[Gasol]

I don't know if I proceed right...
After Reboot, I choose the Recovery Console, like you said; then I choose 1 and press ENTER
After that appears C:>WINDOWS not C:> like you said
so I typped:
attrib -s -r -h "C:\WINDOWS\SYSTEM32\gnhhmu.sys" and press enter it said it is an unknown command... I think I made a mistake... I don't know the sense of "return" maybe... BACKSPACE, or... ESC?
I don't know how to typped the rest of the lines... I don't know how to made this... please help!
I know it is a stupid mistake from me, but I don't know to made this... you can explain again? and why told me that was an unknown command? Oh...

[Advertisements]

No problems if you are not dos savvy it is weird

OK we will do it a bit differently
Starting from the prompt where you arrived not at the one I expected

C:>Windows

type CD system32

You will then get

C:>windows>system32

then type

attrib -s -r -h gnhhmu.sys
del /q gnhhmu.sys
exit

Again pressing enter after each line

[Essexboy]

No problems if you are not dos savvy it is weird

OK we will do it a bit differently
Starting from the prompt where you arrived not at the one I expected

C:>Windows

type CD system32

You will then get

C:>windows>system32

then type

attrib -s -r -h gnhhmu.sys
del /q gnhhmu.sys
exit

Again pressing enter after each line

[Gasol]

Was fine until appear C:\windows\system32
Then... it doesn't work
C:\WINDOWS\system32:attrib -s -r -h gnhhmu.sys (then press ENTER ----> The parameter is not valid)

I made something wrong?! or it is command wrong?!

PS: I'm sorry, I don't want to pissed you off!

[Essexboy]

C:\WINDOWS\system32:attrib -s -r -h gnhhmu.sys

This command has a colon in it and it should not be there
There should be no space between the command line and the command can you confirm that is what you did

EDIT I am married it takes a lot to annoy me

[Gasol]

hm... I made AND with space, like that:
C:>Windows>system32: attrib -s -r -h gnhhmu.sys
that you reffer at?

or you told me to "erase" the space, like this: C:>Windows>system32: attrib -s-r-h ghnmu.sys? (I don't think that)

Are you sure the command it is right?!

Are you married? Ah... Lucky me! (But not so lucky If I continue with this)...

[Essexboy]

Yep I am sure the command is right - but I will double check Just to be sure

[Gasol]

Thank you... and then, if it is right, can you typped for me THE ALL CORRECT LINE?
something like...
C:>Windows>system32:(space)attrib(space)-s(space)-r etc?
Or something like this? It looks stupid for me, but I typped like you said and give it to me "parameter is not valid"

[Essexboy]

OK bear with me I have just asked for confirmation that the commands are correct

c:.Windows>system32 attrib-s-r-h(space) gnhhmu.sys

Lets see if you can access this site


Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window:
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation" check box.
• Click on the “Execute selected scripts”.
• Automatic scanning, healing and system check will be executed.
• A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
• It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
• All applications will work properly after the system restart.

When restarted

• Start AVZ.
  
• Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
• Click on the "Execute selected scripts".
• A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

[Gasol]

The page cannot be displayed (that with avz4)

Well... I try again the figure with console recovery!
I hope it will work now

[Gasol]

Now it works the command but the message was: "The system cannot find the file or directory specifed"

Maybe I can't download the AVZ4 because of the busy server?!
Doesn't exist another method to download this program?!

It is late now; we try again tomorrow to beat this hidden beast.

LE: I have on desktop an "avz4" zip file! I think it is from the last time you help me; I hope it will work. I made the steps guided by you, and then I go to sleep



Later LATER edit:

INCREDIBLE!!!!! When I double-clicked the AVZ.exe, appear a window (program's one) and then... vanished!!! Like in the case of ATF Cleaner! Like the malware know all our moves...

Edited by Gasol, 01 February 2009 - 05:47 PM.

[Essexboy]

OK one of the guys had a similar case to this and he killed it via RC like we are trying to do but with some subtle modifications, no need to force the attributes

Right then into recovery console (you are getting good at this)

And I did make a bit of an error (I must have been getting tired and frustrated ) I sent you to the wrong folder

Start recovery console
If you start at C:>Windows then type the following and press return after each line

DISABLE gnhhmu.sys
CD system32
cd Drivers
del gnhhmu.sys
Exit

On completion of the reboot try the Dr. web link

[Gasol]

after the command DISABLE gnhhmu.sys, appears a message: "The registry entry for the gnhhmu.sys service cannot be located" [Like un the case when I tried to Wipe File with RootRepeal...

I think we are close; if another person have the same problem and resolve it, maybe we are able to made it too...
Can you give me a redirection on that topic?!

PS: It is not a problem! You are very good in your job, and have a lot of work to do and I'm sure not so many time like you want to!

[Essexboy]

Continue now with this and see if we can delete the file which will make us over 50% there


Start recovery console
If you start at C:>Windows then type the following and press return after each line


CD system32
cd Drivers
del gnhhmu.sys
Exit

[Essexboy]

As you are here If that works then try the Dr Web link again

[Gasol]

Nope, doesn't work!
After command: del gnhhmu.sys appear the message: "No matching files were found"!