Computer controlled by a hacker. Use of cmd and result is: timer=timer.dv no good. Try delete pid of Kasperki avp.exe but no success what to do?

try doing system restore by tapping F11 if its Vista or F10 if its XP

or If you have only one Admin account in Vista and have forgotten the password for the same and dont want to reinstall the operating system and land up loosing all your data, this tip is for you.
1) Restart the PC with the Vista Boot Disc.
2) Select Repair Your Computer option
3) Select the Command Prompt
Or - If you dont have a Vista Boot Disc then boot your PC to DOS using any Dos boot disk or other O/s disc.
4) goto "C:\"
5) Navigate to C:\Windows\System32 ( cd c:\windows\system32)
6) Now we will rename the utility manager to cmd.
Type the following commands,
- ren cmd.exe cmdold.exe
- ren utilman.exe cmd.exe
exit
7) we have renamed it successfully.
8) Restart the PC without the disc, reach the screen where you are asked for you password.
9) You will see a white blue icon on bottom left.
10) Click on the icon and CMD will open up, type the following command in CMD.
- net user administrator /active
exit
11) Restart the PC, and you will find you have one more administrator account
12) logon with the new account, goto user accounts and remove the password for your old account.
13) restart the PC with the Disc again, and goto the command prompt as we did in the step 1-3.
14) type the following command,
- cd c:\windows\system32
- ren cmd.exe utilman.exe
- ren cmdold.exe cmd.exe
15) restart the PC, and logon to your own account, open CMD by going from start menu.
16) type the following and restart the PC.
- net user administrator /active:no
17) restart the PC and now you only have one account and thats your own account.

You can reset the password of Windows 7 and Windows Vista. These steps are not provided as troubleshooting. I m jus curious to help you out with my experience.

insert the disc and boot to WinRE

Boot to Win RE
Click Command Prompt option.
C:
CD Windows\system32
ren cmd.exe cmd.old
ren magnify.exe cmd.exe
ren cmd.old magnify.exe
Restart computer
Click on Easy of Access centre left side bottom ? Choose Magnify option ? Command prompt opens up
Type: net user administrator /active:yes
Restart the computer
Logon on administrator account and then using User Account page, remove password for the other account
Search for Magnify.exe in start search and click on it
Command prompt opens up
Type: net user administrator /active:no
Restart the computer
Boot to winRE
Type the following:
C:
CD Windows\system32
ren magnify.exe cmd.old
ren cmd.exe magnify.exe
ren cmd.old cmd.exe
exit
Restart the computer – system logs on to the User account without asking for password provided there is only one user account.

start bar/settings/control panel/user accounts/ delete what you want

I found this on the net, i hope this helps you out. It also says that this nasty virus is a tough one...and you still run the risk of ruining your info on the hard drive. Back-up critical info (Docs,Music, Game info etc)
And keep me posted on the results..i hope this helps you out! GOOD LUCK! 8-)


Step 1 : Use Windows File Search Tool to Find Zlob Path

1. Go to Start > Search > All Files or Folders.
2. In the "All or part of the the file name" section, type in "Zlob" file name(s).
3. To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
4. When Windows finishes your search, hover over the "In Folder" of "Zlob", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Zlob in the following manual removal steps.

Step 2 : Use Windows Task Manager to Remove Zlob Processes

1. To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
2. Click on the "Image Name" button to search for "Zlob" process by name.
3. Select the "Zlob" process and click on the "End Process" button to kill it.
4. Remove the "Zlob" processes files:
5. msmsgs.exe nvctrl.exe msmsgs.exe nvctrl.exe
   Read more about How to kill Zlob Processes

Step 3 : Use Registry Editor to Remove Zlob Registry Values

1. To open the Registry Editor, go to Start > Run > type regedit and then press the "OK" button.
2. Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
3. To delete "Zlob" value, right-click on it and select the "Delete" option.
4. Locate and delete "Zlob" registry entries:
5. HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogonShell=explorer.exe HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows NT CurrentVersionWinlogonShell=explorer.exe, msmsgs.exeHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunRegSvr32=%System%msmsgs.exe HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows CurrentVersionRunRegSvr32=%System%msmsgs.exe
   Read more about How to Remove Zlob Registry Entries

