Trojan agen/gen-cdesc.(149)

[ChrisB]

I think I have this nasty trojan.
I have tried to create the log files but could not get Kaspersky virus removal tool to run properly.
AVZ started but dissapeared no log file in safe mode.
Hijackthis started but dissapeared no logfile.
Install Kaspersky Internet security but can not access the software now after I install it.
I only have the one log file can anybody help.

[Numb]

Hello.
Your AVZ is not updated. Is its update unable as well? If no, run upper menu "file" - database update".
Execute the script:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('\\?\globalroot\Device\__max++>\82A42A38.x86.dll','');
 QuarantineFile('c:\docume~1\christ~1\applic~1\slowbe~1\Ooze sect five.exe','');
 QuarantineFile('C:\Program Files\Dealio Toolbar\SearchSettings.dll','');
 QuarantineFile('C:\Program Files\Windows Live\Toolbar\wltcore.dll','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\rp_skt32.sys','');
 QuarantineFile('C:\Program Files\Windows Live\Family Safety\fssbho.dll','');
 QuarantineFile('C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll','');
 QuarantineFile('C:\Cpqs\Scom\srmclean.exe','');
 QuarantineFile('C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys','');
 QuarantineFile('C:\Program Files\SUPERAntiSpyware\SASENUM.SYS','');
 QuarantineFile('C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS','');
 QuarantineFile('C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\cdiskdun.sys','');
 DeleteFile('C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\cdiskdun.sys');
 BC_DeleteFile('C:\DOCUME~1\CHRIST~1\LOCALS~1\Temp\cdiskdun.sys');
 DeleteFile('C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS');
 BC_DeleteFile('C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS');
 DeleteFile('C:\Program Files\SUPERAntiSpyware\SASENUM.SYS');
 BC_DeleteFile('C:\Program Files\SUPERAntiSpyware\SASENUM.SYS');
 DeleteFile('C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys');
 BC_DeleteFile('C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys');
 DeleteFile('c:\docume~1\christ~1\applic~1\slowbe~1\Ooze sect five.exe');
 BC_DeleteFile('c:\docume~1\christ~1\applic~1\slowbe~1\Ooze sect five.exe');
 DeleteService('SASKUTIL');
 DeleteService('SASENUM');
 DeleteService('SASDIFSV');
 DeleteService('cdiskdun');
 BC_DeleteSvc('SASKUTIL');
 BC_DeleteSvc('SASENUM');
 BC_DeleteSvc('SASDIFSV');
 BC_DeleteSvc('cdiskdun');
BC_ImportquarantineList;
BC_Activate;
ExecuteSysClean;
setavzpmstatus(true);
RebootWindows(true);
end.

After restart, upload the quarantine via the link http://virusinfo.info/upload_virus_eng.php?tid=55776 , as it's described in the app.3 of the rules, and try to make new logs with AVZ. In addition, make this log.

[ChrisB]

Hello Numb
I install lastest AVZ 4.32 updated database and then Execute your script.
AVZ closed down and now when I tried to access (run) AVZ I get a message from windows " windows cannot access the specified device, path, or file. you may not have the appropriate permissions to access the them."
I also tried AVZ with the script in safe mode but had the same problem as above.

Thank you

ChrisB.