[kahdah]

Please go to Start>Run type in Notepad.
Copy what is in the code box below into the open Notepad window.
Change the "Save As Type" to "All Files". Save it as fixthis.bat on your Desktop.

@Echo off
sc stop "avp"
quit

Then please double click on fixthis.bat a window will open and close quickly.This is normal.
=================================================================
After that 1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\dxdgns.dll 
RenV::
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp  .exe

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

[Advertisements]

Hi when combofix says it going to reboot my laptop seem to freeze and doesn't reboot.
it was rebooting before now it just seem to not respond at some point

[ken65]

Hi when combofix says it going to reboot my laptop seem to freeze and doesn't reboot.
it was rebooting before now it just seem to not respond at some point

[kahdah]

Try deleting your version and then redownload it from Here to your Desktop.

After that rerun the fixthis.bat and then redo the cfscript and then it should run.

Let me know how it goes.

Edited by kahdah, 28 January 2008 - 03:12 AM.

[ken65]

Hi nothing i deleted the combofix then download the one from the link you posted. redid the steps above, but nothing happends combo fix will not operate when i slide the CFScript.txt
to it

Edited by ken65, 28 January 2008 - 06:14 AM.

[kahdah]

Ok let's try this:
Run the Fixthis.bat first then RenV.

• Download RenV.exe by sUBs to your desktop
• Double click on it to run it
• It will search your system drive looking for any modified .exe file and will produce a log for you.
  
  
  Refering to the picture above, drag the log it produced into RenV.exe and post the resulting report to your reply.

Edited by kahdah, 28 January 2008 - 11:32 AM.

[ken65]

Ran on Mon 01/28/2008 - 13:10:25.93



------w		   227,856 2008-01-17 23:42:48  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp  .exe



 Entries:				1  (1)

 Directories:			0  Files:			 1

 Bytes:			227,856  Blocks:		  446

[kahdah]

Again run the Fixthis.bat before doing the following:

• Copy the entire contents of the Code Box below to Notepad.
• Name the file as Log.txt (Overwrite the existing one)
• Change the Save as Type to All Files
• and Save it on the desktop

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp  .exe

Refering to the picture above, drag Log.txt into RenV.exe and post the resulting report to your reply.

[ken65]

Ran on Mon 01/28/2008 - 13:46:56.51



------w		   227,856 2008-01-17 23:42:48  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp  .exe



 Entries:				1  (1)

 Directories:			0  Files:			 1

 Bytes:			227,856  Blocks:		  446

[kahdah]

Next, please reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.
  
  Then Create the same script that I had you just create for RenV and drag it into RenV and then Boot back into normal mode and post the results from that log.
  
  :[list]
• Copy the entire contents of the Code Box below to Notepad.
• Name the file as Log.txt (Overwrite the existing one)
• Change the Save as Type to All Files
• and Save it on the desktop

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp  .exe

Refering to the picture above, drag Log.txt into RenV.exe and attach the resulting report to your reply.

[ken65]

Ran on Mon 01/28/2008 - 15:51:44.32

------w		   227,856 2008-01-17 23:42:48  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp  .exe

 Entries:				1  (1)
 Directories:			0  Files:			 1
 Bytes:			227,856  Blocks:		  446

Ran on Mon 01/28/2008 - 15:58:16.23

 Entries:				0  (0)
 Directories:			0  Files:			 0
 Bytes:				  0  Blocks:			0

Edited by ken65, 28 January 2008 - 03:00 PM.

[kahdah]

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\WINDOWS\dxdgns.dll
  
  
  
• Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
• Click the red Moveit! button.
  Click "Exit" to close OTMoveIt.
  
  **When ready to Reply on the forum, please Paste the content of the latest log which is located at the root of the drive where the OTMoveIt folder is:
  C:\_OTMoveIt\MovedFiles\********_******.log
  (where "********_******" is the "date_time")

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

[ken65]

its a dead link

[kahdah]

Sorry it was changed.

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\WINDOWS\dxdgns.dll

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
• Click the red Moveit! button.
• OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

[ken65]

ok i did what you said but i get no files in the moveit folder
All I get is empty folders.

Edited by ken65, 29 January 2008 - 01:49 PM.

[kahdah]

Did Ot move it say file not found when you ran it?