25jurdcyw4. sys, promote. dll/adware. win32.agent. NRC, adware. win32.ejok. X, etc.

25jurdcyw4. sys, promote. dll/adware. win32.agent. NRC, mnbgezuvepffc. dll/adware. win32.ejok. X, etc.

EndurerOriginal

2008-01-061Version

A netizen sent an email saying that an error message was prompted during the recent boot of his computer, saying C:/Windows/system32 /****. DLL cannot be loaded. *** it is a number and cannot be remembered. According to a friend, I found an article on my blog to solve similar problems.

Trojan. win32.mnless. ZPC/ojj6erv. sys that bypasses the icesword file Detection
Http://blog.csdn.net/purpleendurer/archive/2007/11/27/1904076.aspx
Http://endurer.bokee.com/6546536.html
Http://blog.nnsky.com/blog_view_234611.html
Http://blog.sina.com.cn/s/blog_49926d9101000ccy.html
Http://blog.i0778.com /? 1314/action_viewspace_itemid_4376.html

So please help with the repair.

Pe_xscan is used to scan log analysis and the following suspicious items are found:
/=
Pe_xscan 07-12-26 by Purple endurer
18:17:54
Windows XP Service Pack 2 (5.1.2600)
Administrator user group

O2-BHO promote class-{0fa24e3e-422c-4d94-a125-127f32352c90 }-C:/Windows/system32/promote. dll

O2-BHO-{242f800b-2172-4409-a381-476b66e3de2a }-C:/Windows/system32/mnbgezuvepffc. dll

O23-service: 25jurdcyw4 (25jurdcyw4 )-System32/Drivers/25jurdcyw4. sys(Guide)

O23-service: BB-RUN ()-System32, drivers, bb-run.sys(Guide)

O23-service: def2be (def2be )-C:/Windows/system32/Drivers/def2be. sys(Automatic)

O23-service: dontgo ()-System32/Drivers/dontgo. sys(Guide)
===/

Check with WinRAR and find only the first three files. The rest is estimated to have been killed by Kabbah in the computer:

C:/Windows/system32/promote. dll
C:/Windows/system32/mnbgezuvepffc. dll
C:/Windows/system32/Drivers/25jurdcyw4. sys

With WinRAR packaging backup, The result 25jurdcyw4. sys can not be packaged, to download the icesword http://endurer.ys168.com, copy a package, and then force Delete 25jurdcyw4. sys.

Download hijackthis from the http://endurer.ys168.com to fix O2 items.

Go to http://tool.ikaka.com to download rising Kaka Security Assistant, in [advanced features]-> [system enable item management], click [Driver] on the left, find the project corresponding to o23 on the right, right-click and choose delete from the pop-up menu.

Restart your computer. The prompt box is no longer displayed ......

This 25jurdcyw4. sys does not hide its own file. It is easier to process the kernel than oj6erv. sys ......

File Description: C:/Windows/system32/promote. dll
Attribute: ---
Language: English (USA)
File version: 1, 0, 0, 1
Description: promotedemo Module
Copyright: Copyright 2006
Note:
Product Version: 1, 0, 0, 1
Product Name: promotedemo Module
Company Name:
Legal trademark:
Internal name: promotedemo
Source File Name: promotedemo. dll
Creation Time: 14:29:51
Modification time: 14:29:51
Access time: 14:29:51
Size: 28672 bytes, 28.0 KB
MD5: 9b49898abca8a77ad349b8ebd6823f55
Sha1: da6e5b96aef77371b391a334a2e06b76658cfb02
CRC32: fbdc8747

RisingAdware. win32.agent. NRC

File Description: C:/Windows/system32/mnbgezuvepffc. dll
Attribute: ---
Language: Chinese (China)
File version: 1.0.0.0
Note:
Copyright:
Note:
Product Version: 1.0.0.0
Product Name:
Company Name:
Legal trademark:
Internal Name:
Source File Name:
Creation Time: 14:27:26
Modification time: 14:27:26
Access time: 14:27:26
Size: 1108480 bytes 1.58 MB
MD5: 7a7f6cced6f1bcc16cffbc725b0a922d
Sha1: a5f89e6788405f69907d314b89fcd2bcbc4f27cf
CRC32: 4550f29c

RisingAdware. win32.ejok. x

File Description: D:/test/25jurdcyw4. sys
Attribute: ---
An error occurred while obtaining the file version information!
Created at: 22:24:58
Modification time: 18:39:30
Access time:
Size: 22560 bytes, 22.32 KB
MD5: 5a3678283126d82a41a315fe0be884fe
Sha1: 01b1b85e58de4e04d17e07968beea989ef87e35e
CRC32: 58934d0b