[Closed] clickover.cn

Hi,
Same as the others, my XP laptop has been infected by this malware. I found many thread on this forum showing how to fix it, and also with a WARNING: Ask before do the fix.
So, I am not sure if the method shown in this post http://forums.whatthetech.com/Clickover_cn…ts_t105894.html , can be applied for all case, or each computer must have a different approach.

Thank you for your help,

Will

Hi,

Every computer has a different configuration, so another person's fix should not be followed.

I will likely use most of the same tools, but the instructions and scripts could be different.

Please do the following:

Hi and Welcome,

NOTE:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted.
• Please DO NOT run any scans or fix items without my direction.

Please do the following:

STEP #1

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


STEP #2


[external image: Posted Image]
Download GMER Rootkit Scanner from here

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

NOTE: You may have to run these scans in safe mode.

If they will not run in safe mode, try renaming them with a random name and a .com extension ie: for DDS - SSD.com

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log