Cannot download Kapersky Anti-Virus, probably because I still have a virus - help!

[kalaila]

I tryed to install the above program but keeps on saying that it cannot install probably because of having a virus on the computer. I also used Kaspersky Virus removal tool but it seemed that no virus was found. I attach the sytem information file gathered by your program. Thanks in advance for the help - please explain in very simple terms as Im not great with computers, thanks.

[Rene-gad]

pls. remove follow antiviruses before the installation of Kaspersky and try again.

C:\Program Files\AVG\AVG8\avgssie.dll
C:\Program Files\McAfee\VirusScan\NAIEvent.dll

[kalaila]

Hi,
Thanks for your quick reply, Ive removed them both and Im still unable to download the Anti-virus package. Also, do you need to send me the codes so that I can try manually remove the viruses using Kasperkys Anti-Virus Removal program? I think I cant dowload the anti-virus due to the virus,
thanks,

[Rene-gad]

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore


- Execute following script in Manual Healing

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DelBHO('{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}');
 QuarantineFile('c:\progra~1\freedo~1\fdm.exe','');
 QuarantineFile('c:\downloads\software\softonicdownloader82283.exe','');
 DeleteFileMask('c:\program files\askbardis\','*.*',true);
 DeleteDirectory('c:\program files\askbardis\');
 DeleteFileMask('C:\Program Files\McAfee\','*.*',true);
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\Eventlog\Application\McLogEvent','EventMessageFile');
 DeleteFileMask('C:\Program Files\AVG\','*.*',true);
 DeleteDirectory('C:\Program Files\AVG\');
 DeleteDirectory('C:\Program Files\McAfee\');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(true);
RebootWindows(true);
end.

After reboot:
- Execute following script in Manual Healing

begin
CreateQurantineArchive('C:\quarantine.zip');    
end.

- Upload the C:\quarantine.zip here: http://virusinfo.info/upload_virus_eng.php?tid=83238
- Repeat a log file.
- Attach a new log to your new post..

[kalaila]

Hi,

Thanks so much for taking me through this!
I´ve gone through the previous steps on my last log to send you the quarentine file and Ive now created a new log, which I attach.

I await your next instructions!

Thank you!

[Rene-gad]

- Attach a new log to your new post..

... not NEW TOPIC

database released 01/02/2010; 07:27 pls. download the LAST version and repeat the log.

- Execute following script in Manual Healing

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DelBHO('{3041d03e-fd4b-44e0-b742-2d9b88305f98}');
 DelBHO('{201f27d4-3704-41d6-89c1-aa35e39143ed}');
 DeleteFileMask('c:\program files\askbardis\','*.*',true);
 DeleteDirectory('c:\program files\askbardis\');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

- Repeat a log file.
- Attach a new log to your new post..

[kalaila]

Hi,
Sorry about that. What do you mean to download the last version? what version of what?

[Rene-gad]

Hi,
what version of what?

AVPTool: your version is obsolete.

[kalaila]

Ok, here is my log,

Many thanks,

Andrea

[Rene-gad]

Ok, here is my log,

... with obsolete version again:

(database released 01/02/2010; 07:27)

[kalaila]

how do I get the new version? sorry

Добавлено через 1 час 1 минуту

How can I download this if my computer doesnt let me download anything due to the virus?? and where can I find the "latest" version?

[Rene-gad]

how do I get the new version?

http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
If you cannot do it at your system, download at any other one.

[kalaila]

I attach the updated version of AVPtool.
I await the next step,


Thanks again,

[Rene-gad]

Make a log of Hijacktis
Make a log of Malwarebytes Antimalware.

How would be with this thread: http://forum.kaspersky.com/index.php?showtopic=177614 ?

[kalaila]

Hi,

How do I make a log of those please? I have no idea,
thanks.

[Rene-gad]

How do I make a log of those please?

Pls. read the rules (chapter Analysis P. 3).
About MBAM: http://forums.malwarebytes.org/index.php?showtopic=9573

[kalaila]

Hi there,
Sorry. Here are the attached files.
I used Malwarebytes Anti-ware system and did a quick scan, hope thats alright (and deleted the viruses). Hope I did the Hijackthis correctly as a message appeared "System denied access to host file".
Are we any closer to removing the viruses yet? Do I have many?
Thanks.

[Rene-gad]

-Fix with Hijackthis

R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
R3 - URLSearchHook: (no name) - {91C18ED5-5E1C-4AE5-A148-A861DE8C8E16} - (no file)
R3 - URLSearchHook: (no name) - {0974848a-b5bc-49f2-9778-307742b4a55d} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.97,85.255.112.64
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.97,85.255.112.64
O17 - HKLM\System\CS3\Services\Tcpip\..\{074E2339-BA45-45DC-9E09-67E0A1D26FB6}: NameServer = 85.255.112.97,85.255.112.64
O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.112.97,85.255.112.64

Reboot you system and repeat Hijackthis and MBAM - Logging

[kalaila]

Hi there,

Ive followed your directions and rebooted. Please see attached log.

[Rene-gad]

-Fix with Hijackthis

O17 - HKLM\System\CCS\Services\Tcpip\..\{A34D1C57-4E78-40E8-A938-F5289D02C517}: NameServer = 85.255.112.97,85.255.112.64
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.97,85.255.112.64
O17 - HKLM\System\CS5\Services\Tcpip\Parameters: NameServer = 85.255.112.97,85.255.112.64
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.97,85.255.112.64

Reboot you system and repeat Hijackthis and MBAM - Logging

Make such log: http://www.bleepingcomputer.com/comb...o-use-combofix