View Single Post
Old 08-12-2007, 04:29 PM   #6 (permalink)
sUBs
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 24,353
OS: N/A


Re: Pop-ups and recurring infections - can't clean.

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (
"C:\Documents and Settings\HP_Owner\Local Settings\Temp\~freesetup.exe"
"C:\Documents and Settings\HP_Owner\Shared\(Better Version) megatech 54.wma"
"C:\Documents and Settings\HP_Owner\Shared\(naked) megatech 21.wma"
"C:\Documents and Settings\HP_Owner\Shared\by Fry - megatech 40.wma"
"C:\Documents and Settings\HP_Owner\Shared\HuMMeR megatech 45.wma"
"C:\Documents and Settings\HP_Owner\Shared\Imogen Heap- Foolish.wma"
"C:\Documents and Settings\HP_Owner\Shared\megatech 08.wma"
'C:\Documents and Settings\HP_Owner\Shared\shared by m0m get the party ktu remix 25.wma"
"C:\Documents and Settings\HP_Owner\Shared\Top of Charts - 2005 (love).wma"
"C:\Documents and Settings\HP_Owner\Shared\your love shines on me 23.wma"
"C:\Documents and Settings\HP_Owner\Shared\[[ your love shines on me 29.wma"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)

for %%g in (
"C:\Documents and Settings\Marc\.housecall6.6\Quarantine"
"C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery"
"%systemdrive%\VundoFix Backups"
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs

(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg

regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says
__________________

Question - what have you done for the community today?
sUBs is offline