Показано с 1 по 17 из 17.

hey experts :)

  1. #1
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32

    hey experts :)

    Hey , I ve had terrible problems with my computer lately. First it couldnt move at all , it couldnt even start SYSTEM RESTOre and afrer some 100 hours-waited installation I succed in re-installin SYSTEM RESTORE tool and then it started moving but with difficulties.. Now , my kaspersky keep telling me about viruses that I thought I have removed..
    So please, try to help me !
    tnx !
    Вложения Вложения

  2. #2
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    971
    Hi!
    Please, exactly follow the instructions:

    Download special avz in my signature.
    Please execute this script in avz( how-to: http://virusinfo.info/showthread.php?t=9207) (Do remember before execution scripts to exit antivirus and disconnect from internet, disable System Restore )

    Код:
    begin
    SearchRootkit(true, true);
    SetAVZGuardStatus(True);
     QuarantineFile('C:\WINDOWS\system32\KCFG32.CPL','');
     QuarantineFile('c:\docume~1\boy200~1\applic~1\intern~1\manager ooze media.exe','');
     DelBHO('{02478D38-C3F9-4efb-9B51-7695ECA05670}');
     DelBHO('{5C255C8A-E604-49b4-9D64-90988571CECB}');
     DelBHO('{31FC1F5B-A825-4335-827F-9A604838884A}');
     QuarantineFile('C:\WINDOWS\AdobeR.exe','');
     QuarantineFile('C:\Program Files\WordWeb\wweb32.exe','');
     QuarantineFile('C:\Documents and Settings\All Users\Application Data\part dead amok eggs\cool chin.exe','');
     QuarantineFile('C:\Documents and Settings\All Users\Application Data\Mail For File Wave\Blue Cool.exe','');
     QuarantineFile('C:\DOCUME~1\BOY200~1\APPLIC~1\INTERN~1\Drv blue.exe','');
     QuarantineFile('C:\WINDOWS\system32\drivers\ws2_32sik.sys','');
     QuarantineFile('C:\WINDOWS\system32\drivers\nicsk32.sys','');
     QuarantineFile('C:\WINDOWS\system32\drivers\nchssvad.sys','');
     QuarantineFile('C:\WINDOWS\system32\drivers\fips32cup.sys','');
     QuarantineFile('C:\WINDOWS\system32\drivers\amd64si.sys','');
     QuarantineFile('C:\WINDOWS\System32\Drivers\PxHelp20.sys','');
     QuarantineFile('C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys','');   
     DeleteFile('C:\WINDOWS\system32\drivers\ws2_32sik.sys');
     DeleteFile('C:\WINDOWS\system32\drivers\nicsk32.sys');
      DeleteFile('C:\WINDOWS\system32\drivers\fips32cup.sys');
     DeleteFile('C:\WINDOWS\system32\drivers\amd64si.sys');
     DeleteFile('C:\DOCUME~1\BOY200~1\APPLIC~1\INTERN~1\Drv blue.exe');
     DeleteFile('C:\Documents and Settings\All Users\Application Data\Mail For File Wave\Blue Cool.exe');
     DeleteFile('C:\Documents and Settings\All Users\Application Data\part dead amok eggs\cool chin.exe');
     DeleteFile('C:\WINDOWS\AdobeR.exe');
     DeleteFile('c:\docume~1\boy200~1\applic~1\intern~1\manager ooze media.exe');
     DeleteFile('C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys');
    BC_DeleteSvc('amd64si');
    BC_DeleteSvc('mferkdk');
    BC_DeleteSvc('fips32cup');
    BC_DeleteSvc('nicsk32');
    BC_DeleteSvc('ws2_32sik');
    BC_DeleteSvc('mferkdk');
    BC_ImportAll;
    ExecuteSysClean;
    ExecuteRepair(6);
    ExecuteRepair(8);
    ExecuteRepair(9);
    BC_Activate;
    SetAVZPMStatus(true);
    RebootWindows(true);
    end.
    System will reboot.
    Please upload quarantine according to Appendix# 3 of rules by red link in your topic.
    Please read carefully: http://virusinfo.info/showthread.php?t=9184 and make all 3 logs, as described and do attach them to next post in this topic.(use special avz, don't need update it)

  3. #3
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    ok , I hope I ll get by.. I ll let u know when I finish
    Thanx a lot !

    hey , I hope I did this well..
    Вложения Вложения
    Последний раз редактировалось Rene-gad; 22.03.2009 в 19:15.

