How to remove iworm_attck_v122.02?

[supernoobcc]

Hi``
My dad just got a virus called iworm_attck_v122.02a,
it really screwed up his computer`` Is there anyway
i can remove it? We tried AVG, but its not working``
Please help!

 

[howard_hopkinso]

Go HERE and follow the instructions exactly.

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard

 

[fastco]

Follow these instructions carefully;

https://www.techspot.com/vb/topic50981.html

 

[fastco]

Sorry Howard we posted at the same time.

 

[howard_hopkinso]

No problem mate.

It does happen from time to time lol.

Regards Howard

 

[supernoobcc]

Thanks````

 

[IBN]

Make sure you've got a firewall also. If you havn't then download the free version of Zone Alarm.

 

[supernoobcc]

Give me one moment and ill get my HJT log``

 

[supernoobcc]

Dam`` Looks like its gonna take a while....

 

[howard_hopkinso]

Dam`` Looks like its gonna take a while....

Yes it will take a while. However, it`s better than a reformat lol.

Regards Howard

 

[supernoobcc]

Hey`` Howard``
I finally fnish all the steps you told me to do.
Here is my HJT log, please take a look
at it`` Man i wish this crap goes away!

 

[howard_hopkinso]

Your computer is infected with SmitFraud amongst other things.

You haven`t followed the instructions properly, but no matter. I will now give you some step by step instructions, please follow them exactly.

Step 1: Go HERE and follow the instructions very carefully.

Step 2: Go HERE and do likewise.

Step 3: Go HERE and follow the instructions for Ewido.

Post a fresh HJT log, only after doing the above.

Regards Howard

 

[supernoobcc]

OH OH `LOL
Thank you again``
After i did the above``
Everything is fine again!!
THanks man``` They should make up some nobel prizes
for people who do this kind of favors for free. Hehe``

 

[howard_hopkinso]

That`s good news.

However, I`d still like you to post a fresh HJT log, so I can check to make sure your system is clean.

Regards Howard

 

[supernoobcc]

Hey`` Howard``
My dad told me to tell you thank you thank you thank you``
LOL`He says he doesnt anything about computers,but he got to use it
for his joib and if it's not for me or for you, he would have to bring the
computer to best-buy all the time and pay money to get it fixed.
Well, he told me i have to tell u this, hehe``

 

[howard_hopkinso]

Tell your dad, it`s no problem.

I still want to see a fresh HJT log though.

Regards Howard

 

[supernoobcc]

sure```Here is the new HJT log..

 

[howard_hopkinso]

The system is far from clean yet.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

ALCXMNTR.EXE
b1a8a6a5.exe
pgpzge.exe
gdnUS2218.exe

Close task manager.

Run HJT with no other programmes open(except notepad).Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [slfuijv] c:\windows\system32\pgpzge.exe

O4 - HKLM\..\Run: [b1a8a6a5.exe] C:\WINDOWS\system32\b1a8a6a5.exe

O4 - HKCU\..\Run: [b1a8a6a5.exe] C:\Documents and Settings\Owner\Local Settings\Application Data\b1a8a6a5.exe

O9 - Extra button: Instant Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.c om/ (file missing)

O16 - DPF: {00BF3C8D-1C0C-5F86-2BF2-1EA502606884} - http://85.255.113.214/1/gdnUS2218.exeFix all the 016-PDF entries that are the same as this. I.E have the gdnUS2218.exe file at the end.

O21 - SSODL: fairydom - {5839511e-ec1b-4f91-ace3-fb88e52f5239} - (no file)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\b1a8a6a5.exe
C:\windows\system32\pgpzge.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\b1a8a6a5.exe
gdnUS2218.exe<You will need to search your system for this file and delete all instances of it(if there).

Reboot into normal mode and turn system restore back on.

Post a fresh HJT log.


Regards Howard

 

[supernoobcc]

Alright`` Thanks again man`` I'll do it when i got time``
Lol, my dad always got tons of viruses``