@echo off
copy C:\WINDOWS\ServicePackFiles\i386\eventlog.dll c:\eventlog.dll
Exit

@echo off
copy C:\WINDOWS\system32\dllcache\scecli.dll c:\scecli.dll
Exit

3.] Double-click on Fix-XP.bat and let it repair your Eventlog Services.

4.] At this point, you’ll need to download: “The Avenger” by Swandog46 to your Desktop.
—————————
- Right click on the Zip folder and select “Extract All…”
- Follow the prompts and extract Avenger to your desktop

http://swandog46.geekstogo.com/avenger2

5.] Copy these codes and paste these into Avenger – Script Box. However, if you’re using the second script, which is shown in “Step 2”, then, you’ll need to copy the second one. But, please don’t use both, or else, there will be some confusion on your system.
—————————

Begin copying here:
Files to move:
c:\eventlog.dll | C:\WINDOWS\system32\eventlog.dll

Begin copying here:
Files to move:
c:\scecli.dll | C:\WINDOWS\system32\scecli.dll

—————————

6.] Click on Execute

7.] Answer “Yes” twice when prompted.

Notes: just to let you know: The system will restart twice. But, you don’t have to panic… its normal…

8.] Download ComboFix from these website and rename the application before you download!
—————————
If you are using Firefox, make sure that your download settings are as follows:

* Tools >> Options >> Main tab
* Set to “Always ask me where to Save the files”.

http://www.forospyware.com/sUBs/ComboFix.exe

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

http://www.combofix.org/download.php

Important: You’ll need to rename ComboFix into Combo-Fix.
Also, It is important that you rename Combofix during the download, but not after.

Warning: Before you continue, please disable your anti-virus, script blocker and any anti-malware (real-time) protection before the scan. These security application may interfere with ComboFix or remove some of its embedded files which may cause “irregular results”. Also, please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

9.] Double click on combo-Fix.exe & follow the prompts.

10.] When everything is done, Combofix will generate a Text file that contains your removal.

11.] Now, you’ll need to copy these scripts and save it to your desktop.

File Saved As: CFScript.txt
—————————

Collect::
c:\windows\svchasts.exe
c:\windows\system32\desote.exe
c:\windows\ucyzy.dat
c:\program files\Common Files\wapibosogi.lib
c:\AutoRun.vbs
c:\windows\Fonts\AcadEref.ttf
c:\windows\Installer\c62d6.msp
c:\windows\system32\drivers\rotscxltmrssww.sys
c:\windows\system32\drivers \_rotscxltmrssww_.sys.zip
c:\windows\system32\rotscxobwwavmy.dll
c:\windows\system32\rotscxoqfqjruf.dat
c:\windows\system32\rotscxqoeniplv.dat
c:\windows\system32\rotscxylltpkql.dll
c:\windows\system32\twain.dll
c:\windows\braviax.exe
c:\windows\cru629.dat
c:\windows\Installer\550c37.msi
c:\windows\oqixovevu.scr
c:\windows\orabuj.inf
c:\windows\ppp3.dat
c:\windows\ppp4.dat
c:\documents and settings\All Users\Documents\cejik.sys
c:\documents and settings\All Users\Documents\koqely.reg
c:\documents and settings\All Users\Documents\oqijatuzu.exe
c:\documents and settings\All Users\Documents\qyxazemose.exe
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\minix32.exe
c:\windows\system32\sdra64.exe
c:\windows\system32\sonhelp.htm
c:\windows\system32\sysnet.dat
c:\windows\system32\tapi.nfo
c:\windows\system32\userini.exe

Folder::
c:\program files\Windows Police Pro

DirLook::
c:\program files\awesome
C:\b624c1897f972641605426d99d3538

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Viewpoint\\Common\\ViewpointService.exe"=-
"c:\\Program Files\\uTorrent\\uTorrent.exe"=-

RegNull::
[HKEY_USERS\S-1-5-21-2186207459-4142083742-1883771569-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{AF49AC62-35CC-90AD-1EC3-2AE9C244CBB5}*]

12.] Drag CFScript.txt into Combo-Fix.exe

Notes: When Combofix finishes running, there will be a log that pops – up. Please don’t be alarmed! It’s normal for ComboFix…

13.] Download OTL from these website…
—————————

http://oldtimer.geekstogo.com/OTL.exe

—————————

14.] Run the program and paste these codes into the “Custom Scans/Fixes” box.
—————————

:OTL
SRV - (RDPRGOSK [Disabled | Stopped]) -- File not found
[2009/08/28 17:01:10 | 00,017,976 | ---- | M] () -- C:\WINDOWS\ugyl.db
[2009/08/28 17:01:10 | 00,014,776 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\okebihyk.db
[2009/08/28 17:01:10 | 00,013,269 | ---- | M] () -- C:\Documents and Settings\tim\Application Data\epujap.db
[2009/08/28 17:01:10 | 00,012,616 | ---- | M] () -- C:\Documents and Settings\tim\Local Settings\Application Data\ybopot.lib

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[Reboot]

—————————

15.] Click the Run Fix button which is located at the top – left – corner.