  4. #4
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    971
    You did forget upload quarantine.
    Код:
    Please upload quarantine according to Appendix# 3 of rules by red link in your topic.
    use link: http://virusinfo.info/upload_virus_eng.php?tid=42216
    No quarantine, no help.

  5. #5
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    oh ok .. please tell me how to upload quarantine?

    I dont get this part : Enter the list of files which were asked to send in the top window
    which is that part ?

    Upload result
    File saved as 090322_184539_virus_49c65d233f140.zip
    File size 1260798
    MD5 ef360403e0cae74b3eabac255c55d399

    File uploaded, thank you!

    is that it ?
    Последний раз редактировалось Rene-gad; 22.03.2009 в 19:15. Причина: Добавлено

  6. #6
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация
    Регистрация
    03.04.2006
    Сообщений
    21,108
    Вес репутации
    3000
    Please execute this script in avz( how-to: http://virusinfo.info/showthread.php?t=9207) (Do remember before execution scripts to exit antivirus and disconnect from internet, disable System Restore )

    Код:
    begin
    SearchRootkit(true, true);
    SetAVZGuardStatus(True);
     StopService('fsssvc');
    QuarantineFile('C:\Program Files\Windows Live\Family Safety\fsssvc.exe','');
     QuarantineFile('C:\Program Files\Common Files\Windows Live\.cache\2a2686e81c99515\fssclient_x86.msi','');
     QuarantineFile('C:\WINDOWS\Installer\382bbf.msi','');
     DeleteService('Bonjour Service');
     DeleteFile('%programfiles%\bonjour\mdnsresponder.exe');
     DeleteFile('%programfiles%\bonjour\mdnsNSP.dll');
     DeleteFile('C:\WINDOWS\Installer\382bbf.msi');
     DeleteFile('C:\Program Files\Common Files\Windows Live\.cache\2a2686e81c99515\fssclient_x86.msi');
     DeleteFile('C:\Program Files\Windows Live\Family Safety\fsssvc.exe');
     DeleteService('fsssvc');
    BC_DeleteSvc('fsssvc');
    BC_ImportAll;
    ExecuteSysClean;
    BC_Activate;
    SetAVZPMStatus(false);
    RebootWindows(true);
    end.
    System will reboot.
    Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool cleanmgr or CCleaner or ClearProg
    Please upload quarantine according to Appendix# 3 of rules by red link in your topic.
    Please read carefully: http://virusinfo.info/showthread.php?t=9184 and make all 3 logs, as described and do attach them to next post in this topic.(use special avz, don't need update it)

  7. #7
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    here u go ser , I m gonna upload quarantine file on that link that u gave me on previous msg

    Upload result
    File saved as 090322_201422_virus_49c671ee5b577.zip
    File size 5396306
    MD5 0a21a4ee77c44684d4d224488c4dfd0d

    File uploaded, thank you!
    Вложения Вложения
    Последний раз редактировалось Rene-gad; 22.03.2009 в 20:30.

  8. #8
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    971
    Almost

    Fix this in hijack this:
    Код:
    O4 - HKLM\..\Run: [PremierOpinion] C:\Program Files\PremierOpinion\pmropn.exe -boot
    O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
    then, execute this script in avz:
    Код:
    begin
    Clearquarantine; 
    SearchRootkit(true, true);
    SetAVZGuardStatus(True);
     QuarantineFile('c:\docume~1\boy200~1\applic~1\intern~1\manager ooze media.exe','');
     QuarantineFile('C:\Program Files\Common Files\Windows Live\.cache\301ddec01c9847c\fssclient_x86.msi','');
     QuarantineFile('C:\Program Files\PremierOpinion\pmropn.exe','');
     DeleteFile('C:\Program Files\PremierOpinion\pmropn.exe');
     DeleteFile('c:\docume~1\boy200~1\applic~1\intern~1\manager ooze media.exe');
     DeleteFile('C:\Program Files\Common Files\Windows Live\.cache\301ddec01c9847c\fssclient_x86.msi');
    BC_ImportAll;
    ExecuteSysClean;
    BC_Activate;
    RebootWindows(true);
    end.
    Again, a new quarantine upload by red link only.
    Make new logs
    Код:
     virusinfo_syscure.zip
    	virusinfo_syscheck.zip 
    	hijackthis.log
    Последний раз редактировалось drongo; 23.03.2009 в 01:22.

