BleepingComputer.com: Need Help With Removing Adware.purityscan

Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Forum Rules

When posting your problem, do not run and post a ComboFix log. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

If you have not received help after three days, please post a link to your topic HERE.
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Need Help With Removing Adware.purityscan

#1 User is offline   direku 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 7
  • Joined: 22-July 08

Posted 23 July 2008 - 03:08 AM

Hello,

My computer has been infected for quite some time with the adware.purityscan virus which is detected but cannot be removed from my norton antivirus (NA). This malicious virus keeps spawning more and more virus files, their number has gone up to 431. NA can clean most of them but the number of the core files which cannot even be quarantined has gone from 2 or 3 to 11 such files. The effect of the virus is that annoying unwelcome advertisements pop-up time and again while connected to the internet, and I have refrained from on-line shopping.

I have downloaded HJTInstall, ComboFix, and WindowsXP-KB310994-SP2-Home-BootDisk-ENU on my desktop. Following some instructions I found on the web, I dragged WindowsXP-KB310994-SP2-Home-BootDisk-ENU onto the ComboFix and let the thing run hoping that it would resolve the problem. ComboFix generated a log file which I can post here if required. After ComboFix was done I restarted the computer and scanned it with my NA. NA again finds plenty of purityscan virus files. So the removing of the virus is not done. My computer is running fine so far.

I'm waiting for directions on what to do next.

Thank you for your time,
Direku

This post has been edited by direku: 23 July 2008 - 03:09 AM

#2 Guest_superbird_*

  • Group: Guests

Posted 23 July 2008 - 05:14 AM

Hi,

Please don't use tools like ComboFix/Hijackthis, because this could be dangerous without supervising helpers. Every advice is different.

Now, do this:

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware

  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.

  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

#3 User is offline   direku 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 7
  • Joined: 22-July 08

Posted 23 July 2008 - 06:06 AM

Hi superbird,

here is the log file from Malwarebytes' Anti-Malware.

Malwarebytes' Anti-Malware 1.22
Database version: 982
Windows 5.1.2600 Service Pack 2

5:43:41 PM 7/24/2008
mbam-log-7-24-2008 (17-43-41).txt

Scan type: Quick Scan
Objects scanned: 42886
Time elapsed: 3 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

#4 Guest_superbird_*

  • Group: Guests

Posted 23 July 2008 - 06:08 AM

Please use the Internet Explorer browser (or FireFox with IETab), and do an online scan with Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
  • Once the files are downloaded click on Next
  • Click on Scan Settings and configure as follows:
    • Scan using the following Anti-Virus database:
        Extended

    • Scan Options:
        Scan Archives
        Scan Mail Bases

  • Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
Posted Image
Posted Image
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.

#5 User is offline   direku 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 7
  • Joined: 22-July 08

Posted 24 July 2008 - 07:58 PM

Hi superbird,

I'm sorry for the delay, but my internet connection is slow and it took a while to download and run the Kaspersky Scanner. The log file generated from the program is displayed below. I'm waiting for further instructions.

Thank you.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
 Saturday, July 26, 2008
 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
 Kaspersky Online Scanner 7 version: 7.0.25.0
 Program database last update: Thursday, July 24, 2008 23:38:32
 Records in database: 1005269
--------------------------------------------------------------------------------

Scan settings:
	Scan using the following database: extended
	Scan archives: yes
	Scan mail databases: yes

Scan area - My Computer:
	C:\
	D:\
	F:\
	G:\
	H:\
	I:\

Scan statistics:
	Files scanned: 68557
	Threat name: 12
	Infected objects: 30
	Suspicious objects: 0
	Duration of the scan: 00:55:05


