Monday, November 23rd 2009, 2:33am UTC+1
You are not logged in.
- 1
- 2
Community member
Date of registration:
Apr 16th 2008
Version: AntiVir Personal
Operating System: Windows 7 build 7127 x64
Location: Bulgaria
Friday, November 6th 2009, 6:28pm
Hello Japper,
STEP 1
Open NOTEPAD.exe and copy/paste the text in the codebox below:
(don't forget to copy and paste REGEDIT4)
Save this as fix.reg Choose to "Save type as - All Files"
It should look like this:
Double click on fix.reg & allow it to merge into the registry
STEP 2
Download Win32kDiag and save it to your Desktop.
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this
## IMPORTANT ## Place fix.bat next to Win32kDiag.exe
Double click on fix.bat & allow it to run
This should restore permissions on locked files and remove mountpoints.
Then post back the log.
(Split the log into parts in several posts).
STEP 3
Please download GMER and extract it to it's own folder. If needed, read here how to unzip/extract properly.
Next, run the Gmer.exe program and click the "Rootkit/Malware" tab.
Make sure all the boxes on the right of the screen are checked, EXCEPT for "Show All".
Next, select all the disk partitions (C:\, D:\ etc) from the list.
Finally, click "Scan" and allow the scan to complete.
DO NOTHING ELSE WITH THE COMPUTER WHILE THIS SCAN IS RUNNING.
When the scan is completed, click "Copy" to copy the log. Paste it into a blank notepad and save it to your desktop.
Post the log in your next reply.
STEP 4
Please download DDS by sUBs and save it to your desktop.
Disable any anti-malware program that will block scripts from running before running DDS.
* Double-Click on dds.scr and a command window will appear. This is normal.
* Shortly after two logs will appear: DDS.txt and Attach.txt
* A window will open instructing you save & post the logs
* Save the logs to a convenient place such as your desktop
* Copy the contents of both logs & post in your next reply.
STEP 1
Open NOTEPAD.exe and copy/paste the text in the codebox below:
(don't forget to copy and paste REGEDIT4)
Quoted
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog]
"Start"=dword:00000004
Save this as fix.reg Choose to "Save type as - All Files"
It should look like this:
Double click on fix.reg & allow it to merge into the registry
STEP 2
Download Win32kDiag and save it to your Desktop.
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
@Win32kDiag -F -R
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this
## IMPORTANT ## Place fix.bat next to Win32kDiag.exe
Double click on fix.bat & allow it to run
This should restore permissions on locked files and remove mountpoints.
Then post back the log.
(Split the log into parts in several posts).
STEP 3
Please download GMER and extract it to it's own folder. If needed, read here how to unzip/extract properly.
Next, run the Gmer.exe program and click the "Rootkit/Malware" tab.
Make sure all the boxes on the right of the screen are checked, EXCEPT for "Show All".
Next, select all the disk partitions (C:\, D:\ etc) from the list.
Finally, click "Scan" and allow the scan to complete.
DO NOTHING ELSE WITH THE COMPUTER WHILE THIS SCAN IS RUNNING.
When the scan is completed, click "Copy" to copy the log. Paste it into a blank notepad and save it to your desktop.
Post the log in your next reply.
STEP 4
Please download DDS by sUBs and save it to your desktop.
Disable any anti-malware program that will block scripts from running before running DDS.
* Double-Click on dds.scr and a command window will appear. This is normal.
* Shortly after two logs will appear: DDS.txt and Attach.txt
* A window will open instructing you save & post the logs
* Save the logs to a convenient place such as your desktop
* Copy the contents of both logs & post in your next reply.
Community member
Date of registration:
Apr 16th 2008
Version: AntiVir Personal
Operating System: Windows 7 build 7127 x64
Location: Bulgaria
Saturday, November 7th 2009, 1:04pm
Please tell us what viruses Avira Rescue CD was found and renamed.
I hope it's not Virut.Gen.
Win32kdiag was finished great job - rootkit max++ should be gone now.
STEP 1
1. Please download The Avenger by Swandog46to your Desktop.
* Right click on the Avenger.zip folder and select "Extract All..."
* Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
* Right click on the window under Input script here:, and select Paste.
* You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
* Click on Execute
* Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
* It will Restart your computer.
* On reboot, it will briefly open a black command window on your desktop, this is normal.
* After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
* Please copy/paste the content of c:\avenger.txt in your reply.
STEP 2
Please delete any Combofix versions you may have.
Please download a new one and follow the instructions below:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post its log.
Regards,
Georgi
I hope it's not Virut.Gen.
Win32kdiag was finished great job - rootkit max++ should be gone now.
STEP 1
1. Please download The Avenger by Swandog46to your Desktop.
* Right click on the Avenger.zip folder and select "Extract All..."
* Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Begin copying here:
Files to move:
C:\WINDOWS\system32\logevent.dll | C:\WINDOWS\system32\eventlog.dll
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
* Right click on the window under Input script here:, and select Paste.
* You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
* Click on Execute
* Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
* It will Restart your computer.
* On reboot, it will briefly open a black command window on your desktop, this is normal.
* After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
* Please copy/paste the content of c:\avenger.txt in your reply.
STEP 2
Please delete any Combofix versions you may have.
Please download a new one and follow the instructions below:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post its log.
Regards,
Georgi
Date of registration:
Oct 7th 2009
Version: none
Sunday, November 8th 2009, 2:05pm
I could not run combofix as it would not launch
but here is the avenger log:
In an earlier message you asked for me to post the Avira rescue CD log file but I am not sure where this is stored...
I am travelling this next week and will not be able to attend to this PC until the following week so if I don't respond. it is
due to travel. I will pick this back up when I return.
thank you
but here is the avenger log:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
File move operation "C:\WINDOWS\system32\logevent.dll|C:\WINDOWS\system32\eventlog.dll" completed successfully.
Completed script processing.
*******************
Finished! Terminate.
In an earlier message you asked for me to post the Avira rescue CD log file but I am not sure where this is stored...
I am travelling this next week and will not be able to attend to this PC until the following week so if I don't respond. it is
due to travel. I will pick this back up when I return.
thank you
Community member
Date of registration:
Apr 16th 2008
Version: AntiVir Personal
Operating System: Windows 7 build 7127 x64
Location: Bulgaria
Sunday, November 8th 2009, 2:16pm
I could not run combofix as it would not launch
What is the message from Combofix ?
Please try to run DDS:
Please download DDS by sUBs and save it to your desktop.
Disable any anti-malware program that will block scripts from running before running DDS.
* Double-Click on dds.scr and a command window will appear. This is normal.
* Shortly after two logs will appear: DDS.txt and Attach.txt
* A window will open instructing you save & post the logs
* Save the logs to a convenient place such as your desktop
* Copy the contents of both logs & post in your next reply.
If no joy let's try with OTListIt:
Download OTL by Old Timer to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
Regards,
Georgi
Community member
Date of registration:
Jan 31st 2006
Version: AntiVir Premium
AntiVir Personal Unix/Linux
Avira Prem. Security Suite
Operating System: Vista home basic SP2 / XP Home SP3 / Linux Fedora 11 XFCE spinoff
Location: UK / Suisse
Sunday, November 8th 2009, 3:30pm
Hi Japper,
Georgi hope you do not mind me jumping in as well, in my experience this problem is most commonly caused by the virus called “Brontok“.
The Brontok virus will make lots of changes to the system restrictions in order to hide itself from easy detection and also from easy cleaning.
Here’s a free tool called Remove Restrictions Tool (RRT) which is able to re-enables all that the virus had previously disabled, and gives you back control over your computer. Download link.
The Remove Restrictions Tool is able to re-enable the following:
- Registry Tools (regedit)
- Ctrl+Alt+Del
- Folder Options
- Show Hidden Files
It is small and easy to use. But make sure you boot in to Safe Mode to use Remove Restrictions Tool (RRT). Just click on the buttons and it’ll do it’s job.
Regards
Barrie
Georgi hope you do not mind me jumping in as well, in my experience this problem is most commonly caused by the virus called “Brontok“.
The Brontok virus will make lots of changes to the system restrictions in order to hide itself from easy detection and also from easy cleaning.Here’s a free tool called Remove Restrictions Tool (RRT) which is able to re-enables all that the virus had previously disabled, and gives you back control over your computer. Download link.
The Remove Restrictions Tool is able to re-enable the following:
- Registry Tools (regedit)
- Ctrl+Alt+Del
- Folder Options
- Show Hidden Files
It is small and easy to use. But make sure you boot in to Safe Mode to use Remove Restrictions Tool (RRT). Just click on the buttons and it’ll do it’s job.
Regards
Barrie
Virusscan.jotti - Safe Mode XP - Safe Mode Vista - HijackThis - Avira Knowledge Base -
Sorry no help Via PM please post on the forum thank you - Kein Support per PM - Bitte im Forum posten danke.
Sorry no help Via PM please post on the forum thank you - Kein Support per PM - Bitte im Forum posten danke.
Community member
Date of registration:
Apr 16th 2008
Version: AntiVir Personal
Operating System: Windows 7 build 7127 x64
Location: Bulgaria
Monday, November 9th 2009, 12:13am
Hello Barie,
or file infector like "Sality, Virut, Parite"
All the best,
Georgi
Georgi hope you do not mind me jumping in as well, in my experience this problem is most commonly caused by the virus called “Brontok“.
or file infector like "Sality, Virut, Parite"
All the best,
Georgi
- 1
- 2