Foldername.exe / virus that disable anti virus
kair Hi, Back to Top
Touch Forum Moderator Hello kair and welcome to BG
to your desktop, then click on the RSIT.exe to start the scan.RSIT will also create a second log , info.txt, which will be minimized to your taskbar. Post that here as well please (it will also be stored at C:\rsit\info.txt). Click http://www.gmer.net/download.php and download the installer for Gmer to your desktop, then click that file to run Gmer. hidden " or "rootkit ", stop there, and click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please. We don't want any crashes just from taking an initial look at things.Scan (before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan).
You can break logs into parts and use separate posts here when replying and posting the log files, if needed.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
kair first one Back to Top
kair 2nd one Back to Top
Touch Forum Moderator
by Swandog46 to your Desktop.
Click on Avenger.zip to open the file
Extract avenger2.exe to your desktop
Start Avenger
Begin copying here:
Copy/Paste all the text in the above codebox into the main window
Click Execute
The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions.
This log file will be located at C:\avenger.txt
Post C:\avenger.txt in next reply, along with a combofix log ->
Please download Combofix from:
And save to the desktop.
Close all other browser windows.
Double-click on the combofix icon found on your desktop.
Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.
When finished, it will produce a logfile located at C:\combofix.txt.
Post the contents of that log in your next reply
The logs will be reasonably large so you may have to divide them into sections and make several posts to post them.
NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
kair from gmer Back to Top
kair avenger log Back to Top
kair Combo Fix Log Back to Top
kair im a good to go?.. Back to Top
kair sir im still infected the virus are Back to Top
Touch Forum Moderator Yes, you are still infected
and download Win32kDiag.exe directly to your Desktop
cmd (and press OK). At the prompt type or copy/paste the following, pressing Enter after:cd\
Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK.
"%userprofile%\desktop\win32kdiag.exe" -f -r
When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here, along with a combofix log ->
Open notepad and copy/paste the bold text in the codebox below into it:
Name the file as CFScript Save it on the desktop
Killall::
Snapshot::
File:: c:\documents and settings\Owner\Local Settings\Application Data\Application Data.exe
Fcopy::
c:\windows\$NtServicePackUninstall$\explorer.exe | c:\windows\explorer.exe
Once saved, refering to the picture above, drag CFScript.txt into ComboFix.exe.
Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt,
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
kair combo fix Back to Top
kair 1st one Back to Top
kair no, i run first the win32 Back to Top
Touch Forum Moderator Ok.
to perform an online scan. Please use Internet Explorer as it uses ActiveX.
Check (tick) this box: YES, I accept the Terms of Use.
Click on the Start button next to it.
When prompted to run ActiveX. click Yes.
You will be asked to install an ActiveX. Click Install.
Once installed, the scanner will be initialized.
After the scanner is initialized, click Start.
Check (tick) Remove found threats box.
Check (tick) Scan unwanted applications.
Click on Scan.
It will start scanning. Please be patient.
Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt.
Please post this log in your next reply.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Forum Information Currently it is Saturday, November 21, 2009 9:44 AM (GMT +1)View Active Threads Who's Online This forum has 30334 registered members. Please welcome our newest member, sushil .Details 5 Latest Threads
|