  9. #9
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    cool

    wait , i didnt read ur note about fixing that in hijack .. I ll do the hijackk again

    Добавлено через 4 минуты

    can u explain how can I fix things in hijack ?

    Добавлено через 8 минут

    hey I m sorry cause I m far from professional but I can find only that boujour ..

    2nd hijack
    Вложения Вложения
    Последний раз редактировалось Rene-gad; 23.03.2009 в 12:09.

  10. #10
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация
    Регистрация
    03.04.2006
    Сообщений
    21,108
    Вес репутации
    3000

  11. #11
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    ok, i fixed that bounjour thing , but I can find the first one - O4 - HKLM\..\Run: [PremierOpinion] C:\Program Files\PremierOpinion\pmropn.exe -boot

    Добавлено через 2 минуты

    sorry , I CANT *
    Последний раз редактировалось Irena1809; 23.03.2009 в 15:34. Причина: Добавлено

  12. #12
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    971
    It is ok, if you can't find this line- it is gone
    I don't see any sign of infection anymore. But it is very important to update or uninstall your acrobat reader. You can be infected trough this application, cause it quiet popular and have well documented exploits

  13. #13
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    woow really ? THanx soooo much !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ))))))
    one more question : when I open internet explorer every time WINDOWS INSTALLER turns on.. what should I do ?

    Добавлено через 44 секунды

    or microsofr office xp professional with front page installer or some windows installer with kind of network icon turns on ..

    Добавлено через 51 минуту

    they are asking for some fssclienx_x86.msi and when I wanted to install it , it couldnt cause it says that newer version is in my comp
    Последний раз редактировалось Irena1809; 23.03.2009 в 18:44. Причина: Добавлено

  14. #14
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    971
    About internet explorer - uninstall it and install latest version from official site
    Nevertheless, i don't recommend you using internet explorer in internet, because it can't be configured secured and useful in same time, even their latest the 8.0 version can't.
    Use firefox + NoScript add-on.

    About office xp professional -i don't know, perhaps some update is missing. Sometimes helps to update the windows installer from windows update site
    Use an alternative, if such problems persists.
    http://www.koffice.org/
    http://download.openoffice.org/index.html

  15. #15
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    regards from firefox
    Im on mozilla and its great !
    all my problems fixed !! ) thanx a lottttttt !!!!!!!!1
    love ur lab forum )))))))))))))))))))))))))


    regards from Montenegro )

    Добавлено через 4 часа 30 минут

    one more issue and I m gone - i have problem 0x8007007e when I try to sign to my msn .. I guess some DLL file is missing , so how can I figure out which one ?
    Последний раз редактировалось Irena1809; 24.03.2009 в 00:42. Причина: Добавлено

  16. #16
    Senior Member Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для drongo
    Регистрация
    17.09.2004
    Адрес
    Israel
    Сообщений
    7,165
    Вес репутации
    971
    remember in firefox to install NoScript https://addons.mozilla.org/en-US/firefox/addon/722, and use it with wisdom
    try this instruction: http://www.petri.co.il/wu_problems_8007007e.htm
    Последний раз редактировалось drongo; 24.03.2009 в 11:39.

  17. #17
    Junior Member Репутация
    Регистрация
    21.03.2009
    Сообщений
    9
    Вес репутации
    32
    ok thanx a lot !! thanx !!!!!!!!!!!!!

Похожие темы

  1. Cyber-criminals targeting social networks: experts
    От drongo в разделе Computer security news
    Ответов: 0
    Последнее сообщение: 30.07.2009, 18:38

Свернуть/Развернуть Ваши права в разделе

  • Вы не можете создавать новые темы
  • Вы не можете отвечать в темах
  • Вы не можете прикреплять вложения
  • Вы не можете редактировать свои сообщения
  •  
Page generated in 0.01651 seconds with 17 queries