8 major infections together.

I am working in virus removal support for a softwere.

I got a customer with 8 mojor infection in one computer. I have the screen shots of the files and list of files.

I was not able to remove it for the first time.
Then I had to do it three time.
I heve the registry entries also. But I cannot provide it over here. Because all of them are Screen shots.

List of infections:


Advanced Antivirus

C:\Program Files\AAV
C:\Program Files\Aav1
C:\Program Files\Aav.ooo


PC Antispy

C:\Program Files\PC-Antispy
ASpyStBlk.dll


rhcehqj0ev5v:

c:\programfiles\rhcehqj0ev5v\database.dat
c:\programfiles\rhcehqj0ev5v\license.txt
c:\programfiles\rhcehqj0ev5v\MFC71.dll
c:\programfiles\rhcehqj0ev5v\MFC71ENU.dll
c:\programfiles\rhcehqj0ev5v\Msvcp71.dll
c:\programfiles\rhcehqj0ev5v\Msvcr71.dll
c:\programfiles\rhcehqj0ev5v\rhcehqj0ev5v.exe.local



System Antivirus 2008

C:\Program Files\sav0
C:\Program Files\sav1
C:\Program Files\sav.ooo





Virus Remover 2008

C:\Program Files\VirusRemover2008\Viruses.bdt
C:\Documents and Settings\Owner\Application Data\VirusRemover2008



Windows antivirus

C:\program files\ WAV\wav1
C:\program files\ WAV\wav.ooo




Win Defender 2008

C:\program files\WinDefender2008\data.dat
C:\program files\WinDefender2008\FwHookDrv
C:\program files\WinDefender2008\Hosts.hst
C:\program files\WinDefender2008\Manual
C:\program files\WinDefender2008\Options.xml
C:\program files\WinDefender2008\ProgLib.dll
C:\program files\WinDefender2008\Reserve.dat
C:\program files\WinDefender2008\Rules
C:\program files\WinDefender2008\Rules.txt
C:\program files\WinDefender2008\SecCenter
C:\program files\WinDefender2008\Siren.wav
C:\program files\WinDefender2008\Support.url
C:\program files\WinDefender2008\Svo.scf
C:\program files\WinDefender2008\Vfile
C:\program files\WinDefender2008\WDefDemo.exe
C:\program files\WinDefender2008\Web.url
c:\Program Files\WinDefender2008\Uninstall.exec:\Program iles\WinDefender2008\Uninstall_st_st_.exe

And some possible files are:

%UserProfile%\Local Settings\Temp\delwdef2008.bat
c:\Documents and Settings\All Users\Start Menu\WinDefender 2008 Unregistered
c:\Documents and Settings\All Users\Start Menu\WinDefender 2008 Unregistered\Launch WinDefender 2008.lnk
c:\Documents and Settings\All Users\Start Menu\WinDefender 2008 Unregistered\On the web.lnk
c:\Documents and Settings\All Users\Start Menu\WinDefender 2008 Unregistered\Support.lnk
c:\Documents and Settings\All Users\Start Menu\WinDefender 2008 Unregistered\Uninstall WinDefender 2008.lnk

Possible infected registry files:

HKEY_CURRENT_USER\Software\WinDefender 2008
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinDefender 2008
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FWHOOKDRV
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FwHookDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FWHOOKDRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FwHookDrv
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WinDefender 2008"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "C:\DOCUME~1\BC\LOCALS~1\Temp\delwdef2008.bat"

Some system 32 files which can be infected.

C:\WINDOWS\system32\Jupdate-1.6.0_...
C:\WINDOWS\system32\_c0015652.jpg
C:\WINDOWS\system32\senekadf.dat
C:\WINDOWS\system32\senekadf.dll
C:\WINDOWS\system32\seneka.dat
C:\WINDOWS\system32\seneka.dll
C:\WINDOWS\system32\senekaul.dat
C:\WINDOWS\system32\senekakl.dat
C:\WINDOWS\system32\senekaerrors.log
C:\WINDOWS\system32\drivers\seneka.sys
C:\WINDOWS\system32\akttzn.exe
C:\WINDOWS\system32\awtoolb.dll
C:\WINDOWS\system32\bdn.com
C:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\system32\dpcproxy.exe
C:\WINDOWS\system32\h@tkeysh@@k.dll
C:\WINDOWS\system32\rundl1.exe
C:\WINDOWS\system32\regm64.dll
C:\WINDOWS\system32\regc64.dll
C:\WINDOWS\system32\ps1.exe
C:\WINDOWS\system32\psof1.exe
C:\WINDOWS\system32\psoft1.exe
C:\WINDOWS\system32\newsd32.exe
C:\WINDOWS\system32\netod.exe
C:\WINDOWS\system32\mwin32.exe
C:\WINDOWS\system32\mtr2.exe
C:\WINDOWS\system32\msvchost.exe
C:\WINDOWS\system32\mssecu.exe
C:\WINDOWS\system32\msnbho.dll
C:\WINDOWS\system32\msgp.exe
C:\WINDOWS\system32\medup020.dll
C:\WINDOWS\system32\medup012.dll
C:\WINDOWS\system32\hxiwlgpm.dat
C:\WINDOWS\system32\hxiwlgpm.exe
C:\WINDOWS\system32\hoproxy.dll
C:\WINDOWS\system32\sncntr.exe
C:\WINDOWS\system32\ssurf022.dll
C:\WINDOWS\system32\ssvchost.com
C:\WINDOWS\system32\ssvchost.exe
C:\WINDOWS\system32\sysreq.exe
C:\WINDOWS\system32\temp#01.exe
C:\WINDOWS\system32\thun.dll
C:\WINDOWS\system32\thun32.dll
C:\WINDOWS\system32\vbiewer.ocx
C:\WINDOWS\system32\vbsys.dll
C:\WINDOWS\system32\winlogonpc.exe
C:\WINDOWS\system32\winsystem.exe
C:\WINDOWS\system32\winwgpx.exe
C:\WINDOWS\system32\luresult.txt

 

Please get me some resolution steps for this ....

 

I have a tool which helps me to delete the infectious and unwanted files which includes DLL files which we will not be able to remove using ordinary tools. I used that. Still I am not able to remove any of the infected fles. It was recreating by it self(The files in system 32). Can you suggest any tool to delete DLL files?

 

I need to tell you something. I am a virus removal technician. And I trust the tools that I use. I thibnk you did not read teh first thread properly. I was able to remove it. But only by third time. If you want to delet this thread, Do it. Not a big deal.
I was just asking you to gie me some tool to remove that kind of infectious files.
And I know how to do a virus removal very well. I have made some tools for my selg depending on the infections. Ok. SOme batch files and all, so that I can delete the files very wasily.
So, do not think I am not able to do sometyhin. OK. I have 2 yersrs of experience in removing virus from customer's computer.