A virus that blocks all antivirus program

[affynm]

Hello,

I have downloaded crack files from this site

hттp://please_do_not_post_direct_links_on_cracks_or_malwa re.html

then I began to notice unusual behaviours in my computer.

The most important was that the antivirus program in my computer is out of function. I was using NIS 2006. Also it happened may times that the internet connection is disabled also. But I could retrieve it.

I have tried to install other types of antivirus program like kaspersky and AVG, but I got the same problem. The antivirus program is disabled and not functioning.

I have followed the steps that are listed here in this forum and I have generated the 3 log files... but I couldn't up load them!!!


I am waiting for your help..

[affynm]

I have uploaded the log files from another computer.
I have a little problem now, the file size exceeded the allowed size
I have got this msg:
virusinfo_cure.zip:
Exceeds your quota by 2.09 MB

[Numb]

First of all, please, look for the virusinfo_syscure.zip file in AVZ's "log" subfolder. If it exists, attach it to your post here. And you shouldn't try to attach virusinfo_cure.zip file here - it's a quarantine, it should be uploaded via the link http://virusinfo.info/upload_virus_eng.php?tid=55258 only after helper's request.

While executing script, disable your internet connection and turn off any antiviruses and anti-spyware programs. Execute the script:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\DOCUME~1\AF269F~1.F\LOKALA~1\Temp\bfastfao.sys','');
 QuarantineFile('C:\WINDOWS\system32\tdisp.sys','');
 QuarantineFile('C:\Documents and Settings\A.F.F\Application Data\rhawleuqwnbd.dll','');
 SetServiceStart('bfastfao', 4);
 DeleteFile('C:\Documents and Settings\A.F.F\Application Data\rhawleuqwnbd.dll');
 BC_DeleteFile('C:\Documents and Settings\A.F.F\Application Data\rhawleuqwnbd.dll');
 DeleteFile('C:\WINDOWS\system32\tdisp.sys');
 BC_DeleteFile('C:\WINDOWS\system32\tdisp.sys');
 DeleteFile('C:\DOCUME~1\AF269F~1.F\LOKALA~1\Temp\bfastfao.sys');
 BC_DeleteFile('C:\DOCUME~1\AF269F~1.F\LOKALA~1\Temp\bfastfao.sys');
 DeleteService('bfastfao');
 BC_DeleteSvc('bfastfao');
BC_ImportquarantineList;
BC_Activate;
ExecuteSysClean;
executerepair(1);
executerepair(9);
autofixspi;
RebootWindows(true);
end.

After restart, upload quarantine using the link above, as it's described in the app.3 of the rules, and make new logs.

[affynm]

Thank you very much for help.
The computer is working good now. The antivirus program is working also and I can upload files now directly from my machine.

I have attached the log files with this reply.

Are there any other measures that I should do?

[Numb]

There are several suspicious files in your log.
Please, execute the script:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
BC_QrFile('C:\WINDOWS\system32\lpxod.exe');
QuarantineFile('C:\WINDOWS\system32\lpxod.exe','');
BC_Activate;
RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Control\Terminal Server','fAllowToGetHelp', 0);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
SetServiceStart('SSDPSRV', 4);
SetServiceStart('TlntSvr', 4);
RebootWindows(true);
end.

After restart, upload the quarantine via the link http://virusinfo.info/upload_virus_eng.php?tid=55258 . Your main antivirus is AVG, isn't it? If so and if it's updated, make the full scan of your system.

[affynm]

Hello again,

I have executed the script and scanned the system with AVG which found few threats and removed them.

The quarantine is empty now.

What I want to know now is should I keep "Kasper virus removal tool" or unintall it?

At the end I would like to appreciate all your efforts.. you are really helpfull.

[Numb]

Hello.
I'm glad that our advices are helpful. Yes, if your AVG antivirus is alive and up to date, you'd better uninstall AVP tool. As for AVZ tool, it doesnt require any uninstallation, you may just remove it or leave it - at your choice. But if you have enough time, I suggest you to make new logs by AVZ and Hijackthis - just to be sure that everything is clean.