combofix scripts

Combofix - Scrips
zurück zu Combofix

Beispiel:

KILLALL::

File::
C:\WINDOWS\system32\dcads_sidebar_uninstall.exe
C:\WINDOWS\system32\superiorads-uninst.exe
C:\WINDOWS\system32\dcads_sidebar.dll

Folder::
C:\Program Files\Dcads Games Collection
C:\QooBox

Collect::
C:\WINDOWS\system32\EIFLPJ
C:\WINDOWS\system32\FO

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\ notify\mljifca]

[hkey_local_machine\software\microsoft\windows\ currentversion\explorer\ shellexecutehooks]
"{FED51DF2-9644-4C58-9104-90244EDD6EEC}"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"=-
"System"=""

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\ {F64C2181-0062-4ED8-B6B0-72BB47BA711C}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows live Messenger"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00

RenV::
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\hkcmd .exe

Rootkit::
C:\Rootkit.txt

DirLook::
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\shcpobj0elat

Driver::
Winta52

FileLook::
c:\huadio.tmp

Dirlook::
C:\WINDOWS\system32\rMa01yy\
C:\Dokumente und Einstellungen\%Username%\Anwendungsdaten\

((((((((((((((((((((( Look ))))))))))))

---- c:\huadio.tmp ----

Company: Windows ® 2000 DDK provider
File Description: Generic Port I/O
File Version: 5.00.2195.1620
Product Name: Windows ® 2000 DDK driver
Copyright: Copyright © Microsoft Corp. 1981-1999
Original file name: genport.sys

Link: autpackages

Driver:: will do all of the above in one step:
Stop and Disable the service
Delete the NT service
Delete the registry keys involved--including Legacy.