Attached Files
-
ramhijackthis.txt 8.49KB
81 downloads
Winfixer and related popups [CLOSED]
Started by
Stat_shri
, Oct 03 2005 01:43 PM
-
This topic is locked
#1
Posted 03 October 2005 - 01:43 PM
Stat_shri
-
- Member
-
- 1 posts
New Member
#2
Posted 03 October 2005 - 04:36 PM
greyknight17
-
- Visiting Consultant
-
- 16,560 posts
Malware Expert
Welcome to GTG.
Please try not to attach the logs here. Just copy and paste the whole log here next time instead...
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:
sc stop r_server
sc delete r_server
del delete.bat
Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it.
Go into HijackThis->Config->Misc Tools->Delete an NT service and type in r_server and hit OK.
Delete this file if found -> C:\WINDOWS\System32\r_server.exe
Please download VundoFix.exe at http://www.atribune....ds/VundoFix.exe to your desktop.
* Double-click VundoFix.exe to extract the files.
* After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key (or F5 in some machines) until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
* Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
* Please type the following file path (make sure to enter it exactly as below!):
C:\WINDOWS\System32\cbabc.dll
* Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
* When asked for a second path, enter -> C:\WINDOWS\System32\cbabc.*
* Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
* The fix will run then HijackThis will open.
* In HijackThis, please place a check next to the following items and click FIX CHECKED:
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\cbabc.dll
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwga.ops.pl...quicksilver.cab
O16 - DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} (Quicksilver Class) - http://scpwgb.ops.pl...quicksilver.cab
O20 - Winlogon Notify: cbabc - C:\WINDOWS\System32\cbabc.dll
* After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
* Pressing any key will cause a 'Blue Screen of Death' this is normal, do not worry!
* Once your machine reboots please continue with the instructions below.
Download and install CleanUp! http://www.greyknigh...spy/CleanUp.exe
Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click 'Options...'
Move the arrow down to 'Custom CleanUp!'
Put a check next to the following (Make sure nothing else is checked!):
* Empty Recycle Bins
* Delete Cookies
* Delete Prefetch files
* Cleanup! All Users
Click OK. Press the CleanUp! button to start the program.
It may ask you to reboot at the end, click NO.
Then, please run an online virus scan at ActiveScan http://www.pandasoft.../activescan.htm
Copy the results of the ActiveScan and paste them here along with a new HijackThis log and the vundofix.txt file from the vundofix folder into this topic.
Please try not to attach the logs here. Just copy and paste the whole log here next time instead...
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:
sc stop r_server
sc delete r_server
del delete.bat
Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it.
Go into HijackThis->Config->Misc Tools->Delete an NT service and type in r_server and hit OK.
Delete this file if found -> C:\WINDOWS\System32\r_server.exe
Please download VundoFix.exe at http://www.atribune....ds/VundoFix.exe to your desktop.
* Double-click VundoFix.exe to extract the files.
* After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key (or F5 in some machines) until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
* Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
* Please type the following file path (make sure to enter it exactly as below!):
C:\WINDOWS\System32\cbabc.dll
* Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
* When asked for a second path, enter -> C:\WINDOWS\System32\cbabc.*
* Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
* The fix will run then HijackThis will open.
* In HijackThis, please place a check next to the following items and click FIX CHECKED:
O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\System32\cbabc.dll
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwga.ops.pl...quicksilver.cab
O16 - DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} (Quicksilver Class) - http://scpwgb.ops.pl...quicksilver.cab
O20 - Winlogon Notify: cbabc - C:\WINDOWS\System32\cbabc.dll
* After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
* Pressing any key will cause a 'Blue Screen of Death' this is normal, do not worry!
* Once your machine reboots please continue with the instructions below.
Download and install CleanUp! http://www.greyknigh...spy/CleanUp.exe
Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click 'Options...'
Move the arrow down to 'Custom CleanUp!'
Put a check next to the following (Make sure nothing else is checked!):
* Empty Recycle Bins
* Delete Cookies
* Delete Prefetch files
* Cleanup! All Users
Click OK. Press the CleanUp! button to start the program.
It may ask you to reboot at the end, click NO.
Then, please run an online virus scan at ActiveScan http://www.pandasoft.../activescan.htm
Copy the results of the ActiveScan and paste them here along with a new HijackThis log and the vundofix.txt file from the vundofix folder into this topic.
#3
Posted 17 October 2005 - 05:49 PM
greyknight17
-
- Visiting Consultant
-
- 16,560 posts
Malware Expert
Due to lack of feedback, this topic has been closed.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
