Printable View
attached is my avptool_syscheck
i have cleaned with combofix, superantivirus, malwarebytes and this random file keeps coming up in my temp folder. i also keep hearing ads and music in the background when im at my desktop. i checked task manager and iexplorer.exe is running without me executing it
thank you for your help
1. Please, disable System Restore and antivirus (if you have).
2. Execute the script in AVPTool:
[CODE]begin
SetAVZGuardStatus(True);
RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
QuarantineFile('G:\RECYCLER\autorun.exe','');
QuarantineFile('c:\documents and settings\regina mills\local settings\temporary internet files\content.ie5\x08w2ovg\yahoomailuploader_0.5[1].exe','');
TerminateProcessByName('c:\documents and settings\regina mills\local settings\temporary internet files\content.ie5\x08w2ovg\yahoomailuploader_0.5[1].exe');
QuarantineFile('c:\windows\system32\ctfmon.exe','');
DeleteFile('c:\documents and settings\regina mills\local settings\temporary internet files\content.ie5\x08w2ovg\yahoomailuploader_0.5[1].exe');
DeleteFile('G:\autorun.inf');
DeleteFile('G:\RECYCLER\autorun.exe');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteWizard('TSW', 3, 3, true);
BC_Activate;
CreateQurantineArchive('C:\quarantine.zip');
RebootWindows(true);
end.[/CODE]
After restart upload file C:\quarantine.zip, by link [url]http://virusinfo.info/upload_virus.php?tid=58784[/url]
3. Attach a new [B]avptool_syscheck.zip.[/B]
[QUOTE=Aleksandra;496946]1. Please, disable System Restore and antivirus (if you have).
2. Execute the script in AVPTool:
[CODE]begin
SetAVZGuardStatus(True);
RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
QuarantineFile('G:\RECYCLER\autorun.exe','');
QuarantineFile('c:\documents and settings\regina mills\local settings\temporary internet files\content.ie5\x08w2ovg\yahoomailuploader_0.5[1].exe','');
TerminateProcessByName('c:\documents and settings\regina mills\local settings\temporary internet files\content.ie5\x08w2ovg\yahoomailuploader_0.5[1].exe');
QuarantineFile('c:\windows\system32\ctfmon.exe','');
DeleteFile('c:\documents and settings\regina mills\local settings\temporary internet files\content.ie5\x08w2ovg\yahoomailuploader_0.5[1].exe');
DeleteFile('G:\autorun.inf');
DeleteFile('G:\RECYCLER\autorun.exe');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteWizard('TSW', 3, 3, true);
BC_Activate;
CreateQurantineArchive('C:\quarantine.zip');
RebootWindows(true);
end.[/CODE]
After restart upload file C:\quarantine.zip, by link [URL]http://virusinfo.info/upload_virus.php?tid=58784[/URL]
3. Attach a new [B]avptool_syscheck.zip.[/B][/QUOTE]
here you go...
oops.. i uploaded the quarantine file to link provided.. my error for uploading here also
ctfmon.exe - [B]Trojan.Inject.6528 (DrWEB)[/B]
File can not be deleted! c:\windows\system32\ctfmon.exe be replaced by healthy in Safe Mode.
[QUOTE=Aleksandra;497014]ctfmon.exe - [B]Trojan.Inject.6528 (DrWEB)[/B]
File can not be deleted! c:\windows\system32\ctfmon.exe be replaced by healthy in Safe Mode.[/QUOTE]
where can i get a healthy ctfmon.exe?
this machine runs xp home oem and i have a system with xp pro.. can i use that ctfmon.exe?
Please wait ...
[QUOTE=Aleksandra;497041]Please wait ...[/QUOTE]
ctv105.exe in task manager.. advertisement in background
Replace and make logs in Normal mode!
[QUOTE=Aleksandra;497119]Replace and make logs in Normal mode![/QUOTE]
i replaced the ctfmon.exe already with my xp pro version and deleted all the prefetch files.. then i removed superantimalware and everything seems quiet now..
i noticed the ctv file launch in the task manager as soon as i launched Superantimalware... i think it piggy backed it.
i will let you know if it's fixed
till now, thank you for everything