Printable View
Hi,
these are the issues I'm facing : I can't surf the internet, although i can ping www;google.com, I can't install new programs, windows security center is not running and i cannot start it, usb sticks are hitted with W32/rimecued!, ...
I did run antivirus/antispy/... serval times, but nothing seems to help.
I collected the sys info with kaspersky and added them in attachment
Thanks a lot for your support,
Downolad the LAST version of AVPTool and use it further!
Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual disinfection
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('F:\autorun.inf','');
QuarantineFile('C:\Windows\system32\qqkk1vvqq.exe','');
QuarantineFile('C:\Windows\system32\lbrrmmgwwr.exe','');
QuarantineFile('C:\Windows\system32\gbbwm0g0bww.exe','');
QuarantineFile('C:\Windows\system32\bbvq0llg.exe','');
QuarantineFile('C:\Windows\system32\afa0vvqqka.exe','');
QuarantineFile('C:\Windows\system32\0lggb1b.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-8549666223-9408468360-017552361-6338\yv8g67.exe','');
StopService('PKCJM');
DeleteService('PKCJM');
QuarantineFile('C:\Users\VANROM~1\AppData\Local\Temp\PKCJM.exe','');
QuarantineFile('\\?\globalroot\systemroot\system32\H8SRTsdwsfhprpj.dll','');
DeleteFile('\\?\globalroot\systemroot\system32\H8SRTsdwsfhprpj.dll');
DeleteFile('C:\Users\VANROM~1\AppData\Local\Temp\PKCJM.exe');
DeleteFile('C:\RECYCLER\S-1-5-21-8549666223-9408468360-017552361-6338\yv8g67.exe');
DeleteFile('C:\Windows\system32\0lggb1b.exe');
DeleteFile('C:\Windows\system32\afa0vvqqka.exe');
DeleteFile('C:\Windows\system32\bbvq0llg.exe');
DeleteFile('C:\Windows\system32\gbbwm0g0bww.exe');
DeleteFile('C:\Windows\system32\lbrrmmgwwr.exe');
DeleteFile('C:\Windows\system32\qqkk1vvqq.exe');
DeleteFile('F:\autorun.inf');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','bvvqgg1');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','aavkk');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','bvvqggb');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','wrggbr9');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','wrmm6g');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','vvqvqkk ');
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('PKCJM');
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual disinfection
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]and upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Repeat a log file of AVPTool.
- Make a log file with Hijackthis ([URL="http://virusinfo.info/showthread.php?t=9184"] Analysis, p.3 [/URL] for further informations).
- Make a log of [URL="http://virusinfo.info/showthread.php?t=51878"]GMER[/URL]
- Attach 3 logs to your new post..