8 Step Removal Program and Win32/Heur Problem

Status
Not open for further replies.
No!

Start-Run
type
CMD
click OK or Hit Enter Key

Left Click black screen once to make it the active screen then Rt click and paste text from box.

If we need it do you have your XP install CD?

Bear with me as when we get by this we should be able to finish up.

Mike
 
1. How do you get the the command prompt from here? Do I have to reboot to command mode? I am in safe mode with networking

2. You said copy all the way to the second exit. I see three exits in your code.

3. When I get this new icon, I post it back on what thread?

Sorry about my unexperience at this. I just want to be right and not mess up. Thanks

No, I wish I had the install CD with me. It would of made it easier.
 
Ok we will deal with no CD.

3rd exit was a typeo, would cause no problem but I fixed it. You may have to close and reenter the thread to see it.

Yes post the new contents of new Icon.

Mike
 
Not there.

What other computer are using or can you copy regedit.exe from the c:\windows folder of the other computer and copy it to this computer to the C:\windows folder?

Mike
 
Can you copy it via Flash drive or cd writable to the effected computer. Put in c:\windows folder!

Mike
 
Ok. I just did. It just took a long time because running the computer in Normal mode is very slow right now.

I hope you meant the txt file to the c drive right?
 
Hmm!

I meant copy the regedit.exe from the other working computer and put in c:\windows folder of the computer that has a missing regedit.exe.

No problem you are doing great so don't let it stress you out.

BTW do you have a Windows CD for the other computer?

Mike
 
Ohhh. I see. I am going into the c directory now and copng the regedit on a flash drive now.

Windows CD. Do you mean the software?
 
yes I have that cd

I am sorry again. I have the MS Office software CD and not XP. Can I goto Microsoft online and download and install this regedit file?
 
That is what I have been saying.

The good computer has a regedit.exe in the C:\windows folder. All we need to do is copy that one and put it on the one that needs it!

Mike
 
I have that regedit file parked on the desktop of the affected computer now. But, I dont know where to park it in the c drive becuase it has different dir folders than the computer I got it from.
 
OK good.

Rt click and copy
then open My computer
click c:
then click the windows folder
paste to a blank space and chose paste.

If it works then exit to desktop and run ComboFix as that was what found it missing.

Mike
 
Jeeze! I am hanging with you until we fix this and then I am taking the rest of the day off!:D

Meanwhile I am helping others while waiting on your replies. So no problem.

Paste the below into a notepad document so that you can cut and paste on the computer we are working on.

Left Drag mouse and Copy for Pasting all text in the box below. Make sure the slider bar goes to bottom from the @ to the end of the second exit.

Then paste to the black screen of an open command prompt. All may not apply so ignore errors.

Code: 
@echo off
cd\
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile

sc stop TDSSserv.sys
sc delete TDSSserv.sys
:: Above sc commands first stops then deletes service if it exists
::
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata"
reg unload "HKEY_LOCAL_MACHINE\SOFTWARE\tdss"
::
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\tdss" /f
::The above reg commands first unloads the reg keys then deletes these keys.
::
Attrib -h -s -r tdss*.* /s
del  tdss*.* /f /q /s
:: The above two lines first clears protective attributes then 
:: deletes all files on Drive beginning with the name tdss

:: Remove AntiVirus2009
attrib -h -s -r "%UserProfile%\Desktop\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk"
attrib -h -s -r "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll"
attrib -h -s -r "%UserProfile%\Start Menu\Antivirus 2009\*.*"

del "%UserProfile%\Desktop\Antivirus 2009.lnk" /f /q
del "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk" /f /q
del "%UserProfile%\Local Settings\Temporary Internet Files\Content.IE5\S96PZM7V\winsrc[1].dll" /f /q
del "%UserProfile%\Start Menu\Antivirus 2009\*.*" /f /q

rd /s /q "%UserProfile%\Start Menu\Antivirus 2009"

attrib -h -s -r "c:\Program Files\Antivirus 2009\*.*"
rd /s/q "c:\Program Files\Antivirus 2009"

attrib -h -s -r c:\WINDOWS\system32\ieupdates.exe
attrib -h -s -r c:\WINDOWS\system32\scui.cpl
attrib -h -s -r c:\WINDOWS\system32\winsrc.dll

del c:\WINDOWS\system32\ieupdates.exe /f /q
del c:\WINDOWS\system32\scui.cpl /f /q
del c:\WINDOWS\system32\winsrc.dll /f /q

attrib -h -s -r c:\program files\xwdxqu.txt
attrib -h -s -r c:\windows\x
attrib -h -s -r c:\windows\SxsCaPendDel

del c:\program files\xwdxqu.txt  /f /q
del c:\windows\x  /f /q
del c:\windows\SxsCaPendDel  /f /q

reg delete HKLM\SOFTWARE\swearware /f
reg delete HKCU\Software\Wget /f
reg delete HKLM\Software\Classes\CLSID\{CD363BEC-7150-B887-530D-F3E2E0424EA} /f

