IWORM.BADTRANS

[P.]

Sziasztok!
Beledoltem egy e-mail virusba! talan a :images.DOC.SCR: volt a bunos!
Az alabbi ket BAT file leszedi a rendszerrol:

rembadtrans.bat

@echo off
IF NOT EXIST %windir%\system\KERN32.EXE GOTO ERR0

echo. > %windir%\wininit.ini
echo [rename] >> %windir%\wininit.ini
echo NUL=C:\windows\INETD.EXE >> %windir%\wininit.ini
echo NUL=C:\windows\HKK32.EXE >> %windir%\wininit.ini
echo NUL=C:\windows\SYSTEM\KERN32.EXE >> %windir%\wininit.ini
echo NUL=C:\windows\system\CP_23421.nls >> %windir%\wininit.ini
echo NUL=C:\windows\system\hksdll.dll >> %windir%\wininit.ini

echo **********************************************************
echo You must now remove the string C:\WINDOWS\INETD.EXE
echo from the "run=" line in win.ini. You should not remove
echo anything else.
echo **********************************************************
pause

copy %windir%\win.ini %windir%\win.bdt
notepad %windir%\win.ini

echo.
echo **********************************************************
echo Please reboot your system for the disinfection to complete
echo.
echo                        -=oOo=-
echo.
echo It is recommended that you install an antivirus product to
echo                  avoid future infections.
echo **********************************************************
echo	            For further information go to:
echo           http://www.claymania.com/anti-virus.html
echo **********************************************************
pause
goto end

:ERR0
echo *********************************************************
echo You do not appear to be infected with the IWORM.BADTRANS
echo virus. Please Scan your machine with an upto date AV.
echo ********************************************************
pause
goto end

:end
EXIT


-------------------- illetve:
rembadtransB.bat
@echo off

IF NOT EXIST %windir%\system\KERNEL32.EXE GOTO ERR0

echo. > %windir%\wininit.ini
echo [rename] >> %windir%\wininit.ini
echo NUL=C:\windows\SYSTEM\KERNEL32.EXE >> %windir%\wininit.ini
echo NUL=C:\windows\system\CP_25389.nls >> %windir%\wininit.ini
echo NUL=C:\windows\system\kdll.dll >> %windir%\wininit.ini

echo.
echo **********************************************************
echo Please reboot your system for the disinfection to complete
echo.
echo                        -=oOo=-
echo.
echo It is recommended that you install an antivirus product to
echo                  avoid future infections.
echo **********************************************************
echo	            For further information go to:
echo           http://www.claymania.com/anti-virus.html
echo **********************************************************
pause
goto end

:ERR0
echo *********************************************************
echo You do not appear to be infected with the IWORM.BADTRANS
echo virus. Please Scan your machine with an upto date AV.
echo ********************************************************
pause
goto end

:end
EXIT
-------------------------------------- letoltheto a jotanacsokkal! a
http://www.claymania.com/badtrans-b-removal.html
oldalrol.
P.A. <mailto:pandras at mail.elender.hu> ---------------itt a file vege.