WScript problem (//e:VBScript dekstop.ini "Microsoft")

system · 2014-02-15T07:44:49.000Z

Please help me. I’m annoyed with this problem for a very long time. and now its now creating shortcuts in my desktop. i was following this thread http://forum.avast.com/index.php?topic=53253.0 but it seems not working for me. can you help me too please?

Asyn · 2014-02-15T07:49:20.000Z

Please attach your logs. (MBAM, OTL and aswMBR…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0

system · 2014-02-15T08:09:01.000Z

Hello Good day! i attached my logs

system · 2014-02-15T09:24:36.000Z

Hi,

Please download Anti-VBSVBEx64.exe on your Desktop

[*]Double click to run the tool and wait until it finishes.
[*]It will make a log named Anti-VBSVBE.txt. Please attach it to your reply.

.

Please download MCShield from one of the following links:

MCShield -Official download link

[*]Double click on MCShield-Setup to install the application.
Next => I Agree => Next => Install … per installation click on Run! button.
[]Wait a few seconds to MCShield finish initial HDD scan…
[]Connect all your USB storage devices to the computer one at a time. Scanning will be done automatically.
[*]When all scanning is done, you need to post a logreport that MCShield has created.

Under Logs tab (in Control Center) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Post here AllScanst.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

Next →

Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

system · 2014-02-15T22:46:34.000Z

Thank you for monitoring and helping me. this is my logs for today. thank you.

Asyn · 2014-02-15T22:51:56.000Z

polgas0625 post:5:

Thank you for monitoring and helping me. this is my logs for today. thank you.

Can’t see the requested logs…!??

system · 2014-02-15T23:05:44.000Z

i modified my post sir. sorry.

Asyn · 2014-02-15T23:14:31.000Z

polgas0625 post:7:

i modified my post sir. sorry.

No problem. Now, please be patient.

system · 2014-02-16T10:14:48.000Z

Do not use USB devices while cleaning is in progress.

Sorry my mistake in choosing tools, you have a x86 OS

Please download Anti-VBSVBEx86.exe on your Desktop

[*]Double click to run the tool and wait until it finishes.
[*]It will make a log named Anti-VBSVBE.txt. Please attach it to your reply.

.

Scan with Combofix:

[*] Please download ComboFix by sUBs and save it to your Desktop.
You may read how Combofix works here.

[*] Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

[*] Run ComboFix. Click on I Agree! & follow the prompts.
Note: If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart your computer.

[*] When finished, it will produce a report for you. Please attach log reports (ComboFix.txt) back to topic.
(typical log location: C:\ComboFix.txt )

system · 2014-02-17T02:30:35.000Z

Hello! this is my log today! thanks!

system · 2014-02-17T09:28:43.000Z

Open notepad and copy/paste the text present inside the code box below:



File::
c:\windows\system32\rad701A9.tmp
c:\windows\system32\rad84576.tmp
c:\windows\system32\radE79C5.tmp
c:\windows\system32\rad2CC86.tmp
C:\autorun.inf.vir
c:\windows\system32\rad3BD60.tmp
C:\music.lnk.vir
c:\windows\system32\rad5C518.tmp
c:\windows\system32\rad833B2.tmp
c:\windows\system32\rad0F635.tmp
c:\windows\system32\rad30F6B.tmp
c:\windows\system32\rad97F9F.tmp
c:\windows\system32\radD778B.tmp
c:\windows\system32\rad7A524.tmp
c:\windows\system32\rad6623C.tmp
c:\windows\system32\rad215F1.tmp
c:\windows\system32\rad740FF.tmp
c:\windows\system32\rad3CFCD.tmp
c:\windows\system32\radE41C2.tmp
c:\windows\system32\rad81E00.tmp
c:\windows\system32\rad4E341.tmp
c:\windows\system32\radBD4EF.tmp
c:\windows\system32\rad37977.tmp
c:\windows\system32\radF76CA.tmp
c:\windows\system32\rad580E8.tmp
c:\windows\system32\rad25D2F.tmp
c:\windows\system32\rad9C55A.tmp
c:\windows\system32\rad54ADE.tmp
c:\windows\system32\radD820C.tmp
c:\windows\system32\radBF385.tmp
c:\windows\system32\radEC92E.tmp
c:\windows\system32\rad7BC47.tmp
c:\windows\system32\rad40358.tmp
c:\windows\system32\radF79C2.tmp
c:\windows\system32\rad6CAFF.tmp
c:\windows\system32\radC3425.tmp
c:\windows\system32\radE626B.tmp
c:\windows\system32\rad4642C.tmp
c:\windows\system32\rad1B1C6.tmp
c:\windows\system32\radDA694.tmp
c:\windows\system32\radCC6C5.tmp
c:\windows\system32\radA3D81.tmp
c:\windows\system32\rad9FD28.tmp
c:\windows\system32\rad7B3BF.tmp
c:\windows\system32\rad02C3A.tmp
c:\windows\system32\rad020B2.tmp
c:\windows\system32\rad1D75C.tmp
c:\windows\Fonts\autorun.inf
c:\windows\system32\DRIVERS\eamonm.sys
c:\users\Poltit\AppData\Local\Temp\esihdrv.sys
c:\windows\system32\drivers\avgtpx86.sys

Folder::
c:\program files\Common Files\AVG Secure Search

FCOPY::
c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe|c:\windows\explorer.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Df5serv"=-

Driver::
eamonm
esihdrv
vToolbarUpdater15.5.0
avgtp

DDS::
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll

Save this as CFScript.txt

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:[b]ComboFix.txt[/b] )

system · 2014-02-17T15:17:27.000Z

I wish i did it right.

system · 2014-02-17T15:36:57.000Z

Ok,

[]Connect all your USB storage devices to the computer one at a time. Scanning will be done automatically.
[]When all scanning is done, you need to post a logreport that MCShield has created.

Under Logs tab (in Control Center) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Post here AllScanst.txt

system · 2014-02-17T20:46:11.000Z

heeereee

system · 2014-02-17T20:54:17.000Z

Tell me, how is your computer running now?

system · 2014-02-17T23:31:23.000Z

The virus is removed sir! thank you very much! thank you!

system · 2014-02-18T09:02:04.000Z

It is necessary to uninstall ComboFix :

[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.

On Windows7 or Vista you may use Start Search field if Run is not available.

[*] In the line of text type in (Copy) the following:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

[*] then click OK (or press Enter ).

Wait for the uninstall process is complete.

****************

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
.

Keep using MCShield, so this doesn’t happen in the future.

system · 2014-02-18T21:28:44.000Z

Thank you very much!

Announcements