Member Avatar for ezrael

hi, I have got a big problem, all my exe files are corrupted by virus I scanned my pc with kaspersky antivirus and detected as Virus.agent.cb and the virus is removed but my files are not recovered. All MS office pakage documents are changed to Unreadable characters as shown below. Any one who has solution pls show me the way.

dulla^@204~__b_l_e_ _N_o_r_m_a_l______ö___4Ö___
_~dulla^@204~______
___(_k_ôÿÁ_(___________ _N_o_ _~dulla^@204~__________ù___________ÿÿÿÿ____________~dulla^@204~____*___J___K___L___m______”___•___Ø_~dulla^@204~__Ç___È___Ö___×___Ø___Ù___ç___÷___ø___~dulla^@204_______€___€__________˜___~dulla^@204~_€__________˜____0_______€___€______~dulla^@204~_____€___€__________˜____0_______€___€~dulla^@204~___0_______€___€______________ù ______~dulla^@204~____________ù __ ___ÿÿ______hM______Œ_~dulla^@204~__ï_ˆ___ˆ___û_______________“___“___û_~dulla^@204~__8_______*€urn:schemas-microsoft-com:~dulla^@204~_ags_€City_€9_______*€urn:schemas-micr~dulla^@204~_ice:smarttags_€place_€

  • 5 Contributors
  • 6 Replies
  • 547 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by jbennet

Recommended Answers

All 6 Replies

Member Avatar for cohen

Welcome to Daniweb.

Pls do the following:

1. - Download Malwarebytes' Anti-Malware (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

2. - run hijackthis and post the log

In your reply, post the following (in this order):
1. - Malware Bytes Log
2. - Hijackthis log

then we can continue :)

Cohen

Member Avatar for ezrael

thanks cohen for your support, i have done what u suggest me, but my documents are not recoverd. As u order me I attached the log files.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:33:12 AM, on 11/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\LckFldService.exe
C:\WINDOWS\system32\srvany.exe
C:\pvsw\bin\w3dbsmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Concepts Data Systems\Power Ge'ez 2005\pg2005.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\EZA\Application Data\U3\1101420C7A42EF67\LaunchPad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\EZA\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: MSN smart tags - {9DD4258A-7138-49C4-8D34-587879A5C7A4} - C:\PROGRA~1\MSN\smarttag\MSNBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Power Ge'ez 2005.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{FAF259AF-376F-442F-A266-1D5D959A2D03}: NameServer = 192.55.64.36 192.55.64.38
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: Pervasive.SQL Workgroup Engine - Unknown owner - C:\WINDOWS\system32\srvany.exe

--
End of file - 4332 bytes
Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 2

11/20/2008 8:13:00 AM
mbam-log-2008-11-20 (08-13-00).txt

Scan type: Quick Scan
Objects scanned: 6
Time elapsed: 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Member Avatar for nsindian

have you tried a system restore?

Member Avatar for cohen

thanks cohen for your support, i have done what u suggest me, but my documents are not recoverd. As u order me I attached the log files.

OK, well nothing seems to going on with the hijackthis.... so i'm a bit stumped......

Might have to wait for one of the higher guys to come along... sorry

have you tried a system restore?

All a system restore does, it restores the system, it does nothing to the files or the anything....

and i'm not sure if it would get rid of the virus..... :?:

Cohen

Member Avatar for habesha_guy

I'm new gay, So Plz help me out about it!! i lost my file or my all most life. the only thing i have is your help, my boos want to out in my new job, so help me plZ!!!!!!!!

Member Avatar for jbennet

I'm new gay

?

plZ!!!!!!!!

no text speak

Please start your own thread instead of hikacking someone elses

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.