InterviewSolution
Saved Bookmarks
InterviewSolution
| 1. |
Solve : help with a virus? |
|
Answer» Open HijackThis and select Do a system scan only then place a check mark next to:
2) Please run Killbox. 3) Select "Delete on Reboot" 4) Open the text file with these instructions in it, and copy the file name in the quote box below to the clipboard by highlighting them and pressing Control-C: Quote C:\WINDOWS\System32\tellcoma.exe 5) Return to Killbox, go to the File menu, and choose "Paste from Clipboard" 6) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot PROMPT Click "No" at the Pending Operations prompt If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click HERE to download and run missingfilesetup.exe Then try Killbox again.. Let the system reboot. Post a new HijackThis log. when i CLICKED "delete file" i got "pending file name operations registry data has been removed by external process" and then it doesnt reboot by itselfReboot the computer. After rebooting, open up Killbox again, click File -> Logs -> Actions History Log Copy and paste the contents of kb.log and post it in your next reply. If that doesn't work go to Start > Run and type: (or copy and paste) notepad systemdrive%\!Killbox\Logs\kb.log Copy and paste the contents of kb.log and post it in your next reply. Also run a new hijackthis scan and post the log.kill box & hjt logs attached [file cleanup - saving space - ATTACHMENT deleted by admin]This is definitely a NASTY one. They are renamed to something else now. Open HijackThis and select Do a system scan only then place a check mark next to: O4 - HKUS\S-1-5-18\..\Run: [Microsoft Config 32] msconfigx32.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Microsoft Config 32] msconfigx32.exe (User 'Default user') Close all windows except for HijackThis and click Fix checked Exit Hijackthis. Open Killbox. Click the button that says All Files Copy the files in the quote box below. Quote C:\WINDOWS\System32\tellcoma.exe In Killbox click File > Paste from clipboard Check the box to Replace On Reboot, then check the box under it Use Dummy. Then click the red X and allow reboot. Post the Killbox log i the next post along with a new hijackthis log please. i cant seem to get the new kb log?....i got to kb..click files...click logs then i click actions history log but it comes up with the previous kb log.. am i doing something wrong?Did it seem like it worked this time? what do you mean?Did killbox work with no errors? Post a new hijackthis log please.it came up with the same message as before --------- hjt log attched [file cleanup - saving space - attachment deleted by admin]I have asked on the errors and it seems this is not uncommon for killbox to report this. The log is finally clean. How is the computer now? Let's clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if launched accidentally. Please download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop. 1. Double click OTMoveIt2.exe to launch it. 2. Click on the CleanUp! button. 3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access. 4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?) 4. When finished exit out of OTMoveIt2 Download and install CleanUp! Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
I'll let you know if any of the symptoms appear again!! thanks so much for this!! Im sorry if i ve bee a pain ^^ thank you thank you!! btw..how COME i have a antivirus on my pc but it still doesnt help instead we have to go through all thses steps?Quote thanks so much for this!! Im sorry if i ve bee a pain ^^ No problem, glad you stuck it out also. Quote how come i have a antivirus on my pc but it still doesnt help instead we have to go through all thses steps? Not sure how it got there. All it takes is one click and all sorts of stuff can get in. Antivirus can't always stop some of the well written virus out there. Quote I'll let you know if any of the symptoms appear again!! Absolutely, we will be here. Quote I think everything is ok now! Good, I hope it stays that way. To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place? Safe surfing........ |
|