can't remove virusses

[pieterke]

Hi,

these are the issues I'm facing : I can't surf the internet, although i can ping www;google.com, I can't install new programs, windows security center is not running and i cannot start it, usb sticks are hitted with W32/rimecued!, ...
I did run antivirus/antispy/... serval times, but nothing seems to help.

I collected the sys info with kaspersky and added them in attachment

Thanks a lot for your support,

[Rene-gad]

Downolad the LAST version of AVPTool and use it further!

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- Execute following script in Manual disinfection

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
 QuarantineFile('F:\autorun.inf','');
 QuarantineFile('C:\Windows\system32\qqkk1vvqq.exe','');
 QuarantineFile('C:\Windows\system32\lbrrmmgwwr.exe','');
 QuarantineFile('C:\Windows\system32\gbbwm0g0bww.exe','');
 QuarantineFile('C:\Windows\system32\bbvq0llg.exe','');
 QuarantineFile('C:\Windows\system32\afa0vvqqka.exe','');
 QuarantineFile('C:\Windows\system32\0lggb1b.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-8549666223-9408468360-017552361-6338\yv8g67.exe','');
 StopService('PKCJM');
 DeleteService('PKCJM');
 QuarantineFile('C:\Users\VANROM~1\AppData\Local\Temp\PKCJM.exe','');
 QuarantineFile('\\?\globalroot\systemroot\system32\H8SRTsdwsfhprpj.dll','');
 DeleteFile('\\?\globalroot\systemroot\system32\H8SRTsdwsfhprpj.dll');
 DeleteFile('C:\Users\VANROM~1\AppData\Local\Temp\PKCJM.exe');
 DeleteFile('C:\RECYCLER\S-1-5-21-8549666223-9408468360-017552361-6338\yv8g67.exe');
 DeleteFile('C:\Windows\system32\0lggb1b.exe');
 DeleteFile('C:\Windows\system32\afa0vvqqka.exe');
 DeleteFile('C:\Windows\system32\bbvq0llg.exe');
 DeleteFile('C:\Windows\system32\gbbwm0g0bww.exe');
 DeleteFile('C:\Windows\system32\lbrrmmgwwr.exe');
 DeleteFile('C:\Windows\system32\qqkk1vvqq.exe');
 DeleteFile('F:\autorun.inf');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','bvvqgg1');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','aavkk');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','bvvqggb');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','wrggbr9');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','wrmm6g');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3259215167-1646201033-2034137753-1003\Software\Microsoft\Windows\CurrentVersion\Run','vvqvqkk ');
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('PKCJM');
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.

After reboot execute following script in Manual disinfection

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

and upload the C:\quarantine.zip over the link Upload quarantined files on the top of this page.


- Repeat a log file of AVPTool.
- Make a log file with Hijackthis ( Analysis, p.3 for further informations).
- Make a log of GMER
- Attach 3 logs to your new post..