SecurityTool virus

Welcome, Nohbdy

Step 1:
Let's try to download and save the below to your PC (save it anywhere you can find it. The Desktop is fine). Then double-click on it to run it.

AVPFind.bat

It should take a couple minutes to run. You will see a black command prompt window while it is running and it should close when it is finished. Once it finishes, attach the c:\avplog.txt file that is will hopefully create as long as the malware does not block the batch file from running.

Step 2:
Now download and Run exeHelper

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


Step 3:
Next, try running the below online scan:

http://www.superantispyware.com/onlinescan.html

Reboot immediately after scanning if it finds and removes anything. Let me know if anything was found. See if you can save a log with it.


Step 4:
Now run a new scan with MGtools: Using MGtools

Attach the below logs when finished with all of the above:

• C:\avplog.txt - from AVPfind
• a log from online SAS scan if you could make one
• log.txt - from exeHelper
• C:\MGlogs.zip - from MGtools

*The C:\ assumes that drive C is you Windows boot drive. If you boot from another drive, then use the correct drive letter above.

dr.m

 

Nohbdy

I see you're online --- please wait for my instructions to be posted shortly.

Thanks,
dr.m

 

Nohbdy

Please enter the below command into a command prompt window. Note that this is a space after the DIR and also before every C:\

DIR /a/s C:\WINDOWS\scecli.dll C:\WINDOWS\netlogon.dll C:\WINDOWS\eventlog.dll C:\Windows\cngaudit.dll > C:\flist.txt

If the above runs, a file named C:\flist.txt should be created. Attach this file here or post inline what is in the file (do whatever is easier).

Thanks!

 

:tas

Arrggghhh! ... conferring with our Malware Guru.

dr.m

 

Hello, Nohbdy

Questions:
(1) Can you boot into Safe Mode or Safe Mode with Command Prompt?
(2) Do you have your Windows XP boot CD?

* Using Windows Explorer, please locate the following files / right-click on them / select "Properties".

Under the General tab, please post back the file sizes in bytes:

C:\WINDOWS\scecli.dll
C:\WINDOWS\netlogon.dll
C:\WINDOWS\eventlog.dll

dr.m

 

Thanks for letting me know.

Safe surfing