View Single Post
Old 10-08-2007, 10:53 AM   #8 (permalink)
tetonbob
Manager, Security Center, TSF Academy; Analyst, Security Team
 
tetonbob's Avatar
 
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,228
OS: 2000 Pro; XP Pro; XP Home


Re: popups; Trj/Downloader.OZB, Generic Malware, Trj/Downloader.PCQ

Please use Symantec's guide to remove the Norton Quarantine files.


Next...

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

Quote:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

C:\WINDOWS\tsitra572.exe.tmp
"C:\Documents and Settings\Owner\Application Data\Microsoft\Windows\rayiou.exe"
"C:\Documents and Settings\Owner\Desktop\[4]-Submit_2007-10-07@18.16.zip"

) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)

for %%g in (

%systemdrive%\Deckard
%systemdrive%\Qoobox

) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs

(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg

regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says

Then, I'll be glad to help you uninstall Norton, and install a new Free Anti-Virus.
__________________
Practice Safe Surfing
Because what you don't know, CAN hurt you.
Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

Microsoft MVP - Consumer Security 2009
tetonbob is offline