Virus sos? replied by motoway @ Mon, 14 Jul 2008 21:50:43 +0800

motoway — Mon, 14 Jul 2008 21:50:43 +0800

KapserSky log.

http://www.mediafire.com/?nmezga9byyb

Virus sos? replied by ndmmxiaomayi @ Mon, 14 Jul 2008 17:47:46 +0800

ndmmxiaomayi — Mon, 14 Jul 2008 17:47:46 +0800

Looks good.

Please go to Kaspersky website to perform an online scan. Please use Internet Explorer as it uses ActiveX.
Click on Accept
It will prompt you to download an ActiveX. Allow it.
After that, you will be prompted to install it.
Once installed, it will start downloading the definitions. This will take some time. At the same time, you may also receive another prompt to install another ActiveX. Allow it again and repeat Step 2.
When the definitions have finished downloading, click Next.
Click on Scan Settings.
Under Scan using the following antivirus database:, choose extended - protect your computer from Spyware, adware, dialers and potentially dangerous software such as remote access utilities, prank programs and jokes. We do not recommend this option to beginners or inexperienced users.
Under Scan options:, check (tick) both boxes.
Click Ok.
Under Please select a target to scan:, click on My Computer. It will start scanning. Please be patient.
Click on Save Report As....
Give this report a name and change the Save as type: to Text file (*.txt) before clicking on Save.
Please post this log in your next reply.

Virus sos? replied by ndmmxiaomayi @ Mon, 14 Jul 2008 17:38:29 +0800

ndmmxiaomayi — Mon, 14 Jul 2008 17:38:29 +0800

Originally posted by motoway:

Hey i clicked Send File and the window close. Is that supposed to happen?

Yes.

Virus sos? replied by motoway @ Mon, 14 Jul 2008 17:23:41 +0800

motoway — Mon, 14 Jul 2008 17:23:41 +0800

Hey i clicked Send File and the window close. Is that supposed to happen?

This is the combofix log:

http://www.mediafire.com/?sml5t8viogy

And this is the HijackThis log:

http://www.mediafire.com/?dmdzjycbyk1

Thanks Mayi for your detailed instructions thus far. Really appreciate it!

Virus sos? replied by ndmmxiaomayi @ Mon, 14 Jul 2008 15:47:19 +0800

ndmmxiaomayi — Mon, 14 Jul 2008 15:47:19 +0800

Yeah...

Disable AntiVir temporarily

Right click on the red umbrella and untick AntiVir Guard enable. Remember to re-enable it before posting back the logs.

Disable Teatimer temporarily

Right click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
Click on Mode > Advanced Mode. When it prompts you, click Yes.
On the left hand side, click on Tools.
Check (tick) this box if it is not yet ticked: Resident.
You will notice that Resident is now added under Tools. Click on Resident.
Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
Exit Spybot Search & Destroy.
Restart your computer for the changes to take effect.

Download this file - http://www.mediafire.com/?mr2rxtcid13

Save it as CFScript.txt

Referring to the picture below, drag CFScript into Combofix.

Combofix will start running. When done, a log will be produced. Please post this log in your next reply.

In addition, it will prompt you to submit some files for analyzing.

Click OK.

Copy and paste the file path into the text box next to the Browse button (boxed up in red).

Click on Send File.

Do not mouse click on Combofix while it is running. That may cause it to stall.

Upload both HijackThis and Combofix logs to Mediafire.

Virus sos? replied by motoway @ Mon, 14 Jul 2008 05:01:36 +0800

motoway — Mon, 14 Jul 2008 05:01:36 +0800

Me thinks virus still around coz my IE keeps hanging. o_0

Virus sos? replied by motoway @ Sat, 12 Jul 2008 13:45:28 +0800

motoway — Sat, 12 Jul 2008 13:45:28 +0800

I tink it's dis one ba..

http://www.mediafire.com/?0ojpxt4z4yg

Too many combo fix file le. I tink the latest one is the one in C drive rite?

This is the one i found in C drive. Sollie sollie i didn't take notice of where the latest one is stored.

Virus sos? replied by motoway @ Sat, 12 Jul 2008 13:27:08 +0800

motoway — Sat, 12 Jul 2008 13:27:08 +0800

ok i go run combo fix liao hab to off this webbie le.

Later~

Virus sos? replied by ndmmxiaomayi @ Sat, 12 Jul 2008 13:20:34 +0800

ndmmxiaomayi — Sat, 12 Jul 2008 13:20:34 +0800

Download XP Pro Recovery Console setup file from here - http://www.microsoft.com/downloads/details.aspx?FamilyId=535D248D-5E10-49B5-B80C-0A0205368124&displaylang=en

Save it to your desktop and drag it into Combofix.

Follow the instructions...

Remember to disable AntiVir (right click on the umbrella and untick AntiVir Guard enable) before running Combofix.

Upload the Combofix log to Mediafire.

Virus sos? replied by motoway @ Sat, 12 Jul 2008 13:17:13 +0800

motoway — Sat, 12 Jul 2008 13:17:13 +0800

yeps!

Virus sos? replied by ndmmxiaomayi @ Sat, 12 Jul 2008 13:16:41 +0800

ndmmxiaomayi — Sat, 12 Jul 2008 13:16:41 +0800

Is Boot.bak renamed to boot.ini ?

Virus sos? replied by motoway @ Sat, 12 Jul 2008 13:09:45 +0800

motoway — Sat, 12 Jul 2008 13:09:45 +0800

ok sollie missed 1 step.

