Infected with virus - Block access to AV & MS website

Hi there

My PC has been infected by virus which is blocking me from accessing any AV website and MS website.

Everytime I restarted my PC, my Bitdefender block some activities that accessing some chinese website.

I already run Spybot, Bitdefender & Dr Web Cure It.

They managed to clean certain virus but still I cant access those websites.

Below I attached log from Kapersky removal tool.

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Cure
[CODE]begin
SetAVZPMStatus(True);
ExecuteRepair(13);
RebootWindows(true);
end.
[/CODE]
After reboot
- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Repeat a log file.

The log attached as per your request.

What is the drive E:\? It contains malicious items, let it ON during the follow operations.

- Startmenu/Run... give the string in: [code]edit c:\windows\system32\drivers\etc\hosts[/code] and press Enter, remove all servers besides [CODE]127.0.0.1 localhost[/CODE]
File/Close and Save changings.

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore


- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('E:\autorun.inf','');
QuarantineFile('E:\SPOOLSV.EXE','');
DeleteFile('E:\SPOOLSV.EXE');
DeleteFile('E:\autorun.inf');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]


- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat a log file.
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=43845[/url]
- Attach a new log to your new post..

I already uploaded the quarantine.zip file and already attached log. As additional information, everytime I restart my PC, my AV will block access from my PC to the website like what I attached.

FYI, I even cannot access this website from my PC.I have to use another PC to access to this website

For the 2nd time:
[B]What is the drive E:\? [/B]

really sorry...i miss that part.

E: is my thumb drive which is i just reformatted.

Did you clean all temp/cache maps using CCleaner & ClearProg?

[QUOTE=mynor;417822]I already uploaded the quarantine.zip file[/QUOTE]Whereto? I'd like to see it here: [url]http://virusinfo.info/upload_virus_eng.php?tid=48020[/url]

yes. i did clean using CCleaner but I havent use ClearProg

update: i just try to scan using ClearProg 1.5.1 Beta 8 but half way it crashed

[size="1"][color="#666686"][B][I]Добавлено через 17 минут[/I][/B][/color][/size]

[QUOTE=Rene-gad;417857]Did you clean all temp/cache maps using CCleaner & ClearProg?

Whereto? I'd like to see it here: [URL]http://virusinfo.info/upload_virus_eng.php?tid=48020[/URL][/QUOTE]

Yes. I uploaded by using your link.

[QUOTE=mynor;417861]Yes. I uploaded by using your link.[/QUOTE]The container is empty. Pls. repeat & copy-paste the message about successful upload.

BTW: You hadn't use Beta of ClearProg but only Final version.

i cannot upload anymore and i got this error:

[B]Upload result[/B]

[B]Upload error. This file already was uploaded before[/B]

I'm sorry, I gave you a wrong link :>
Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Cure
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('C:\WINDOWS\System32\Drivers\29732f40.sys','');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\tcpip.sys','');
QuarantineFile('E:\MPNOTIFY.EXE','');
QuarantineFile('E:\autorun.inf','');
DeleteFile('E:\MPNOTIFY.EXE');
DeleteFile('E:\autorun.inf');
DeleteFile('C:\WINDOWS\System32\Drivers\29732f40.sys');
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(2);
ExecuteRepair(3);
ExecuteRepair(4);
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual Cure
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]

- Repeat a log file.
- Upload the quarantine.zip over this link: [url]http://virusinfo.info/upload_virus_eng.php?tid=48020[/url]

quarantine file uploaded successfully.

log as per attached below

[QUOTE]System booted in Safe Mode[/QUOTE]
Log should be done only in NORMAL MODE and you should not remove old log files.

this one log when my pc in normal mode..
i did removed the old log because it going to take space when I attached a new logs

The drive E:\ is infected. Evtl. it will be infected at any other PC. Format it at Linux System or don't use it at all.
Repeat the log without E:\