TechSpot

How to remove iworm_attck_v122.02?

By supernoobcc
Jul 5, 2006
  1. Hi``
    My dad just got a virus called iworm_attck_v122.02a,
    it really screwed up his computer`` Is there anyway
    i can remove it? We tried AVG, but its not working``
    Please help!
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Go HERE and follow the instructions exactly.

    Post a fresh HJT log into this thread, only after doing the above.

    Regards Howard :)
     
  3. fastco

    fastco TS Booster Posts: 1,122

  4. fastco

    fastco TS Booster Posts: 1,122

    Sorry Howard we posted at the same time.
     
  5. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    No problem mate.

    It does happen from time to time lol.

    Regards Howard :)
     
  6. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    Thanks````
     
  7. IBN

    IBN TS Maniac Posts: 487

    Make sure you've got a firewall also. If you havn't then download the free version of Zone Alarm.
     
  8. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    Give me one moment and ill get my HJT log``
     
  9. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    Dam`` Looks like its gonna take a while....
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Yes it will take a while. However, it`s better than a reformat lol.

    Regards Howard :)
     
  11. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    Hey`` Howard``
    I finally fnish all the steps you told me to do.
    Here is my HJT log, please take a look
    at it`` Man i wish this crap goes away!
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your computer is infected with SmitFraud amongst other things.

    You haven`t followed the instructions properly, but no matter. I will now give you some step by step instructions, please follow them exactly.

    Step 1: Go HERE and follow the instructions very carefully.

    Step 2: Go HERE and do likewise.

    Step 3: Go HERE and follow the instructions for Ewido.

    Post a fresh HJT log, only after doing the above.

    Regards Howard :)
     
  13. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    OH OH `LOL
    Thank you again``
    After i did the above``
    Everything is fine again!!
    THanks man``` They should make up some nobel prizes
    for people who do this kind of favors for free. Hehe``
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    That`s good news.

    However, I`d still like you to post a fresh HJT log, so I can check to make sure your system is clean.

    Regards Howard :)
     
  15. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    Hey`` Howard``
    My dad told me to tell you thank you thank you thank you``
    LOL`He says he doesnt anything about computers,but he got to use it
    for his joib and if it's not for me or for you, he would have to bring the
    computer to best-buy all the time and pay money to get it fixed.
    Well, he told me i have to tell u this, hehe``
     
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Tell your dad, it`s no problem.

    I still want to see a fresh HJT log though.

    Regards Howard :)
     
  17. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    sure```Here is the new HJT log..
     
  18. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    The system is far from clean yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    ALCXMNTR.EXE
    b1a8a6a5.exe
    pgpzge.exe
    gdnUS2218.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

    O4 - HKLM\..\Run: [slfuijv] c:\windows\system32\pgpzge.exe

    O4 - HKLM\..\Run: [b1a8a6a5.exe] C:\WINDOWS\system32\b1a8a6a5.exe

    O4 - HKCU\..\Run: [b1a8a6a5.exe] C:\Documents and Settings\Owner\Local Settings\Application Data\b1a8a6a5.exe

    O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.c om/ (file missing)

    O16 - DPF: {00BF3C8D-1C0C-5F86-2BF2-1EA502606884} - http://85.255.113.214/1/gdnUS2218.exeFix all the 016-PDF entries that are the same as this. I.E have the gdnUS2218.exe file at the end.

    O21 - SSODL: fairydom - {5839511e-ec1b-4f91-ace3-fb88e52f5239} - (no file)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\WINDOWS\ALCXMNTR.EXE
    C:\WINDOWS\system32\b1a8a6a5.exe
    C:\windows\system32\pgpzge.exe
    C:\Documents and Settings\Owner\Local Settings\Application Data\b1a8a6a5.exe
    gdnUS2218.exe<You will need to search your system for this file and delete all instances of it(if there).

    Reboot into normal mode and turn system restore back on.

    Post a fresh HJT log.


    Regards Howard :)
     
  19. supernoobcc

    supernoobcc TS Rookie Topic Starter Posts: 18

    Alright`` Thanks again man`` I'll do it when i got time``
    Lol, my dad always got tons of viruses``
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...