Ok already :)

Virus sos? replied by ndmmxiaomayi @ Sat, 12 Jul 2008 13:05:26 +0800

ndmmxiaomayi — Sat, 12 Jul 2008 13:05:26 +0800

Show hidden files already?

Boot.ini by default is hidden.

Virus sos? replied by motoway @ Sat, 12 Jul 2008 13:04:03 +0800

motoway — Sat, 12 Jul 2008 13:04:03 +0800

I cant find c:\boot.ini in my C drive though when i type c:\boot.ini i can find it.

As in, i don't see boot.ini file in c:\

Virus sos? replied by ndmmxiaomayi @ Sat, 12 Jul 2008 12:38:57 +0800

ndmmxiaomayi — Sat, 12 Jul 2008 12:38:57 +0800

The wrong version of Recovery Console has been installed. We need to get it removed and re-install the correct version. Please ensure that you read through all instructions carefully. If any of the steps are unclear, please let me know.

Show hidden files and folders

Open My Computer.
Go to Tools > Folder Options.
Select the View tab.
Scroll down to Hidden files and folders.
Select Show hidden files and folders.
Uncheck (untick) Hide extensions of known file types.
Uncheck (untick) Hide protected operating system files (Recommended).
Click Yes when prompted.
Click OK.

Step 1

Delete this file, it's on your desktop.

C:\Documents and Settings\Administrator\Desktop\WinXP_EN_HOM_BF.EXE

Step 2

Delete this folder - C:\cmdcons

Step 3

Delete this file file - C:\Boot.ini

Step 4

Right click on this file - C:\Boot.bak and select Rename.

Copy and paste in Boot.ini and press Enter.

Let me know when you have done all 4 steps. Don't restart your computer yet.

Virus sos? replied by motoway @ Sat, 12 Jul 2008 11:35:24 +0800

motoway — Sat, 12 Jul 2008 11:35:24 +0800

Here is the combofix file.

http://www.mediafire.com/?xt9cryy3tqd

My window sometimes has alot of pop up screen. Unstoppable one.

Virus sos? replied by motoway @ Fri, 11 Jul 2008 15:56:08 +0800

motoway — Fri, 11 Jul 2008 15:56:08 +0800

Ok i upload later k.

Coz my brother is back from camp and he's hogging the comp. =_=

Thanks alot yea!~

Virus sos? replied by ndmmxiaomayi @ Fri, 11 Jul 2008 15:35:49 +0800

ndmmxiaomayi — Fri, 11 Jul 2008 15:35:49 +0800

Please upload the Combofix log to Mediafire. There may be some leftovers.

Log can be found at C:\Combofix.txt

Virus sos? replied by motoway @ Fri, 11 Jul 2008 01:48:59 +0800

motoway — Fri, 11 Jul 2008 01:48:59 +0800

Fwah i do the Combofix liao. Reali power lehs!

No more VIRUS ALERT beside my computer clock liao!

And i can see more items on my desktop now~ I tink the virus block some programs last time.

http://www.mediafire.com/?f3vbdtmjttz

This is the new media log file. Should be ok le rites?? XD

Sho happi~

Virus sos? replied by motoway @ Fri, 11 Jul 2008 01:15:31 +0800

motoway — Fri, 11 Jul 2008 01:15:31 +0800

can can tml den check back ba, i go take my time look around the web.

I beri IT idiot one.

Virus sos? replied by ndmmxiaomayi @ Fri, 11 Jul 2008 01:12:56 +0800

ndmmxiaomayi — Fri, 11 Jul 2008 01:12:56 +0800

Most likely I will check back tomorrow. You can just post if you want.

Virus sos? replied by motoway @ Fri, 11 Jul 2008 01:09:22 +0800

motoway — Fri, 11 Jul 2008 01:09:22 +0800

ok me go on desktop now.

But no rush la, i can settle tml if u need to sleep =D

Virus sos? replied by ndmmxiaomayi @ Fri, 11 Jul 2008 01:05:28 +0800

ndmmxiaomayi — Fri, 11 Jul 2008 01:05:28 +0800

LOL... you got an assortment of old and new viruses.

Virus Alert near the clock - New

That bio hazard background - Old

In between, add Vundo.

Disable AntiVir as it will interfere with Combofix.

This topic contains the instructions for disabling AntiVir Antivirus (find the one with umbrella icon) - http://www.bleepingcomputer.com/forums/topic114351.html

If you already have Combofix, please delete this copy and download it again as it's being updated regularly.

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once Recovery Console is installed, you should see a blue screen prompt like the one below:

Click Yes to allow Combofix to continue scanning for malware.

When done, a log will be produced. Please post that log and a new HijackThis log in your next reply.

Do not mouse click on Combofix while it is running. That may cause it to stall.

Upload all the logs to Mediafire as usual so sgF don't eat up the letters.

Virus sos? replied by motoway @ Fri, 11 Jul 2008 01:04:47 +0800

motoway — Fri, 11 Jul 2008 01:04:47 +0800

wah new pattern ar??

My windows is working fine, except sumtimes it still prompt me to dl the file. Other den that it's ok.

Virus sos? replied by ndmmxiaomayi @ Fri, 11 Jul 2008 01:02:09 +0800

ndmmxiaomayi — Fri, 11 Jul 2008 01:02:09 +0800

Basket. Means it's a new variant.

Recent Posts in 'Virus sos?' | sgForums.com