Please check my attachments

Did you install KillAndClean? Look in Add/Remove programs for it and if found, uninstall it. Let me know whether you find it or not and if you could uninstall it.

Next time, please follow the directions for creating a Bitdefender log. What you posted is OK for now, but it is not what was requested.

Where is the requested log from running CounterSpy?

You have a whole bunch of different problems we need to fix, Virtumonde, Wareout, and a variety of other trojans. The reason you are so badly infected is because your Window's OS version is severely out of date with its updates. This will have to be addressed after we finish removing your malware.

Download HOSTER and then follow the below steps.

• Unzip Hoster to a convenient folder such as C:\Hoster
• Run Hoster.exe, click Restore Original Hosts and then click OK.
• Click the X to exit the program

Now look in Add/Remove programs for the below and uninstall if found:
UnSpyPC
KillAndClean

Let me know whether you find them or not and if you could uninstall them.


Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

• Save it to your desktop and then run it by double clicking on it. It creates a folder named c:\fixwareout.
• Click Next, then Install.
• Then make sure Run fixit is checked (this runs C:\fixwareout\fixit.bat). And then click Finish.
• The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so.
• Your system may take longer than usual to load; this is normal.
• When your system reboots, follow the prompts. Afterwards, HijackThis will launch. If it does not launch then run it yourself. Please click Scan, and check the following items if they still exist:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: (no name) - {6224F13B-4C11-0D28-A184-8EC5764548F0} - SYSTRAV.dll (file missing)
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKLM\..\Run: [msag] ExchangeMaster.exe
O4 - HKLM\..\Run: [MsNetHelper] KeywordFinder.exe
O4 - HKLM\..\Run: [browsebar] hyandex.exe
O4 - HKCU\..\Run: [lvagpujk] C:\WINDOWS\System32\lvagpujk.exe
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [runload32] Uint32.exe
O4 - HKCU\..\Run: [MNTP] prcmon.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2A0E086-B824-459A-9CF8-830336D1DB8E}: NameServer = 85.255.114.40,85.255.112.15
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.40 85.255.112.15
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.40 85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.40 85.255.112.15

After clicking Fix Checked, close HijackThis, and click OK to proceed.

At the end of the fix, reboot into safe mode and use Windows Explorer to double check for the below files and delete if found:
C:\Program Files\KillAndClean <--- the whole folder
C:\Program Files\UnSpyPC <--- delete the whole folder if found
c:\documents and settings\all users\favorites\Download Free Spyware Remover.url
c:\windows\system32\SYSTRAV.dll
c:\windows\system32\ExchangeMaster.exe
c:\windows\system32\KeywordFinder.exe
c:\windows\system32\hyandex.exe
C:\WINDOWS\System32\lvagpujk.exe
c:\windows\system32\Uint32.exe
C:\windows\system32\prcmon.exe
c:\windows\system32\tcpservice2.exe
c:\windows\system32\txfdb32.dll
C:\WINDOWS\system32\cydqjzha.exe
C:\WINDOWS\system32\dmuxi.exe
C:\WINDOWS\system32\gnbmbziy.mbo
C:\WINDOWS\system32\pyfbykyr.exe
C:\WINDOWS\system32\rlfispjf.exe
C:\WINDOWS\system32\{74AF1BB2-DDEE-466B-95F1-EBA5E48A2635}.exe
c:\windows\BTGrab.dll
c:\windows\dlmax.dll
c:\windows\susp.exe

Now reboot into normal mode and please attach the contents of the logfile C:\fixwareout\report.txt

There could be additional cleanup to do from Wareout and it the log will let us know.

Also attach a new HijackThis log.

 

You still have not attached the log from CounterSpy!

Also the fixwareout log shows a file that I asked you to delete:

{74AF1BB2-DDEE-466B-95F1-EBA5E48A2635}.exe

You need to delete this file as indicated in my previous instructions. It is in the system32 folder.

Why is MSconfig running? You must always select Normal Startup after using MSconfig to boot into safe mode.

Your log is clean but you have major issues in that your Windows & IE versions are seriously out of date. This is a severe security risk.

How are things working right now?

 

As long as it is delete now, you are ok!


If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

 

You're welcome. Surf safely and thanks for recommending us.