Application.Keygen.Xpstyle.R please help!

Hello guys,

I alredy did what you said in your guides and i'm desesperate. I have Application.Keygen.Xpstyle.R virus on my computer and i'm unable to remove it. I have bitdefender antivirus plus 10. Please help me.

 

Welcome to MajorGeeks.com!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

• CounterSpy
• AVG Antispyware Log - ONLY IF NEEDED you were not able to run CounterSpy
• Bitdefender - from step 6
• Panda Scan - from step 6
• runkeys.txt - the log from GetRunKey.bat
• newfiles.txt - the log from ShowNew.bat
• HijackThis

If you have followed our guides then you would have postted all the logs requested in the above instructions.

 

Ok, I runed most application that you said. The only ones left are CounterSpy and Hijack. I'll add them in a few moments.

 

Sorry in advanced I'm uploading now shownew, runkey and hijack

 

Here it is The CounterSpy

 

I still need logs from the BitDefender and Panda AcvtiveScan online scans.

 

Ok, here are both scans.

 

HijackThis is not in the location specified by our instructions. Right-click on the underlined text and Save Link as to your Desktop. Move_HijackThis.vbs

Double-click Move_HijackThis.vbs on your Desktop. This script will move HijackThis to the proper location. DO THIS before you continue with my instructions.

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop. DO NOT run it as this time we will do that later in Safe Mode.

Close Notepad.

Using Add or Remove Programs in the Control Panel; uninstall the following:

<< The installed version of Java on this compter is out-dated. Install Java Runtime Environment (JRE) 6 available from Sun Microsystems. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

Download
- Pocket Killbox

Run HijackThis, choose "Open the Misc Tools Section", choose "Process Manager", Highlight:

Choose Kill Process. Click on the "Back" Button

Place a checkmark in the box next to the following lines:Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Open ExplorerXP navigate to and DELETE the following:

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log and fresh logs from ShownNew and GetRunKeys

 

Hi,

I did as you said and noticed 2 things: one while in safe mode i couldn't merge the registry like you said. Second : I couldn't delete C:\WINDOWS\Temp\{52338F65-A1C3-4CDC-B733-50051682B297}. It doesn't exist aparently.

And now i'm posting HijackThis,ShownNew and GetRunKeys like you requested.
Thanks for helping me

 

Run the registry patch in Normal Mode.

Download GMER

1. Save the GMER.zip file to your desktop
2. Now uzip it to your desktop to reveal a GMER.exe file
3. Double click the GMER.exe file
4. Click the Rootkit tab and then click the Scan button.
5. IMPORTANT: Do NOT use the computer while the scan is in progress.
6. Do not select the "Show all" checkbox during the scan.
7. When it finishes, click the Copy button. This will copy the results to your clipboard.
8. Paste the clipboard into a notepad file and save it to a log (like gmer.log).
9. Attach your log to your next reply.

If you don't know how to open notepad, click Start, Run, and enter notepad and click OK. To paste the info you copied into notepad, just hit CTRL-V. Then save the log.

 

Hi,

Finally i could add the registry patch.
I'm adding gmer log