AndyManchesta
Excuse me posting into the thread Simon V, SDFix has removed the worm but hasnt removed its reg entries so I thought its best to clear that up first so it doesnt look like the worm is still running. I'll make a slight adjustment later so it repeats the regfixes in normal mode to prevent it happening again but the log shows it removed the worm files so this part should be simple enough to complete
Hi Artemesia
Run Hijack This and choose Do A System Scan then place a check next to these entries
F3 - REG:win.ini: load=C:\WINDOWS\system32\vdbezmzs\winlogon.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\vdbezmzs\winlogon.exe
Close all open browser and other windows except for Hijack This and press the Fix Checked button
Can you set Windows to show hidden files and folders to remove the following shortcut as HijackThis usually has problems fixing it
Click Start. Goto MyComputer then C:\drive
Select the Tools menu from the top bar and click Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
UnCheck the "Hide protected operating system files (recommended)" option.
Click Yes to confirm then OK
Set this back once you have checked for the file by opening the same page and pressing the Restore Defaults button then click Apply and OK.
Goto Start > Run > and copy and paste
%userprofile%\Start Menu\Programs\Startup\
Press OK and it will open the startup folder, check for a file named winlogon in this folder and if its found right click it and choose Delete.
Goto Start > Run > and type
cmd
Press OK and the command prompt will open, copy and paste this onto the cmd screen
rd /q %systemroot%\system32\vdbezmzs
Press OK and it will remove the empty worm folder, type exit and press ok to then close the command prompt
Next open notepad (Start Menu > Run > type notepad and press ok) then copy and paste the contents of the code box into Notepad making REGEDIT4 the top line.
Goto File on the top bar of Notepad and choose Save As, on the Save As Type area change it to all files then name it fix.reg and save it to your desktop, double click fix.reg (or right click and choose Merge) and allow it to be merged into the registry which will remove the entries.
Finally set Windows to hide system and hidden files as explained above by pressing the restore defaults button
Then reboot and post a new HijackThis log and Simon V will continue where he left off
Thanks Simon
Andy
EDIT: Also delete the C:\SDFix folder as it contains backups of the worm files which are not needed now,
Hi Artemesia
Run Hijack This and choose Do A System Scan then place a check next to these entries
F3 - REG:win.ini: load=C:\WINDOWS\system32\vdbezmzs\winlogon.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\vdbezmzs\winlogon.exe
Close all open browser and other windows except for Hijack This and press the Fix Checked button
Can you set Windows to show hidden files and folders to remove the following shortcut as HijackThis usually has problems fixing it
Click Start. Goto MyComputer then C:\drive
Select the Tools menu from the top bar and click Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
UnCheck the "Hide protected operating system files (recommended)" option.
Click Yes to confirm then OK
Set this back once you have checked for the file by opening the same page and pressing the Restore Defaults button then click Apply and OK.
Goto Start > Run > and copy and paste
%userprofile%\Start Menu\Programs\Startup\
Press OK and it will open the startup folder, check for a file named winlogon in this folder and if its found right click it and choose Delete.
Goto Start > Run > and type
cmd
Press OK and the command prompt will open, copy and paste this onto the cmd screen
rd /q %systemroot%\system32\vdbezmzs
Press OK and it will remove the empty worm folder, type exit and press ok to then close the command prompt
Next open notepad (Start Menu > Run > type notepad and press ok) then copy and paste the contents of the code box into Notepad making REGEDIT4 the top line.
REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "winlogon"=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "winlogon"=-
Goto File on the top bar of Notepad and choose Save As, on the Save As Type area change it to all files then name it fix.reg and save it to your desktop, double click fix.reg (or right click and choose Merge) and allow it to be merged into the registry which will remove the entries.
Finally set Windows to hide system and hidden files as explained above by pressing the restore defaults button
Then reboot and post a new HijackThis log and Simon V will continue where he left off
Thanks Simon
Andy
EDIT: Also delete the C:\SDFix folder as it contains backups of the worm files which are not needed now,
