Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

El amvo ve que ningun programa lo detecta ni mawarebytes ni nood al dia ni superspyware

yo para darme cuenta de que lo tengo tengo abilitado todos los archivos ocultos
cuendo no los veo se que tengo el condenado bicho.

ahora

para quitarlo ago esto

On Error Resume Next

Dim geekside,nret,nret1,nret2,nret3,nret4,nret5,nret6, nret7,nret8,nret9,nret10,nret11,nret12,nret13,nret 14,WSHShell,nret15
Dim nret16,nret17,nret18,nret19,nret20,nret21,nret22,n ret23,nret24,nret25,nret26,nret27,nret28,nret29,nr et30,nret31,nret32
Dim nret33,nret34,nret35,nret36,nret37,nret38,nret39,n ret40,nret41,nret42,nret43,nret44,nret45,nret46,nr et47,nret48, nret49, nret50
Dim nret51, nret52,nret53,nret54,nret55,nret56,nret57,nret58, nret59, nret60,nret61,nret62,nret63
Dim nret64,nret65,nret66,nret67,nret68,nret69,nret70,n ret71,nret72,nret73,nret74,nret75,nret76,nret77



Set geekside=WScript.CreateObject("WScript.Shell")
Set WSHShell=Wscript.CreateObject("Wscript.Shell")

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set colDrives = objFSO.Drives

Wscript.Echo "Software provisto por MyGeekSide.com para la eliminación del software malicioso amvo, avpo, n1detect"

For Each objDrive in colDrives
If objDrive.IsReady = True Then
Wscript.Echo "Limpiar unidad: " & objDrive.DriveLetter


nret13=geekside.Run("cmd /C taskkill /f /im amvo.exe",0,TRUE)
nret14=geekside.Run("cmd /C taskkill /f /im avpo.exe",0,TRUE)

nret55=geekside.Run("cmd /C taskkill /f /im semo2x.exe.tmp",0,TRUE)
nret58=geekside.Run("cmd /C taskkill /f /im semo2x.exe",0,TRUE)


nret=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\autorun.inf",0,TRUE)
nret1=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\ntdeiect.com",0,TRUE )
nret2=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\n1detect.com",0,TRUE )
nret3=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\n1deiect.com",0,TRUE )
nret4=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\n?deiect.com",0,TRUE )
nret5=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\nide?ect.com",0,TRUE )
nret6=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\u?de?ect.com",0,TRUE )


nret51=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\80*.com",0,TRUE)
nret52=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\semo*.exe",0,TRUE)


nret64=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\dos*.com",0,TRUE)
nret65=geekside.Run("cmd /C attrib -s -h -r "&objDrive.DriveLetter&":\xfool*.com",0,TRUE)


nret7=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\autorun.inf /f /q /a",0,TRUE)
nret8=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\ntdeiect.com /f /q /a" ,0,TRUE)
nret9=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\n1detect.com /f /q /a",0,TRUE)
nret10=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\n?deiect.com /f /q /a",0,TRUE)
nret11=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\nide?ect.com /f /q /a",0,TRUE)
nret12=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\u?de?ect.com /f /q /a",0,TRUE)


nret53=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\80*.com /f /q /a",0,TRUE)
nret54=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\semo*.exe /f /q /a",0,TRUE)


nret66=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\dos*.com /f /q /a",0,TRUE)
nret67=geekside.Run("cmd /C cd \ & del "&objDrive.DriveLetter&":\xfool*.com /f /q /a",0,TRUE)



nret15=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\amvo.exe",0,TRUE)
nret16=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\avpo.exe",0,TRUE)
nret17=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\amvo0.dll",0,TRUE)
nret18=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\amvo1.dll",0,TRUE)
nret41=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\amvo2.dll",0,TRUE)
nret19=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\avpo0.dll",0,TRUE)
nret20=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\avpo1.dll",0,TRUE)


nret56=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\semo*.exe.tmp",0,TRUE)
nret60=geekside.Run("cmd /C attrib -s -h -r c:\windows\system32\semo*.exe",0,TRUE)


nret23=geekside.Run("cmd /C del /f c:\windows\system32\amvo.exe",0,TRUE)
nret24=geekside.Run("cmd /C del /f c:\windows\system32\avpo.exe",0,TRUE)
nret25=geekside.Run("cmd /C del /f c:\windows\system32\amvo0.dll",0,TRUE)
nret26=geekside.Run("cmd /C del /f c:\windows\system32\amvo1.dll",0,TRUE)
nret42=geekside.Run("cmd /C del /f c:\windows\system32\amvo2.dll",0,TRUE)
nret27=geekside.Run("cmd /C del /f c:\windows\system32\avpo0.dll",0,TRUE)
nret28=geekside.Run("cmd /C del /f c:\windows\system32\avpo1.dll",0,TRUE)


nret57=geekside.Run("cmd /C del /f c:\windows\system32\semo*.exe.tmp",0,TRUE)
nret59=geekside.Run("cmd /C del /f c:\windows\system32\semo*.exe",0,TRUE)


nret31=geekside.Run("cmd /C reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\ /v amva /f",0,TRUE)
nret32=geekside.Run("cmd /C reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\ /v avpo /f",0,TRUE)

nret68=geekside.Run("cmd /C reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run\ /v avpa /f",0,TRUE)


nret33=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 1 /f",0,TRUE)
nret43=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\ /v SuperHidden /t REG_DWORD /d 1 /f",0,TRUE)
nret44=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced\ /v ShowSuperHidden /t REG_DWORD /d 1 /f",0,TRUE)


nret45=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 1 /f",0,TRUE)
nret46=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\Advanced\ /v SuperHidden /t REG_DWORD /d 1 /f",0,TRUE)
nret47=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\Advanced\ /v ShowSuperHidden /t REG_DWORD /d 1 /f",0,TRUE)


nret34=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\NOHIDDE N\ /v CheckedValue /t REG_DWORD /d 2 /f",0,TRUE)
nret35=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\NOHIDDE N\ /v DefaultValue /t REG_DWORD /d 2 /f",0,TRUE)


nret36=geekside.Run("cmd /C reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL \ /v CheckedValue /f",0,TRUE)
nret37=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL \ /v CheckedValue /t REG_DWORD /d 1 /f",0,TRUE)
nret38=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL \ /v DefaultValue /t REG_DWORD /d 2 /f",0,TRUE)


nret39=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\SuperHidden\ /v CheckedValue /t REG_DWORD /d 0 /f",0,TRUE)
nret40=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\SuperHidden\ /v DefaultValue /t REG_DWORD /d 0 /f",0,TRUE)

nret48=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\ /v Type /t REG_SZ /d Group /f",0,TRUE)


nret49=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f",0,TRUE)
nret50=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f",0,TRUE)


End If
Next

nret61=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\Explorer\ /v NoFolderOptions /t REG_DWORD /d 0 /f",0,TRUE)
nret62=geekside.Run("cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\ /v NoFolderOptions /t REG_DWORD /d 0 /f",0,TRUE)
nret63=geekside.Run("cmd /C reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System\ /v DisableRegistryTools /t REG_DWORD /d 0 /f",0,TRUE)


el asunto no es la deteccion ni la eliminacion sino como evitar que este puñado de textos llamado amvo no se cuele al sisteama .....

alguna sugerencia

Hola sithanubis:
Consejos para antes de publicar un nuevo mensaje
Políticas del Foro de InfoSpyware
NO Poner Logs De HijackThis Y/O ComboFIX En Este Sector Del Foro O Seran Eliminados.

Tenes un tema abierto en el cual te estoy brindando ayuda y no respondiste, por lo cual este tema se cierra.