help required

Cannot find virus. have tried AVG, MS live one care, kaspersky.

Spybot will not run!

All help appreciated

Logs attached

Please read carefully the rules, your logs are almost useless to us.
You should update avz bases, disable antivirus and make logs in [U]normal mode[/U] and [U]not[/U] in safe mode, like you did.
Describe your problem. You can't boot in normal mode?

[QUOTE=drongo;441003]make logs in [U]normal mode[/U] [/QUOTE]+ remove all antiviruses excepted one of them.

Will do normal mode although may take a time as keeps locking

thanks

if you will disable all your programs in system tray, except your browser(browser should be running)- it will be faster.

let you know

hopefully these are what you need - back in safe mode.....

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
[COLOR="Red"][B]- System Restore[/B][/COLOR]

-[URL="http://virusinfo.info/showthread.php?t=9206"]Fix[/URL] with Hijackthis
[CODE]O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - (no file)
[/CODE]
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('%systemroot%\system32\UACnbacbigjwy.dll','');
DeleteFile('%systemroot%\system32\UACnbacbigjwy.dll');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.
[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL]
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat steps 1...3 of Analysis and attach 3 new logs
- Make a log with GMER [url]www.gmer.net[/url] (download, start, press SCAN, wait a couple of minutes till the scanning will be to the end, press SAVE and save a log as gmer.log, attach the log together with 3 standard logs).
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.

Hi

More logs.

Cannot get GMER to finish - starts to run then locks up = time period varies for lock up.

thanks

[QUOTE=neilwool;441515]
Cannot get GMER to finish - starts to run then locks up = time period varies for lock up.
[/QUOTE]Switch firewall & antivirus off before starting of gmer.

have done that GMER still locks but varies on how long before it locks

[size="1"][color="#666686"][B][I]Добавлено через 2 часа 48 минут[/I][/B][/color][/size]

once I start gmer it quickly states warning gmer has found system modification which might have been caused by ROOTKIT activity. Dou want to fully scan your system?
I have been saying yes.
I notice that highlighted in red is;
Type Name value
service C:\windows\system32\drivers\UACxocntoymcj.sys (System) UACd.sys

hope this helps

Copy & paste follow code
[CODE]gmer.exe -del service UACd.sys
gmer.exe -del file "C:\windows\system32\drivers\UACxocntoymcj.sys"
gmer.exe -reboot[/CODE]
in a new text file, save it as e.g. [B]123.bat[/B] in the same directory where lies gmer.exe and start it with double click.
After reboot switch firewall & antivirus off and repeat Gmer.log

after runing CHKDSK ran on reboot and rebuilt the usn journal.

also avg detected and removed trojan horse generic 13.BQVV on restart.

GMER ran sucessfully and I attach log

Copy & paste follow code
[CODE]gmer.exe -del reg "HKLM\SYSTEM\ControlSet002\Services\UACd.sys"
gmer.exe -del file "C:\windows\system32\drivers\UACuwpritrdme.sys"
gmer.exe -del file "C:\windows\system32\UACtboebebhwt.dll"
gmer.exe -reboot[/CODE]
in a new text file, save it as e.g. [B]321.bat[/B] in the same directory where lies gmer.exe and start it with double click.
After reboot switch firewall & antivirus off and repeat Gmer.log

gmer log

[QUOTE=neilwool;441797]gmer log[/QUOTE]it's clean. Any problem more?

Hi

No more problems all seems fine - thank you very much.

Best wishes

Neil

[QUOTE=neilwool;441928] thank you very much.[/QUOTE]thanks could be pressed here [IMG]http://virusinfo.info/images/buttonsen/post_thanks.gif[/IMG] ;)

sent USD35 hope thats OK

cheers

[QUOTE=neilwool;441998]sent USD35 hope thats OK[/QUOTE]TYVM :)