Step 4 : Use Windows Command Prompt to Unregister Zlob DLL Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then click the "OK" button.
2. Type "cd" in order to change the current directory, press the "space" button, enter the full path to where you believe the Zlob DLL file is located and press the "Enter" button on your keyboard. If you don't know where Zlob DLL file is located, use the "dir" command to display the directory's contents.
3. To unregister "Zlob" DLL file, type in the exact directory path + "regsvr32 /u" + [DLL_NAME] (for example, :C\Spyware-folder\> regsvr32 /u Zlob.dll) and press the "Enter" button. A message will pop up that says you successfully unregistered the file.
4. Search and unregister "Zlob" DLL files:
5. uimcu.dll antzozc.dll dtjby.dll
   
   

Step 5 : Detect and Delete Other Zlob Files

1. To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
2. Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
3. To change directory, type in "cd name_of_the_folder".
4. Once you have the file you're looking for type in "del name_of_the_file".
5. To delete a file in folder, type in "del name_of_the_file".
6. To delete the entire folder, type in "rmdir /S name_of_the_folder".
7. Select the "Zlob" process and click on the "End Process" button to kill it.
8. Remove the "Zlob" processes files:
9. uimcu.dll antzozc.dll dtjby.dll dumpserv.com zxserv0.com vnp7s.net Protect RSA ncompat.tlb msvol.tlb hp[X].tmp msmsgs.exe nvctrl.exe dumpserv.com zxserv0.com vnp7s.net %UserProfile%\Application Data\Microsoft\Protect %UserProfile%\Application Data\Microsoft\Crypto\RSA ncompat.tlb msvol.tlb hp[X].tmp

[Solution # 1]
Drag and drop it onto regsvr32.exe in Windows\system32 folder. Make a shortcut for regsvr32.exe in the same folder the OCX is in and drag and drop it that way

[Solution # 2] Just run cmd.exe as administrator and try again. This is the key.

Here, step by step:

1. find the folder of cmd: it is usually on C:\windows\system32\cmd.exe
2. Do right click over cmd.exe and click on "run as Administrator"
3. now just use regsvr32.exe as you used to do!

For example, to register most Blackd Proxy ocxs, you might need to type this in "Administrator" cmd:

regsvr32.exe c:\windows\system32\richtx32.ocx
regsvr32.exe c:\windows\system32\comdlg32.ocx
regsvr32.exe c:\windows\system32\mswinsck.ocx
regsvr32.exe c:\windows\system32\msflxgrd.ocx
regsvr32.exe c:\windows\system32\msinet.ocx
regsvr32.exe C:\windows\system32\comctl32.ocx

A side result for Visual Basic 6.0 users: this seems to be the way to use components in Windows Vista properly. Just register the components of your proyect with "Administrator" cmd before adding them to your proyect (or before opening a proyect that already had such components)


[Solution # 3]
use this in command line

REGSVR32 /V then ur ocx or dll name
ex:
REGSVR32 /V CRPAIG32.DLL


[Solution # 4]
right-clicking the batch file and selecting 
'run as administrator'.

Registered:
richtx32.ocx
comdlg32.ocx
mscomctl.ocx
dxtmeta2.dll


Good luck

Follow these steps in order to resolve the issue:
Stop the Print Spooler Service: 1) Click Start. 2) Type ‘cmd’ in the Start Search box.Search results should appear. 3) Right-click on ‘cmd’ in the search results, and select Run as Administrator.The command window will appear.4) Type ‘net stop spooler’ into the command window and press <ENTER>.The Print Spooler service should now be stopped.
Delete the Printer Drivers: .
1) Click Start.
2) In the Start Search box, type ‘C:WindowsSystem32SpoolDriversw32x86’ and press <ENTER>.
3) Delete all the files and folders in this directory.
NOTE: If the folder will not delete, rename folder to w32x86.old.
Remove the Dell printer software:
1) Click Start.
2) Click Control Panel.
3) Click Programs.
4) Click Programs and Features.
5) Click the software related to the attached Dell printer to highlight it.
6) Click Uninstall/Change.
7) Follow through the prompts in order to remove the software.
8) Restart the computer.
At this point, the user should install the latest printer software from http://support.dell.com and be able to print successfully.

It is probably a leftover problem from spyware or a virus.
Open Windows Explorer and go to C:\Windows\System32

Click Folder Options on the Tools menu.
Click the View tab
Select Show hidden files and folders, under Hidden files and folders

Now find cmd.com and delete it
Don't touch command.com, only cmd.com.
Check also for the file ping.com and delete it if it exists.

Warning: Don't delete cmd.exe and ping.exe only the files with .com extension. Be careful, because you are working with system files here.

Good luck
Please post some feedback or if you need more help

its simple guys..!!!
if it asks for permission to access outlook..don't permit it because it is a smart virus and is going to spread it to all the people on your contact list...!!!
simply open task manager and end process tree of KHATRA.exe , gHost.exe , xplorer.exe and OUTLOOK.exe seperately...!!
then run your anti virus or download one if you don't have one..!!!
run a complete computer scan in detail..!!
then delete all files which are infected by the virus because the results contain only duplicate files which are created by the virus

" After receiving many complaints from people’s about this virus, I finally decided to guide the users about the removal of this virus. Some of the problems caused by this virus are :
1. Show Hidden Files and Folders not working.
2. My Computer Drives open another explorer window.
3. When you run a program, just in 2 or 3 minutes the program dissappears (Actually runs in background but you can not see its window in foreground).
Removal of this Virus
Unfortunately, I have no removal tool to remove this virus at the time of writing, but you will soon see one. You can try the manual removal of it.
Manual Removal
Caution : While the manual process is going on, do not open any My Computer drive.
1. Open up cmd by typing cmd in Start –> Run.
2. Type in cmd
taskkill /f /im smss.exe
taskkill /f /im killer.exe
3. The virus placed some files at the root of every drive so you need to clean them.
Repeat the following commands on cmd for all your drives (Here it is applied for C drive)
del /a:h /f c:\autorun.inf
del /a:h /f c:\smss.exe
del /a:h /f c:\funny ust scandal.avi.exe
4. Now you need to delete files in windows folder so type :
del /a:h /f c:\windows\killer.exe
del /a:h /f c:\windows\autorun.inf
del /a:h /f c:\windows\smss.exe
del /a:h /f c:\windows\funny ust scandal.exe
5. Now you need to delete one more file :
del /a:h /f “%userprofile%\Start Menu\Programs\Startup\lsass.exe”
6. Use PowerExes to delete startup entries like.
smss.exe
lsass.exe(if it does not remove then only uncheck it)
killer.exe
7. To restore Folder Option Settings Follow this page
Show Hidden Files And Folders Not Working
8. To Remove the virus from Flash Drive, Insert a flash drive cancel any Autoplay box.
Open cmd and type (Replace x by your usb drive letter)
del /a:h /f x:\autorun.inf
del /a:h /f x:\smss.exe
del /a:h /f x:\funny ust scandal.avi.exe"



(source of info can be found here)

Download this:
Funny UST Scandal Avi.exe Remover
http://www.geocities.com/six519/Remover....

or if you don't thrust another exe from some unknown location

-first download taskiller in http://www.rsdsoft.com/task_killer/index... and install it to
your computer because you cant use taskmanager to terminate the virus(the virus automatically close taskmanager).

-run taskiller and left click it on the system tray(the one with a skull icon)

-click processes

-to close the virus, select process and click yes to the question

(process to close)
1.killer.exe
2.lsass.exe
3.smss.exe

note: close only file that have the same icon of Funny UST Scandal.avi.exe


CMD STEPS
1-now, click "start" then "run"
2-type "cmd" without quotes
3-type "cd\" without quotes
4-type "attrib -h -s smss.exe" without quotes
5-type "attrib -h -s autorun.inf" without quotes
6-type "start c:" without quotes(a new window will open)
7-select smss.exe,autorun.inf,Funny UST Scandal.avi.exe and delete it

-if theres any drive or a partition type "d:" in command prompt without quotes
"d" is the drive letter then repeat the CMD STEPS number 4-7 above.......

-now type this on the command prompt "cd windows" without quotes(na naman!)
-type "attrib -h -s smss.exe" without quotes(uli)
-type "start c:\windows" without quotes(hay naku!)
-delete the file smss.exe
-now, goto c:\documents and settings\all users\startmenu\programs\startup
-delete lsass.exe

-click "start" then "run"
-type "regedit" without quotes then delete the registry entries above.