File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280000\4C3CE29D.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280001\4C3CE2A6.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280002\4C3CE2AF.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800000\4CD72569.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.if	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800001\4CD72570.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04840001\4C8DAECD.VBN	Infected: Trojan.Win32.BHO.bkm	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980000\4CB99C0C.VBN	Infected: Trojan-Downloader.Win32.Agent.jih	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980001\4CB99D6E.VBN	Infected: Trojan-Downloader.Win32.Agent.ezc	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980002\4CB99E65.VBN	Infected: Trojan-Downloader.Win32.Agent.ofz	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980003\4CB99E6D.VBN	Infected: not-a-virus:AdWare.Win32.Rond.d	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04A80001\4CA83854.VBN	Infected: Trojan.Win32.BHO.bkm	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0000\4CED9F17.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.if	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0001\4CED9F1F.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680000\4F79B1BA.VBN	Infected: Trojan-Downloader.Win32.Homles.bl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680001\4F79B1D9.VBN	Infected: Trojan.Win32.Monderb.fd	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0000\485F780E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0001\485F7816.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000\48FCCB8E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0001\48FCCD18.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0002\48FCCD20.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0003\48FCCD28.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000\48FC852E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0001\48FC8535.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0002\48FC853D.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0000\493FDBF2.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0001\493FDBFA.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0002\493FDC02.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0001\49FED62E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0002\49FED636.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\QooBox\Quarantine\C\Program Files\FNTS~1\uѕerinit.exe.vir	Infected: not-a-virus:AdWare.Win32.PurityScan.id	1

The selected area was scanned.

#6 Guest_superbird_*

  • Group: Guests

Posted 25 July 2008 - 06:28 AM

Hi,

First, empty your Quarantine from Symantec Antivirus.
After that, make a new scan with Symantec Antivirus, and delete everything it finds.

Now, make a new logfile with Kaspersky.
Post it in your next reply.

Do you have any problems?

#7 User is offline   direku 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 7
  • Joined: 22-July 08

Posted 25 July 2008 - 07:38 PM

Hi superbird,

I followed your instructions: I deleted the files that the norton antivirus had quarantined. Then I run the antivirus and it found only one infected file which was C:\QooBox\Quarantine\C\Program Files\FNTS~1\uѕerinit.exe.vir. The antivirus didn't give me an option to remove this file because it said it had quarantined it. I rebooted the computer and then I run Kaspersky Scan. Here is the scan report:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
 Sunday, July 27, 2008
 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
 Kaspersky Online Scanner 7 version: 7.0.25.0
 Program database last update: Friday, July 25, 2008 22:58:43
 Records in database: 1008751
--------------------------------------------------------------------------------

Scan settings:
	Scan using the following database: extended
	Scan archives: yes
	Scan mail databases: yes

Scan area - My Computer:
	C:\
	D:\
	F:\
	G:\
	H:\
	I:\

Scan statistics:
	Files scanned: 67767
	Threat name: 12
	Infected objects: 30
	Suspicious objects: 0
	Duration of the scan: 00:55:55


File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280000\4C3CE29D.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280001\4C3CE2A6.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280002\4C3CE2AF.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800000\4CD72569.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.if	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800001\4CD72570.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04840001\4C8DAECD.VBN	Infected: Trojan.Win32.BHO.bkm	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980000\4CB99C0C.VBN	Infected: Trojan-Downloader.Win32.Agent.jih	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980001\4CB99D6E.VBN	Infected: Trojan-Downloader.Win32.Agent.ezc	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980002\4CB99E65.VBN	Infected: Trojan-Downloader.Win32.Agent.ofz	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980003\4CB99E6D.VBN	Infected: not-a-virus:AdWare.Win32.Rond.d	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04A80001\4CA83854.VBN	Infected: Trojan.Win32.BHO.bkm	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0000\4CED9F17.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.if	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0001\4CED9F1F.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680000\4F79B1BA.VBN	Infected: Trojan-Downloader.Win32.Homles.bl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680001\4F79B1D9.VBN	Infected: Trojan.Win32.Monderb.fd	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0000\485F780E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0001\485F7816.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000\48FCCB8E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0001\48FCCD18.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0002\48FCCD20.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0003\48FCCD28.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000\48FC852E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0001\48FC8535.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0002\48FC853D.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0000\493FDBF2.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0001\493FDBFA.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hl	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0002\493FDC02.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0001\49FED62E.VBN	Infected: not-a-virus:AdWare.Win32.PurityScan.hk	1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0002\49FED636.VBN	Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad	1
C:\QooBox\Quarantine\C\Program Files\FNTS~1\uѕerinit.exe.vir	Infected: not-a-virus:AdWare.Win32.PurityScan.id	1

The selected area was scanned.

