Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Win 32

  1. #1
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default Win 32

    i have inadvertently and foolishly opened the DHL email. i now am the proud owner of Win32.Buzus.arqx. Computer pretty locked up and cannot download or run from internet.
    Anyone, anyone? I know im a dummy.

  2. #2
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,300

    Default

    Hi,


    Download DDS and save it to your desktop from here or here or here.
    Disable any script blocker, and then double click dds file to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.


    PS. You may need to download using other system.
    Microsoft Windows Insider MVP 2016-2018
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default Win 32

    Ok i did that in Safe Mode. Not sure if that was ok or not but here is what i saved.

  4. #4
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default

    Thanks for the help too. Let me know if i need to try and do this in my normal desktop mode. Not sure if i can though. And if i cannot how do i get a report on a system that wont let me run or download?
    Thanks again.

  5. #5
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,300

    Default

    Hi


    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully first.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2018
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  6. #6
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default Ok did that

    Here are the reports:
    Thank you again.

  7. #7
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,300

    Default

    Hi again,

    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer


    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    http://forums.spybot.info/showthread.php?p=397648#post397648
    Collect::
    c:\docume~1\TENNIS~1\LOCALS~1\Temp\DATF.tmp.exe
    Driver::
    hpzszguirwpo
    Folder::
    c:\documents and settings\All Users\Application Data\oKaHnLc18100
    c:\docume~1\tennis~1\applic~1\Sql
    File::
    c:\windows\system32\MAI1C7.tmp

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Uninstall old Adobe Reader versions and get the latest one ((Adobe Reader X + 10.0.1 update for it)) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.

    Uninstall your current Adobe shockwave player and get the fresh one here if needed.

    Uninstall vulnerable Flash versions by following instructions here. Fresh version can be obtained here.


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 24.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u24-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.



    * Go here to run an online scanner from ESET.
    • Note: You will need to use Internet explorer for this scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is UNchecked.
    • Click Scan
    • Wait for the scan to finish.



    Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2018
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  8. #8
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default Log

    Here is the log. I am following the other directions. I unchecked the resident box on the advanced tab in S D but i could not find the uncheck for tea timer. Let me know if i did it wrong.

  9. #9
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default cannot disable tea timer

    I cannot find where to disable. I unchecked the box for resident but no Tea Timer is availble to uncheck. I tried to reboot and tea timer begins on reboot.
    Also tried online scan. It found trojan but locked up at 17% of scan. I will try again.

  10. #10
    Junior Member
    Join Date
    Mar 2011
    Posts
    7

    Default Where is the eset log?

    I ran eset scan on my system as directed but no report came up. It said it found 3 threats but did not indicate where and i saw not text report. Just trying to do it right.
    Thanks
    Last edited by tashi; 2011-03-11 at 06:38. Reason: Merged two topics

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •