1053 error

[retrosnake]

Hi, I am receiving the 1053 error when trying to manually start the service and cannot get Kaspersky 2009 to run.

I have attached my log as well. Please let me know what script to run to resolve?

Thanks
John

[Rene-gad]

Kaspersky Virus Removal Tool 7.0.0.290 (database released 18/11/2008; 13:08 )

Download the last version of AVPTool, make a cure starting from any write-protected drive, then logging from this system.

[retrosnake]

please see attached.

[Rene-gad]

Do you really understand English? Or have you attached the old file once more?

[retrosnake]

yes i understand english - it seems you have some issue comprehending or explaining in english what you need done.

as you can tell the file is different because the size is different.

either you can help or you cant, let me know

[Rene-gad]

either you can help or you cant, let me know

Yes, we can, but: I advised you to download THE LAST VERSION of AVPTool, your version has a very old signatures from 18/11/2008. Is it difficult to understand???

[retrosnake]

lets give it another go..

[Rene-gad]

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- Execute following script in Manual Cure

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\TEMP\tempo-5340968.tmp','');
 QuarantineFile('C:\WINDOWS\system32\gxvxctuumpvpoarnclcmppeqbnmkdmxsaufji.dll','');
 DeleteFile('C:\WINDOWS\system32\gxvxctuumpvpoarnclcmppeqbnmkdmxsaufji.dll');
 DeleteFile('C:\WINDOWS\TEMP\tempo-5340968.tmp');
BC_ImportAll;
ExecuteSysClean;
SetAVZPMStatus(True);
BC_Activate;
RebootWindows(true);
end.

After reboot execute following script in Manual Cure

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

- Remove Bonjour
- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool cleanmgr or CCleaner or ClearProg
- Close all the programs and start only Internet Explorer!!!
- Repeat a log file.
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the quarantine.zip over the link Upload quarantined files on the top of this page.
- Attach a log to your new post..

[retrosnake]

updated instructions... log file attached.

[Rene-gad]

- Execute following script in Manual Cure

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\TEMP\tempo-5340968.tmp','');
 QuarantineFile('C:\WINDOWS\system32\gxvxctuumpvpoarnclcmppeqbnmkdmxsaufji.dll','');
 QuarantineFile('C:\WINDOWS\system32\drivers\gxvxcsyasrqoyepjctqohsawwpsxixbojnnnk.sys','');
 DeleteFile('C:\WINDOWS\system32\drivers\gxvxcsyasrqoyepjctqohsawwpsxixbojnnnk.sys');
 DeleteFile('C:\WINDOWS\system32\gxvxctuumpvpoarnclcmppeqbnmkdmxsaufji.dll');
 DeleteFile('C:\WINDOWS\TEMP\tempo-5340968.tmp');
BC_ImportAll;
ExecuteSysClean;
SetAVZPMStatus(True);
BC_Activate;
RebootWindows(true);
end.

After reboot execute following script in Manual Cure

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

FOR THE 2nd TIME: Remove Bonjour
- Repeat a log file.
- Upload the quarantine.zip over the link Upload quarantined files on the top of this page.

[retrosnake]

process followed.

For the First and last time - bonjour was already removed. The service is inactive and the application is removed.

do you have any idea of what you are doing?

[Rene-gad]

For the First and last time - bonjour was already removed.

No, it wasn't, see your previous log file.
BTW: It the last log file I can find not removed parts of bonjour too.

do you have any idea of what you are doing?

Do you mind: what a bullshit had you catched? Please.

tempo-5340968.tmp_ - Trojan.Win32.Agent2.kma

Remove AskBar & Install Service Pack 3 + all Updates + Internet Explorer 8.