Notes: let the program run; reboot the PC when it is done.

16.] Download Malwarebytes from these links and follow the prompts.
—————————

http://www.malwarebytes.org/mbam-download.php

http://www.softpedia.com/get/Antivirus/Malwarebytes-Anti-Malware.shtml

Notes: please do a deep scan and make sure that your database is up-to-date!
Also, If it asked you to restart the computer, please do so immediately.

17.] Last and not least, please copy these codes and save it as: CFScript.txt
—————————

KillAll::

File::
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FGQ0JB3M\111_[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\PH0SB3VN\lexus111[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\QIS2LMNX\file[1].exe

Reboot::

—————————

18.] Drag the scripts into Combo-Fix.exe

19.] Now, you’ll need to cleanup your computer. But, don’t worry, you’re nearly there!

- Click Start >> Run >> Type: Combofix /u
- Click OK

20.] Go back and look for OLT. Then, double-click on OTL.exe and run it.

21.] Click on the CleanUp! Button.

Notes: you will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

22.] Finish!

Good Work! You have done a great job!!

Copyrighted By Lair360

http://avira.com

http://softpedia.com

————————–

2.] Execute the application and scan your computer.
But, if you want to do it faster, you can go to these directories.

Right click on these folders and scan it with Avira.
————————–
C:\Windows\
C:\Windows\System32
C:\Windows\System32\System32.exe
C:\windows\system32\dllcache\win32\winlogon.exe
C:\windows\system32\dllcache\win32\csrss.exe

Notes: let the software kill all of the process. But, don’t hit the ignore button!
Also, please don’t forget to hit the delete button when the scan – engine has found the infected file!

3.] Erase all of these folders in your USB stick with Avira.
However, if you leave it alone, it’s going to regenerate the virus – that would mean: you’ll need to repeat step five!

Part Two: modify windows Shell and Userinit.exe registry
———————————

Warning: once you reboot without userinit.exe and system32.exe, windows cannot access windows successes – fully!
So, please don’t stop and wonder off at stage three…

Notes: to locate these files, please follow these instructions.
————————–
a.] In “Folder Option,” just hit the “View” tab and un – tick or select these options.

Hidden files and folders >> select: Show hidden files and folders.
Hidden files and folders >> un – tick: Hide protected operating system files (Recommended).

Items to be removed from USB memory sticks.
————————–
Autorun.inf
Secret.exe
Phimnguoilon.exe / Phim nguoi lon.exe
————————–

4.] Fix the registry location within these directories…

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

a.] Click on Userinit (REG_SZ)
b.] Right click and select “Modify…”
c.] Change the directories.

Important: Please include the trailing comma. But, please be aware that ‘Windows’ was installed in C:\Windows; Userinit.exe file is actually present in the System32 folder. You may want to verify that as well.

Wrong: C:\Windows\userinit.exe
Right: C:\Windows\System32\userinit.exe,

Important: You must make sure that the registry location and directory is correct before the initial reboot. But, if you left it UN – changed; the windows logon and access is completely disabled. So, please double check before you hit the “Restart” button!!

Advice: For better performances, you can also put ‘Userinit.exe’ into this registry location. It will boot faster after reboot.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Winlogon

a.] Go to Start >> Run and insert: regedit.
b.] Direct yourself to the correspondent registry location.
c.] At the left panel, just look for ‘Winlogon’ and move your mouse to the right panel.
d.] Right click and Select New >> String Value
e.] Rename it as ‘Userinit’ – without the quotes.
f.] Right click on your new registry – strings and select: Modify
g.] Copy the ‘value data’ which is shown underneath…
————————–
C:\Windows\System32\userinit.exe,
————————–

Important: Please include the trailing comma. But, please be aware that ‘Windows’ was installed in C:\Windows; Userinit.exe file is actually present in the System32 folder. You may want to verify that as well.

h.] Paste the data; click ‘OK’ and exit the registry.

After reboot, use iobit windows care personal and CCleaner to repair, clean and remove all the junk files.

5.] Reboot and run Avira again.

Warning: please check your registry entries (again) for any changes and repeat step four to step five. But, you don’t have to run the anti-virus again.

Part Three: double check your folders for “system32.exe and csrss.exe”
———————————
Problems: For most users, they also got one of their ‘Shell’ registry infected with a file called: System32.exe. To solve this problem, please continue and clear this hidden virus.

