View Single Post
Old 12-01-2008, 11:28 PM   #9 (permalink)
sUBs
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 24,324
OS: N/A


Re: IE popups (Virtumonde?) and disabled Windows Update

Quote:
Yes, it did used to load.
Let's restore the entry that ComboFix removed. To prevent future ComboFix runs from removing it again, we'll make a copy of the C:\WINDOWS\system\c6051.cpl to be placed in the C:\Windows\System32 directory.



Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

Code:
@echo off
attrib -h -r -s -a c:\windows\system\c6051.cpl
copy /y c:\windows\system\c6051.cpl  c:\windows\system32\
swreg delete "hklm\software\microsoft\windows nt\currentversion\winlogon\notify\gebxqihe"
regedit /s c:\qoobox\quarantine\registry_backups\hklm-run-c6501sound.reg.dat
swreg query "hklm\software\microsoft\windows\currentversion\run" >log.txt
start log.txt
del %0
Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says
sUBs is offline