Virus sos?

ndmmxiaomayi SG

The wrong version of Recovery Console has been installed. We need to get it removed and re-install the correct version. Please ensure that you read through all instructions carefully. If any of the steps are unclear, please let me know.

Show hidden files and folders

Step 1

Delete this file, it's on your desktop.

C:\Documents and Settings\Administrator\Desktop\WinXP_EN_HOM_BF.EXE

Step 2

Delete this folder - C:\cmdcons

Step 3

Delete this file file - C:\Boot.ini

Step 4

Right click on this file - C:\Boot.bak and select Rename.

Copy and paste in Boot.ini and press Enter.

Let me know when you have done all 4 steps. Don't restart your computer yet.

motoway SG

I cant find c:\boot.ini in my C drive though when i type c:\boot.ini i can find it.

As in, i don't see boot.ini file in c:\

ndmmxiaomayi SG

Show hidden files already?

Boot.ini by default is hidden.

motoway SG

ok sollie missed 1 step.

Ok already :)

ndmmxiaomayi SG

Is Boot.bak renamed to boot.ini ?

motoway SG

yeps!

ndmmxiaomayi SG

Download XP Pro Recovery Console setup file from here - http://www.microsoft.com/downloads/details.aspx?FamilyId=535D248D-5E10-49B5-B80C-0A0205368124&displaylang=en

Save it to your desktop and drag it into Combofix.

Follow the instructions...

Remember to disable AntiVir (right click on the umbrella and untick AntiVir Guard enable) before running Combofix.

Upload the Combofix log to Mediafire.

motoway SG

ok i go run combo fix liao hab to off this webbie le.

Later~

motoway SG

I tink it's dis one ba..

http://www.mediafire.com/?0ojpxt4z4yg

Too many combo fix file le. I tink the latest one is the one in C drive rite?

This is the one i found in C drive. Sollie sollie i didn't take notice of where the latest one is stored.

motoway SG

Me thinks virus still around coz my IE keeps hanging. o_0

ndmmxiaomayi SG

Yeah...

Disable AntiVir temporarily

Right click on the red umbrella and untick AntiVir Guard enable. Remember to re-enable it before posting back the logs.

Disable Teatimer temporarily

Download this file - http://www.mediafire.com/?mr2rxtcid13

Save it as CFScript.txt

Referring to the picture below, drag CFScript into Combofix.

Combofix will start running. When done, a log will be produced. Please post this log in your next reply.

In addition, it will prompt you to submit some files for analyzing.

Click OK.

Copy and paste the file path into the text box next to the Browse button (boxed up in red).

Click on Send File.

Do not mouse click on Combofix while it is running. That may cause it to stall.

Upload both HijackThis and Combofix logs to Mediafire.

motoway SG

Hey i clicked Send File and the window close. Is that supposed to happen?

This is the combofix log:

http://www.mediafire.com/?sml5t8viogy

And this is the HijackThis log:

http://www.mediafire.com/?dmdzjycbyk1

Thanks Mayi for your detailed instructions thus far. Really appreciate it!

ndmmxiaomayi SG

Hey i clicked Send File and the window close. Is that supposed to happen?

Yes.

ndmmxiaomayi SG

Looks good.

motoway SG

KapserSky log.

http://www.mediafire.com/?nmezga9byyb

« Previous Page