1.] Since Avira removed this file: System32.exe = “C:\Windows\System32\system32.exe,” you have to go to the registry and fix the location. But, don’t you even dare delete the registry entries!!

a.] Click Start >> Run >> Type: regedit >> Click OK or press Enter.
b.] Navigate through the registry folders and look for this registry location…

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\

Notes: look for a file called: “Shell” [without the quotes].

2.] Right click on the value; select modify; delete the entire line from “Shell” and copy this to your registry: explorer.exe

3.] After this process, please reboot your computer ‘again’ and let the new setting take effect!

4.] Your computer is ready to go!

Background history of “csrss.exe”

Introductions: firstly, the ‘csrss.exe’ file, it should be in: “C:\Windows\System32\” or “C:\Windows\system32\dllcache.” However, it shouldn’t be in the ‘config’ directory and this directory: “C:\windows\system32\dllcache\win32\csrss.exe” or anywhere else…

Notes: Please change the directories on these registry locations to the correct links….

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit = ‘C:\Windows\System32\userinit.exe,’ (REG_SZ)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell= “explorer.exe” (REG_SZ)

Notes: If these directories are missing, please re-create them.

These are the registry to delete…

1.] Go to this directory: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\…

2.] Look under “Image File Execution Options” folders and locate this sub-folder: “explorer.exe” [without the quotes]

Notes: It creates sub-key “explorer.exe” and the value under it:
Debugger=c:\windows\csrss.exe

3.] Delete it!

Optional – Part four: use ComboFix.exe to fix / remove other viruses
———————————
1.] Download ComboFix from these links…
———————————
ComboFix: http://www.combofix.org/
Mirror: http://subs.geekstogo.com/ComboFix.exe
———————————

2.] Make a folder in your C:\ drive.
3.] Drag your ComboFix.exe into that folder.
4.] Disable all anti-virus application, anti-spyware application and all software that has HIPS function.

Notes: if you want to safely disable their system guard for ComboFix.exe to clean your computer, I would recommend you to disable it in: “Computer Management” consol.

Click Start >> Right click: My Computer >> Select: Manage >> Services and Applications >> Services

5.] Double check your security guards to see if it’s disabled. After that, just execute ComboFix.

Notes: ComboFix will warn you if you haven’t disable the security guards. But, click Ok if you already disabled the Shield…

6.] The scanner will trigger another box which contains a list of infected files.

7.] After the scan, it will ask you to reboot your computer. All you need to do is click the “Ok” button or hit the “Enter” key (on your keyboard).

8.] After reboot, just don’t touch anything and let it remove these parasite!
The files which will be remove are shown in combofix.

9.] When everything is cleared and dusted, you’ll need to wait for a while.
This is because; the application is generating a ‘Log.txt’ file about ComboFix removal process.

20.] Install CCleaner and clear your Internet Explorer + Firefox temporary files and internet system cache.

Part five: remove ComboFix.exe from your computer
———————————
1.] Click Start >> Run >> Type: Combofix /u
2.] Click Ok or press “Enter” on your keyboard
3.] Disable your System Restore and re-enable it…
4.] Re-activate your ‘System Shield’ and reboot your computer.
5.] Finish!

Copyrighted by Lair360

http://www.forospyware.com/sUBs/ComboFix.exe

Warning: It’s highly recommended that you must disable all anti-virus before you use ComboFix.

Notes: if you want to use ComboFix.exe, you must install Microsoft Recovery Console with your Windows XP CD. However, you must be connected to the internet to download the latest Recovery Console Updates.

2.] Click on this link and download: Process Explorer – http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Notes: if the link is broken, please remove “bb896653.aspx” and find “Process Explorer”

3.] Execute the program and look for this hidden process: sdra64.exe

Notes: this process hides itself under “Winlogon”.

4.] Press CTRL+F on your keyboard and type: sdra64.exe.

5.] Double click on the search results, it should be listed as winlogon. However, don’t end the actual process! You need to highlight “sdra64.exe” on the second box and end the infected process.

6.] On the toolbar select Handle >> Close Handle. After that, you could delete the file.

7.] Click Start >> Run >> Type: Regedit

8.] Expand each folder and look for this registry location…

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

9.] Look for this registry key and modify with caution.

Userinit = C:\WINDOWS\SYSTEM32\\Userinit.exe,C:\WINDOWS\system32\sdra64.exe,

- You need to delete the second part and accept the changes.

Userinit = C:\WINDOWS\SYSTEM32\\Userinit.exe,

10.] Close the registry and rename sdra64.exe to sdra64.vir. After that, you need to use “Notepad” and make a TXT file for Combo-Fix.exe (renamed version to avoid shutdown).

———— Copy Text —————

FileLook::
c:\Program Files\mb.exe

Collect::
c:\windows \system32\lowsec\local.ds
c:\windows \system32\lowsec\user.ds
c:\windows\uyuxexiv.dll
c:\windows\Kqigisucejalafo.dll
c:\windows\system32\sdra64.exe

Folder::
c:\windows\system32\lowsec

———— End —————

11.] Save this as: “CFScript.txt”.