#8 Guest_superbird_*

  • Group: Guests

Posted 26 July 2008 - 03:47 AM

Hi,

1. Open Notepad - Do not use any other texteditor, or the script will fail!
Copy this in the notepad file:

@ECHO OFF
IF EXIST log.txt DEL log.txt
ECHO Deleting files>>log.txt
FOR %%g in (
"C:\QooBox\Quarantine\C\Program Files\FNTS~1\uѕerinit.exe.vir") DO (
IF EXIST %%g (
ATTRIB -r -s -h %%g
DEL %%g
IF EXIST %%g (
ECHO %%g not deleted>>log.txt
) ELSE (
ECHO %%g deleted>>log.txt)
) ELSE (
ECHO %%g not found>>log.txt))
>>log.txt (
ECHO.
ECHO Deleting folders)
FOR %%I in (
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280002"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04840001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980002"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980003"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04A80001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0002"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0003"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0002"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0000"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0002"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0001"
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0002") DO (
IF EXIST %%I (
RD /S /Q %%I
IF EXIST %%I (
ECHO %%I not deleted>>log.txt
) ELSE (
ECHO %%I deleted>>log.txt)
) ELSE (
ECHO %%I not found>>log.txt))
START NOTEPAD.EXE log.txt

Go to File > Save As
Fill in the following values:
Location: Desktop
Filename: del.bat
Filetype: All Files

Dobleclick del.bat to start the script.
Post the logfile that opens in your next reply.

2. Go to Start > Run. Type: combofix /u


Do you still have any problems? :thumbsup:

#9 User is offline   direku 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 7
  • Joined: 22-July 08

Posted 26 July 2008 - 06:54 AM

superbird,

here is the log file of your script. As you see, the problematic file is not deleted! Do you have any other suggestion as to how this virus can be exterminated? Also I didn't understand why the ComboFix was no longer needed. It was ComboFix that reduced all the problems created from this virus on my computer to only this file.

Deleting files
C:\QooBox\Quarantine\C\Program Files\FNTS~1\u?erinit.exe.vir not deleted

Deleting folders
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04280002" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04800001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04840001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980002" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04980003" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04A80001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\04AC0001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\07680001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\085C0001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0002" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08CC0003" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08DC0002" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0000" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\090C0002" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0001" deleted
"C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\09FC0002" deleted

This post has been edited by direku: 26 July 2008 - 06:57 AM

#10 Guest_superbird_*

  • Group: Guests

Posted 26 July 2008 - 07:14 AM

Have you done step 2?

I let you delete combofix because:
1. The infected files that are quarantined by ComboFix are being deleted then.
2.It's not recommended to use ComboFix without supervision. ComboFix is a specialized tool, and can't be used by everyone. A training is needed to understand everything what ComboFix sais.

If you haven't done step 2 yet, please do it.

Then inform me which problems you still have. :thumbsup:

#11 User is offline   direku 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 7
  • Joined: 22-July 08

Posted 26 July 2008 - 10:40 AM

Hi superbird,

Scanning my computer with my antivirus, and after that with Kaspersky Scanner, didn't show traces of any viruses. I believe things are all clean and safe now.
Thank you for your excellent support, and keep you forum simple and clean too :thumbsup:

So Long,
Direku.

#12 Guest_superbird_*

  • Group: Guests

Posted 26 July 2008 - 10:51 AM

Hi,

You're welcome. :thumbsup:
Do this:

1. Now you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

2. Go to the Windows update site and download and install all available updates, so your computer is prtected against malware.

3. Read this page To prevent yourself against re-infection.

You can delete all used tools and programs.

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users