NetTool.Win32.PsKill.a Solved

Question

Hello,

After running a complete scan of my computer, it indicates the presence of 2 risky programs:

C:\WINDOWS\system\RESTORE.INS\C:\OEMCUST\TOOLS\WIN32\PSKILL.EXE

C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP397\A0194569.INS\C:\OEMCUST\TOOLS\WIN32\PSKILL.EXE

Is there danger?
How can I remove them safely, as my antivirus does not handle it by itself?

Windows XP SP2
Antivirus = F-Secure (with Orange subscription)

Configuration: Windows XP Internet Explorer 7.0

propreté · Answer

First, go to start, control panel, system, and disable system restore on all drives.

Then we'll see the downloaded llog.
Install this one and scan in normal mode.

https://www.01net.com/telecharger/windows/Securite/antivirus-antitrojan/fiches/12884.html

Follow this tutorial if you find any issues, thanks to Malékal.

http://www.malekal.com/tutorial_TrojanRemover.php
=============================================================

For these programs, install them and scan in safe mode. For CCleaner, do not install the Yahoo toolbar and check all boxes before scanning. You will scan at least 2 times with each software.

For this one, you will install it and scan in safe mode.

https://www.01net.com/telecharger/windows/Securite/anti-spam/fiches/44096.html

-------------------------------------------------------------------------------------------------------
https://www.01net.com/404//fiches/8351.html

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

https://www.01net.com/telecharger/windows/Utilitaire/systeme/fiches/29399.html

For these programs, install them and scan in safe mode. For CCleaner, do not install the Yahoo toolbar and check all boxes before scanning. You will scan at least 2 times with each software.

For safe mode, restart your PC and press F8 (sometimes F5) as soon as it turns on until the menu appears
and choose safe mode.

Download and extract it, place it in C:

Go to this page http://www.pcinpact.com/forum/index.php?showtopic=106555 and search for this link

http://snooky730.free.fr/exploreboard/inde...0by%20FRUiT.rar

Once that's done, go into safe mode. Click on start, run, in run, type "cmd"

A black window opens, copy and paste what is in quotes "cd c:\" then press enter (C being the letter where Windows is installed. If Windows is on (I), replace C with I)

Then type "clean /all /d /i /r /s" then press enter

Wait for it to finish. Normally, your icons won't appear anymore. Press Alt + Gr + Ctrl + Del

Go to file, then execute, and type "explorer" and press enter. Copy this before proceeding.

Safe mode:

Use this method (with the F8 key) only if Windows XP is the only operating system installed on your computer.

1/ -Start Windows, or if it is running, close Windows then turn off the computer.
2/ -Restart the computer. The computer begins processing instructions known as Basic Input/Output System (BIOS). The display depends on the BIOS manufacturer. Some computers show a progress bar referencing BIOS, others may not indicate the ongoing process.
3/ -At the end of the BIOS loading, start pressing the F8 key on your keyboard. Continue until the advanced options menu of Windows appears. If you start pressing F8 too early, some computers may display the message "keyboard error". To resolve this, restart the computer and try again.
4/ -Using the arrow keys on your keyboard, select Safe Mode from the menu, and then press Enter.

Then do an online scan here

https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

and

http://www.bitdefender.fr/scan_fr/scan8/ie.html

If nothing is found, reactivate your system restore and restore a log. The two scans above only work with Internet Explorer.

zoren8 · Answer

Hello Propreté,

Thank you for this quick response, but what you're asking me to do is way beyond my knowledge in the computing world. I'm the kind of person who installs and uses; as soon as it involves getting my hands dirty, I'm lost.
Isn't there something simpler?

propreté · Answer

Okay for you, we'll try to keep it simple, so just disable your system restore

Click on Start, Control Panel, System, disable system restore on all drives.

Online scan with that

Then do an online scan here

https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

and

http://www.bitdefender.fr/scan_fr/scan8/ie.html

If it finds nothing, then reactivate your system restore and provide a log. The two scans above only work with Internet Explorer and you need to accept ActiveX controls

Okay

propreté · Answer

Actually, these are sites to scan your PC remotely, meaning

you click on it and normally you will be asked to accept the ActiveX controls, you accept

it will update and they will scan.

So it will be done directly, lol.

I was like you at first, but you will see it comes naturally and it's very, very simple.

propreté · Answer

Ok, mmm, moi Ramadan après, désolé, je serai là sûrement demain ou dans la soirée, mais suis ce que je t’ai écrit plus haut à la lettre et ça devrait aller.

propreté · Answer

mets un log hijack this maintenant

Commence par poster un rapport HijackThis stp,
>Download HiJackThis: http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis
- Launch the program, then select < do a system scan and save a logfile >
- Save the log on your desktop.
And send your HijackThis log to the forum by copying and pasting it.

propreté · Answer

Do you want to keep the toolbars? Most of them are spyware.  It's up to you.  For me, otherwise it seems to be fine.

propreté · Answer

FIX ALL THIS

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en\msntb.dll

O4 - Global Startup: Quick Launch of Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\en.htm
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3E82BB3F-ABE4-458D-9281-0187286A4E51} (VoxsyncCtrl Class) - http://contacts.orange.fr/wfr_webab/VoxsyncX.cab
O16 - DPF: {5CE72DD0-4695-4D18-A4D3-3367ACD37578} (F-Secure Health Check 1.0) - http://support.f-secure.com/enu/home/onlineservices/fshc/fscax.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {5DDCC37F-7C6B-48B8-9664-97C537920CA0} (aecviz Class) - http://www.maisonfamiliale.com/AECVIZ/npaecviz.cab
O16 - DPF: {7DA181BB-EF8D-4A7E-8C53-7BFC718EF71D} (Upload Class) - http://photos.orange.fr/resources/activex/Ephoto.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
O24 - Desktop Component 0: (no name) - file:///D:/common/win/lang/en/images/resume_02.jpg

NetTool.Win32.PsKill.a

8 réponses

How to get the character µ on the android keyboard.

Texture issues in enshrouded

Access issue to my "contact me" profile

Windows spotlight is not working.

My tv turns off and then on again repeatedly?

Executable from a python file

Pay in 4 installments cdiscount

The alt gr key is not working on my keyboard.

Code 80072efe how to get windows update working again

Video in ".3gp" format