941;388538]i make all you want[/QUOTE]I wanted nothing! But you want to heal your system.

Check your system with [URL="http://www.freedrweb.com/cureit/"]CureIt[/URL] started from CD or write-protected SD-Card.

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
StopService('pxsec');
StopService('pxscan');
QuarantineFile('C:\WINDOWS\System32\drivers\pxscan.sys','');
QuarantineFile('C:\WINDOWS\System32\drivers\pxsec.sys','');
QuarantineFile('C:\WINDOWS\TEMP\1912085126.exe','');
QuarantineFile('C:\WINDOWS\TEMP\tsrq1tmth.exe','');
QuarantineFile('C:\WINDOWS\System32\drivers\509b1879.sys','');
QuarantineFile('C:\Documents and Settings\All Users\proto.dll','');
QuarantineFile('C:\WINDOWS\system32\jh9fgo4ksdgf.dll','');
DeleteFile('C:\WINDOWS\system32\jh9fgo4ksdgf.dll');
DeleteFile('C:\Documents and Settings\All Users\proto.dll');
DeleteFile('C:\WINDOWS\System32\drivers\509b1879.sys');
DeleteFile('C:\WINDOWS\TEMP\tsrq1tmth.exe');
DeleteFile('C:\WINDOWS\TEMP\1912085126.exe');
DeleteFile('C:\WINDOWS\System32\drivers\pxsec.sys');
DeleteFile('C:\WINDOWS\System32\drivers\pxscan.sys');
DeleteService('pxsec');
DeleteService('pxscan');
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('pxsec');
BC_DeleteSvc('pxscan');
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat a log file.
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=43845[/url]
- Attach a new log to your new post..
17.04.2009, 12:31
bilbo1941

Вложений: 1

the new list

the new code
17.04.2009, 15:09
Rene-gad

[QUOTE=Rene-gad;388740]
Check your system with [URL="http://www.freedrweb.com/cureit/"]CureIt[/URL] started from CD or write-protected SD-Card[/QUOTE]Done?

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
RegKeyParamDel('HKEY_USERS','S-1-5-21-342507437-1588892488-4289718972-1008\Software\Microsoft\Windows\CurrentVersion\Run','Diagnostic Manager');
RegKeyParamDel('HKEY_USERS','S-1-5-21-342507437-1588892488-4289718972-1008\Software\Microsoft\Windows\CurrentVersion\Run','DiskChk help');
TerminateProcessByName('c:\docume~1\compaq~1\locals~1\temp\1663535040.exe');
QuarantineFile('C:\Documents and Settings\All Users\proto.dll','');
QuarantineFile('C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1663535040.exe','');
QuarantineFile('C:\WINDOWS\system32\jh9fgo4ksdgf.dll','');
DeleteFile('C:\WINDOWS\system32\jh9fgo4ksdgf.dll');
DeleteFile('C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\1663535040.exe');
DeleteFile('C:\Documents and Settings\All Users\proto.dll');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat a log file and additionally log file of Hijackthis ([url]http://virusinfo.info/showthread.php?t=9184[/url] Analysis chapter 3)
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=43845[/url]
- Attach a new log to your new post..