Hi, I am using windows XP on my PC. There is some virus threat. A folder with name "New Folder.exe" is created in every folder. Also i am unable to open task manager, windows services and other management tools. Any application related to virus security is killed automatically right after execution. Also if i open a web page containing any material related to virus scan, the page is closed automatically.
I have installed the updated version of Mcaffe virus scan but scanning is not performed
Thanks for reply I tried it but explorer is closed automatically after page is loaded. I am unable to use any online scan service because of this behavior for explorer.
Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) and save it to your desktop.
When you have done this, please boot into Safe Mode (Tap F8 during startup).
Rightclick on the SDFix.zip folder and choose Extract All. Open the extracted folder- C:\ SDFixand doubleclick on RunThis.bat to start the script.
Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. When you hit any key, your computer will reboot. Your system will take longer that normal to restart as the fixtool will be running and removing files.
When your desktop loads, the utility will complete the removal and display Finished. Press any key again to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of Report.txt back in this thread along with fresh hijackthis log,and tell how things are running
Otherwise -
Please set your system to show all files. Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders. Uncheck: Hide file extensions for known file types Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Click OK.
Find c: autorun. inf
Open it with Notepad and post the contents in next reply
Do NOT post your problem in someone elses thread.
Start a new topic so that it may receive proper attention.
Habib said... Hi, I am using windows XP on my PC. There is some virus threat. A folder with name "New Folder.exe" is created in every folder. Also i am unable to open task manager, windows services and other management tools. Any application related to virus security is killed automatically right after execution. Also if i open a web page containing any material related to virus scan, the page is closed automatically.
I have installed the updated version of Mcaffe virus scan but scanning is not performed
I am having the same exact problems. One of the other problems is that it also removes your folder options to show hidden files, and msconfig.
I finally installed QUICKSTARTUP and found a startup entry for a folder>Yahoo Mess..pointing to SCVHSOT.exe (that is spelled correctly). It is located in the system32 file. There is also another "folder" named Nhatquanglan18. These folders are actually applications. Once I delete these applications and remove the startup link in the startup.ini, if booted to Winternals ERD commander and use the Regedit tool to repair the ACMru entry. There should only be 2 entries under ACMru: 5603 and 5604 with no subfolders. Just delete all that shouldnt be there... 5603 should only have 2 entries: )Default) reg_sz (value not set) and 000 reg_sz *.exe, and 5604 should only have 1 entry: (default) reg_sz (value not set). Delete all other entries. Then I browsed to SAMS/administrator (or your admin account) and right click to reset permissions.
After all this, I was able to do almost all admin stuff accept tast manager, but I could create a new admin account and it had all admin features, and the newfolder.exe would stop writing itself to my thumbdrive evertime I inserted it, not to mention a (foldername).exe in every folder and subfolder throughout the entire drive. I also noticed that this "virus/worm" does not write itself or create subfolders on external USB drives, as long as they are not FLASH based.
I have been searching for a week to get better or updated information, this forum is the closest yet to what I am getting. Hope the above helps at least for now. And I hope Symantec gets on board with this to catch it with real time protection.
Currently it is Wednesday, March 17, 2010 9:09 PM (GMT +1) There are a total of 76.277 posts in 17.610 threads. In the last 3 days there were 11 new threads and 60 reply posts. View Active Threads
Who's Online
This forum has 31151 registered members. Please welcome our newest member, kas. 16 Guest(s), 0 Registered Member(s) are currently online. Details
|