Unknown virus very dangerous please help to remove

[mmrana]

windows automatic restart when i try to install avast or any antivirus safe is disable. please hlp to remove virus

rana

 

[Blind Dragon]

That version wont show everything

Incorrect HJT version installed or wrong folder

• Please uninstall your current version of HJT (This can be done through Control Panel => add/remove programs icon => highlight HJT => select change/uninstall button)
• The LATEST version of HJT (currently v2.0.0.2) can be downloaded from HERE
• Run the HijackThis Installer and it will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe. Please don't change the directory. If HijackThis is used from a temp folder it is in danger of being accidentally deleted by Disk Cleanup or similar tools.
• After installing, the program launches automatically, select Scan now and save a log
• After the scan is complete please post your log onto the forums in your next reply.

Also try this program
Malwarebytes' Anti-Malware

• Please download Malwarebytes' Anti-Malware to your desktop.
  
• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please attach this log with your reply
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

 

[mmrana]

Virus problem was not solved

what you said i do it but the problem was not solved. i do windows repair and installed avast some time later it corrupted and avast in inactive mood no antivirus do not install. my two log file attached. i scaned by latest combofix, and super antispyware too. please help...

Rana

 

[Blind Dragon]

There isn't much to that log. We need to look deeper

Combofix

• Download Combofix to your desktop.
• Double click combofix.exe & follow the prompts.
• A window will open with a warning.
• When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log.

Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Combofix is a very powerful tool so please do NOT do anything without instruction

Combofix will automatically save the log file to C:\combofix.txt

 

[mmrana]

virus do not go please help

i try to remove avast and macfee antispyware but nothing happend.
latest log files attached please help me......

 

[Blind Dragon]

I am working on a fix for you, looks like you may have a rootkit that changes the registry to override your anti-virus product, basically using windows security center against you.

Let's try this first before manually messing around in the registry

You may want to print this out or save it in a notepad to your desktop to be able to see it while in safe mode

Download and Install SDFix

• Download SDFix and save it to your Desktop.
  
• Double click SDFix.exe and it will extract the files to %systemdrive%
  (Drive that contains the Windows Directory, typically C:\SDFix)

Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

Run SDFix

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
• Attach Report.txt back here

 

[mmrana]

problem is increase

Well i said that windows do not work with safe mood so i do repair of windows. Already i repair windows 2 times and installed fresh windows i time i do it when i was not member of this site. but i can not understand what had happened my pc, Problem is increase. before repair windows i faced another problem that is any file or folder do not paste and pc was very slow. I am waiting for your help.......
Well this site is very helpful but i have to say that techspot is very slow.

I do it what u said sdfix report file attached

Regards
Rana

 

[Blind Dragon]

Sorry I am having a bit of trouble understanding everything you say clearly.

Slow hmmm, well it is also free as this is NOT my job.

You have some programs running from temp folder we should really clean this out.

Download and Run ATF Cleaner
Download ATF Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it.

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

Firefox or Opera:
Click Firefox or Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Let me see a fresh Hijackthis log

 

[mmrana]

i am very worry for my pc please solve problem quickly

After install new antivirus, some times later it is not work, when i click scan button pc restart.

after windows startup some error are shown these are

BCCode : 50 BCP1 : FFFFFFF0 BCP2 : 00000000 BCP3 : 804EA447
BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

AppName: igfxtray.exe AppVer: 3.0.0.2104 ModName: unknown
ModVer: 0.0.0.0 Offset: f0019306

AppName: hkcmd.exe AppVer: 3.0.0.2104 ModName: unknown
ModVer: 0.0.0.0 Offset: f0019306

fresh log file attached

 

[Blind Dragon]

You have both Norton and Mcafee active in memory at the same time. This is not good to have multiple Anti virus programs running at the same time

You need to pick one of these and we will remove the other

 

[jeannie2426]

what about one care, is that good?

 

[Blind Dragon]

one care isn't bad but you just don't want multiple AV products active as it can hurt your performance and in rare cases even cause crashes