12.] Drag the text file to Combo-Fix.exe and let it remove the infected files.

Notes: your desktop may go blank. This is normal and it will return, when ComboFix is done. But, make sure that you are connected to the internet and click OK.
After that, just follow the prompts for any updates.

Warning: do not mouse-click combofix’s window whilst it’s running.
That may cause it to stall.

13.] Let the application remove the threats.
All you need to do is make a cup of tea or coffee and keep an eye on your computer.

14.] Check your ComboFix log files and take a look at the removal area.
Make sure that the following infection is deleted.

c:\windows\Kqigisucejalafo.dll
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\sdra64.exe
c:\windows\uyuxexiv.dll

15.] Go back into the registry – library and check “userinit” for any unwanted modification.

Normal: Userinit = C:\WINDOWS\SYSTEM32\\Userinit.exe,
Infected: Userinit = C:\WINDOWS\SYSTEM32\\Userinit.exe,C:\WINDOWS\system32\sdra64.exe,

16.] Download CCleaner and delete all your Computer’s temporary files and internet files.

17.] Reboot your computer and re-enable all of your security settings.

Recommended procedure: I would suggest you to download “MalwareBytes” and do a full system scan. It’s important to keep a backup of another anti-virus. You cannot trust just one… you need 2 just to keep things low!

http://www.malwarebytes.org/

Notes: to remove ‘ComboFix’ from your computer, please use this command from the Run Box.

Type: combofix /u

18.] Finish!

Copyrighted by Lair360 – 2009

File::
c:\Documents and Settings\All Users\Desktop\BlockWatcher.lnk
c:\Program Files\BlockWatcher Software\BlockWatcher\BlockWatcher.exe
c:\WINDOWS\10068tro9zd85.exe
c:\WINDOWS\10258z9amb5t73a.bin
c:\WINDOWS\10518virzs5f9.ocx
c:\WINDOWS\temp\yxh5.tmp.exe
c:\WINDOWS\system32\yxh5.tmp.exe
c:\WINDOWS\system32\19z89s5y663.dll
c:\WINDOWS\system32\1a605tzal32359.dll
c:\WINDOWS\system32\1aa8tzi952064.cpl 

Folder::
c:\Program Files\BlockWatcher Software
c:\Program Files\BlockWatcher Software\BlockWatcher
c:\Documents and Settings\All Users\Start Menu\Programs\BlockWatcher

Registry::
[HKEY_CURRENT_USER\Software\BlockWatcher]
[HKEY_LOCAL_MACHINE\SOFTWARE\BlockWatcher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BlockWatcher"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BlockWatcher"=-
"yxh5.tmp.exe"=-

3.] Let the application repair / disinfect your computer. Also, when it’s running, please avoid touching your keyboard or the switch button.

4.] At this stage, you’ll need to use MalwareBytes and perform a full system scan.
After that, you’ll need to download CCleaner and remove all of the junk files.

Link: http://ccleaner.com

5.] You’re Done!

Copyrighted By Lair360

http://www.bitdefender.com/site/Downloads/downloadFile/1584/FreeRemovalTool

http://www.softpedia.com/get/Antivirus/Anti-Downadup.shtml

ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip
———————————

2.] After downloading, just extract the contents to a folder.

3.] Disconnect from the network and unplug your network cable.
If you have wireless connections, please disable your connections and ‘power off’ your router.

4.] Disable “Windows System Restore” to clean all your infected restore points.

Click Start >> Control Panel >> System >> System Restore

5.] Execute the application and choose the best scanning option.

If it asked you to reboot your system, please deny it (don’t click ok) and continue…

6.] After the removal, please go to your registry and check this directory.
This is a safety precaution for all users!
———————————
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

- Make sure that you have this: Userinit [REG_SZ] = C:\Windows\System32\userinit.exe,
———————————
If not, please change it and replace the infected strings with the above or the information which is given below.

Value Name: Userinit
Value Type: REG_SZ
Value Data: C:\Windows\System32\userinit.exe,

7.] Reboot your computer when it completes disinfection.

8.] Plug in your network cable and check your firewall before connecting.

9.] Now, we will need to enable: “Windows System Restore,” and create a restore point.
——————————–
- To enable Windows System Restore, right-click on My Computer >> select Properties >> click on System Restore tab >> Uncheck the option: “Turn off system restore on all drives” >> in the warning box, just select: Yes >> Click: Apply >> OK.

Notes: Once “System Restore” is enabled, it will create a ‘restore point’ for you…

10.] Download CCleaner and delete all your Internet Temporary files and system caches.

11.] Done and dusted!

Optional: if you haven’t got “Microsoft Security Bulletin MS08-067″ service update, please use this link; download the patch; install the patch and reboot your system.

Link: http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx