TechSpot

Unknown virus very dangerous please help to remove

By mmrana
May 7, 2008
  1. windows automatic restart when i try to install avast or any antivirus safe is disable. please hlp to remove virus

    rana
     
  2. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    That version wont show everything

    Incorrect HJT version installed or wrong folder
    • Please uninstall your current version of HJT (This can be done through Control Panel => add/remove programs icon => highlight HJT => select change/uninstall button)
    • The LATEST version of HJT (currently v2.0.0.2) can be downloaded from HERE
    • Run the HijackThis Installer and it will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe. Please don't change the directory. If HijackThis is used from a temp folder it is in danger of being accidentally deleted by Disk Cleanup or similar tools.
    • After installing, the program launches automatically, select Scan now and save a log
    • After the scan is complete please post your log onto the forums in your next reply.


    Also try this program
    Malwarebytes' Anti-Malware

    • Please download Malwarebytes' Anti-Malware to your desktop.
    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please attach this log with your reply
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
     
  3. mmrana

    mmrana TS Rookie Topic Starter

    Virus problem was not solved

    what you said i do it but the problem was not solved. i do windows repair and installed avast some time later it corrupted and avast in inactive mood no antivirus do not install. my two log file attached. i scaned by latest combofix, and super antispyware too. please help...

    Rana
     
  4. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    There isn't much to that log. We need to look deeper

    Combofix
    • Download Combofix to your desktop.
    • Double click combofix.exe & follow the prompts.
    • A window will open with a warning.
    • When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log.
    Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Combofix is a very powerful tool so please do NOT do anything without instruction

    Combofix will automatically save the log file to C:\combofix.txt
     
  5. mmrana

    mmrana TS Rookie Topic Starter

    virus do not go please help

    i try to remove avast and macfee antispyware but nothing happend.
    latest log files attached please help me......
     
  6. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    I am working on a fix for you, looks like you may have a rootkit that changes the registry to override your anti-virus product, basically using windows security center against you.

    Let's try this first before manually messing around in the registry

    You may want to print this out or save it in a notepad to your desktop to be able to see it while in safe mode

    Download and Install SDFix
    • Download SDFix and save it to your Desktop.
    • Double click SDFix.exe and it will extract the files to %systemdrive%
      (Drive that contains the Windows Directory, typically C:\SDFix)

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

    Run SDFix
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    • Attach Report.txt back here
     
  7. mmrana

    mmrana TS Rookie Topic Starter

    problem is increase

    Well i said that windows do not work with safe mood so i do repair of windows. Already i repair windows 2 times and installed fresh windows i time i do it when i was not member of this site. but i can not understand what had happened my pc, Problem is increase. before repair windows i faced another problem that is any file or folder do not paste and pc was very slow. I am waiting for your help.......
    Well this site is very helpful but i have to say that techspot is very slow.

    I do it what u said sdfix report file attached

    Regards
    Rana
     
  8. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Sorry I am having a bit of trouble understanding everything you say clearly.

    Slow hmmm, well it is also free as this is NOT my job.

    You have some programs running from temp folder we should really clean this out.

    Download and Run ATF Cleaner
    Download ATF Cleaner by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it.

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    Firefox or Opera:
    Click Firefox or Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Let me see a fresh Hijackthis log
     
  9. mmrana

    mmrana TS Rookie Topic Starter

    i am very worry for my pc please solve problem quickly

    After install new antivirus, some times later it is not work, when i click scan button pc restart.

    after windows startup some error are shown these are

    BCCode : 50 BCP1 : FFFFFFF0 BCP2 : 00000000 BCP3 : 804EA447
    BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

    AppName: igfxtray.exe AppVer: 3.0.0.2104 ModName: unknown
    ModVer: 0.0.0.0 Offset: f0019306

    AppName: hkcmd.exe AppVer: 3.0.0.2104 ModName: unknown
    ModVer: 0.0.0.0 Offset: f0019306

    fresh log file attached
     
  10. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    You have both Norton and Mcafee active in memory at the same time. This is not good to have multiple Anti virus programs running at the same time

    You need to pick one of these and we will remove the other
     
  11. jeannie2426

    jeannie2426 TS Rookie

    what about one care, is that good?
     
  12. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    one care isn't bad but you just don't want multiple AV products active as it can hurt your performance and in rare cases even cause crashes
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...