:: rootkit gaopdxserv
attrib -h -s -r "c:\windows\system32\drivers\gaopdxqfotrruc.sys"
attrib -h -s -r "c:\windows\system32\gaopdxqpqjwmyc.dll"
attrib -h -s -r "\c:\windows\system32\drivers\gaopdxuigiphwm.sys"

sc stop gaopdxserv.sys.sys
sc delete gaopdxserv.sys.sys

del  /f /q "c:\windows\system32\drivers\gaopdxqfotrruc.sys"
del  /f /q  "c:\windows\system32\gaopdxqpqjwmyc.dll"
del  /f /q  "\c:\windows\system32\drivers\gaopdxuigiphwm.sys"

sc stop WinSvchostManager
sc delete WinSvchostManager

sc stop ntndis
sc delete ntndis

attrib -h -s -r "C:\WINDOWS\system32\drivers\ntndis.exe"
attrib -h -s -r "C:\WINDOWS\system32\drivers\ntndis.sys"

del  /f /q "C:\WINDOWS\system32\drivers\ntndis.exe"
del  /f /q "C:\WINDOWS\system32\drivers\ntndis.sys"

sc stop u_lehj
sc delete u_lehj

attrib -h -s -r "c:\program files\Common Files\System\u_lehj32.dll"
del  /f /q "c:\program files\Common Files\System\u_lehj32.dll"

attrib -h -s -r "C:\WINDOWS\system32\svcprs32.exe"
attrib -h -s -r "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
attrib -h -s -r "C:\WINDOWS\system32\mdmcls32.exe"

del  /f /q "C:\WINDOWS\system32\svcprs32.exe"
del  /f /q "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dllhost.exe"
del  /f /q "C:\WINDOWS\system32\mdmcls32.exe"

reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys" /f
reg delete "HKEY_LOCAL_MACHINE\Software\Classes\gaopdxvx" /f

reg delete "HKEY_CURRENT_USER\Software\75319611769193918898704537500611" /f
reg delete "HKEY_CLASSES_ROOT\CLSID\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{037C7B8A-151A-49E6-BAED-CC05FCB50328}" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "75319611769193918898704537500611" /f
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" "ieupdate" /f
echo Finshed ripping out Antivirus 2008-9
:: Fix associations
ftype exefile="%1" %*
ftype batfile="%1" %*
ftype cmdfile="%1" %*
ftype comfile="%1" %*
ftype scrfile="%1" /S
ftype regfile="regedit.exe" "%1"
ftype piffile="%1" %*
ftype inffile=%SystemRoot%\System32\NOTEPAD.EXE "%1"
ftype vbsfile=%SystemRoot%\System32\WScript.exe "%1" %*
ftype jsfile=%SystemRoot%\System32\WScript.exe "%1" %*

assoc .exe=exefile
assoc .bat=batfile
assoc .cmd=cmdfile
assoc .com=comfile
assoc .scr=scrfile
assoc .reg=regfile
assoc .pif=piffile
assoc .lnk=lnkfile
assoc .inf=inffile
assoc .vbs=VBSFile
assoc .js=JSFile
exit
exit

This should run and exit!

It is a coverall and you may see a few errors related to it addressing something you do not need. This is normal ignore.

Reboot then do the below

Open then Update SuperAntiSpyware

Then Click Preferences
then click Repairs

Then counting down from top do the following entries

Numbers 6, 8, 11, 12, 13, 15,18, 19, 20, 21, 22, 24, 25, 26 and 27!

Then in case some of the things we fixed after MBAM and SAS were reporting clean, allows them to find more now run MBAM and SAS again.

Mike
 
ok. I just got back from a small break myself and I really do appreciate your time on a Saturday. I am running the command now. How long does it take to run? The last statement on it says The operation completed successfully
Attrib -h -s -r tdss*.* /s

It hasnt exited itself yet.

sorry it just did...oops

OK running Mbam and then SAS. Will send txt files as well as HJT to you when done. Hopefully we are headed towards the finish line.
 
Yes but we sure are limited by no XP CD!

You are doing great. It is hard for you and me doing it this way but that is the only way for now.

Mike
 
No worries. I needed this done becuase this computer is my lifeline in my profession. How do I obtain a XP CD?
 
Who is the computer Mfg?

Mike

Look on the Sony website for your model usually they have a disk at a very good price.

Mike
 
It seems like mbam is not responding although the processors are running on it. I had to shut it down in Normal mode and had to restart it in Safe mode and it is still not responding on the interface screen.
 
Abort it and try SAS first.

Then retry MBAM.

We are getting nowhere. I think you should ask your family and friends to borrow a Windows XP cd.

Mike
 
Status
Not open for further replies.

Similar threads

E
I have been taken over by a software called Astanda using XML to Log everything and roaming to an SQL server.
Replies
0
Views
467
eriksnyman1
E
O
Syngate - what is it and why has it shown up on my laptop?
Replies
2
Views
280
Nelson28
N
J
Inactive Admin rights are revoked
Replies
18
Views
2K
Broni
Broni

Latest posts

Back