computer virus

[2kchevy06civic 5,000+ posts]

I really don't want to take the time to go through the services and look what each is, I believe DBfan is already on it =D.....

 

[vosschs 5,000+ posts]

i really hope so, this shits gay, i cant even see half the pics on the web, pop ups come up, it shuts down some times

 

[Hundreth 10+ year member]

OK, you can kind of **** over the virus, then delete it...

boot up and push f8, do that thing where you can get into dos...

if you know how to use dos.. goto the folder where the angelex.exe file is...

type edit angelex.exe

and just stick garbage in there... or delete everything... do whatever you can to make that program not work.. then save.

then set the file to read only, reboot, and clean everything out.

 

[sumone 10+ year member]

missing one thing...there's no "dos" in xp //content.invisioncic.com/y282845/emoticons/smile.gif.1ebc41e1811405b213edfc4622c41e27.gif

that's why you gotta goto bootdisk.com, download the first one & boot off that floppy.

then delete the angel program & those vx2 files

then reboot w/o floppy in the drive

 

[sumone 10+ year member]

oh yeah and that hijack-this program has a "delete file on reboot" option if you click the config button at the bottom right, then the misc tools tab...

having a clean system is good //content.invisioncic.com/y282845/emoticons/smile.gif.1ebc41e1811405b213edfc4622c41e27.gif

Logfile of HijackThis v1.99.0

Scan saved at 12:47:24 AM, on 12/17/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\VTTimer.exe

C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe

C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe

C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE

C:\WINDOWS\System32\wfxsnt40.exe

C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE

C:\WINDOWS\System32\devldr32.exe

C:\Program Files\CompuServe 7.0\wcs2000.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Opera7\opera.exe

C:\Documents and Settings\me\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"

O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"

O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\Updreg.exe

O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe

O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE

O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe

O4 - Global Startup: CompuServe 7.0 Tray Icon.lnk = C:\Program Files\CompuServe 7.0\cstray.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{813A3371-9DE7-4515-AD6E-244FF0CC3DC2}: NameServer = 205.188.146.146

O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe

O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe

O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

 

[cyberbob25 10+ year member]

posted by sumone:missing one thing...there's no "dos" in xp

Correct, however, I believe hundreth was referring to the recovery console, which the original poster did say he was able to figure out how to get to. But I still agree with what you said about hijack this.

 

[Hundreth 10+ year member]

Not only that, but it depends if the original poster's file system is FAT32 or NTFS.. where the more common NTFS doesn't have dos, but FAT32 does.

 

[Radar 10+ year member]

Also if youre having a problem deleting files Mike showed me this one. X-cleaner has a shred file function. Taht managed to get rid of a file i could not delete b/c it was 'in use' (in use my ***.....er nevermind)

 

[vosschs 5,000+ posts]

time to reformat

 

[slack 10+ year member]

missing one thing...there's no "dos" in xp //content.invisioncic.com/y282845/emoticons/smile.gif.1ebc41e1811405b213edfc4622c41e27.gif
that's why you gotta goto bootdisk.com, download the first one & boot off that floppy.

then delete the angel program & those vx2 files

then reboot w/o floppy in the drive

maybe he was referring to command prompt. lol i mean geeeez

you can do the same thing as he said with command prompt in winXP

go to start... run... type cmd hit enter

ur shell comes up

cd to the directory of the virus

edit virus.exe

If u wanna do it that way though. I dont recomend messing with all the hex in the file, but if u cant get rid of it, this might work

 

[vosschs 5,000+ posts]

its gone now //content.invisioncic.com/y282845/emoticons/wink.gif.608e3ea05f1a9f98611af0861652f8fb.gif

 

[RangerMan Premium Member]

its gone now //content.invisioncic.com/y282845/emoticons/wink.gif.608e3ea05f1a9f98611af0861652f8fb.gif

How'd you get it off? I have the same shit.

 

[vosschs 5,000+ posts]

i didnt, i reformated

 

[RangerMan Premium Member]

i didnt, i reformated

How do you do that? I'm a computer retard.