please help me, it’s avout 2 week now
there is many viruses in my laptop, i think i already cleaned it a bit, but there is still some viruses…
when i boot-up scan with avast, there is viruses caled win32:file-infectorA in windows, so many
i already do OTL, combofix, rogue killer, fss, mbam, avast, smadav
here is the log
please help me…
here is another log
i really need kind people help 
i already begin the war since 2 weeks ago, now i’m really out of ammo and don’t have idea 
Let me look these over and I will return shortly. 
Please download aswMBR to your desktop.
[*]Right click and Run as Administrator the aswMBR icon to run it.
[*]Click the Scan button to start scan.
[*]When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
woooow really fast reply, thaanksss 
ah i forgot the aswMBR, sorry ;D
ok i already scanned it
and before aswMBR, i scanned it with avast too
here the log
please help me anyone?
Hi,
I am still here. I am speaking with a colleague about your system. I will return as quickly as I can. Thank you for your patience.
okay, please take care
i’ll waiting
Hi,
Please download the following programmes to your desktop:
Install IMGBurn
[]Double click Dr Web
[]IMGBurn will open
[*]Burn the ISO to a cd
[]Reboot the infected computer with the CD in the drive
[]Ensure that the first boot device is CD - If you are not sure about that then see this page for instructions
[*]As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.
http://i1224.photobucket.com/albums/ee362/Essexboy3/Dr%20Web%20shots/livecdbootscreen.gif
[*]Use arrow keys to select DrWeb-LiveCD (Default)
[*]When the system is loaded, check the disks or folders you want to scan, and click on “Start”.
http://i1224.photobucket.com/albums/ee362/Essexboy3/Dr%20Web%20shots/livecdDriveselection.gif
[]The programme will now scan for and cure/delete any malware that it finds. Allow it to do so
[]Once completed reboot to normal windows
[*]No log is produced so once in normal windows run a fresh OTL scan and let me know if the problems persist
ok i already scanned it with drlive, it got something
i also scan with spybot S&D, and use CCleaner too
but that 4 viruses there, in the pict, still there :o
lsass.exe
imjputy.exe
tsauninst.exe
CloseHK.EXE ← i already deleted it with avast
here’s OTL log
anyway is lsass.exe important?? ???
ah there’s kind of ‘autorun-like’ thingy when i do sumting. like when i want to copy the OTL.txt, there’s ‘autorun-like’ in a flash, maybe viruses doing something…
lsass.exe is a “vital” file,located in system32.Do NOT delete,as well as other “infected processes”,you may end up having an unbootable computer.Just wait for the experts to help you .
“lsass.exe is the Local Security Authentication Server. It verifies the validity of user logons to your PC or server. Lsass generates the process responsible for authenticating users for the Winlogon service. This is performed by using authentication packages such as the default, Msgina.dll. If authentication is successful, Lsass generates the user’s access token, which is used to launch the initial shell. Other processes that the user initiates then inherit this token.” .
Have a nice day.
OMG :o
i nearly deleted that, lol
thanks for the info
so… should i keep using that infected laptop?
or should i shut down it first until the master show up with cure??
(i’m scarred that virus will duplicated itself)
Hi,
Please read through these instructions to familarize yourself with what to expect when this tool runs
Download ComboFix from one of these locations:
* IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
[*]Double click on ComboFix.exe & follow the prompts.
[*]As part of it’s process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it’s strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RCUpdate1.png
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/RC2-1.png
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
okay here is is o__o
and combofix said explorer.exe infected
avast only said that 4 process are infected (still in my above post)
Excuse me a question, and found DrWeb something?
you mean “is dr web live found a virus??”
yes it is, but i forgot what is it…
i only scanned it in Drive C, and offcourse i make DrWeb to cure the viruses too
but, the viruses still in my Drive C:\Windows, that what Avast said, and my windows XP seems a bit weird too with that autorun thingy
Hi,
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
[*]Double-click SystemLook.exe to run it.
[*]Copy the content of the following codebox into the main textfield:
:filefind
*explorer.exe
[*]Click the Look button to start the scan.
[*]When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
woooowww what a cools aps
so basically the “look” will search for that file and it’s duplication right??
hummm explorer.exe is 3!!!
ah, i also scanned that 3 suspicious files, and voila
here’s the result :o
so the virus is now explorer.exe and another again >:(
what to do now?
Hi,
[*]Please open Notepad (Start → Run → type notepad in the Open field → OK) and copy and paste the text present inside the code box below:
FCopy::
C:\WINDOWS\system32\explorer.exe | c:\windows\explorer.exe
DirLook::
c:\documents and settings\Ushio\Application Data\ZTEMTUI
[*]Save this as CFScript.txt and change the “Save as type” to “All Files” and place it on your desktop.
http://img.photobucket.com/albums/v706/ried7/CFScriptB-4.gif
[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
[*]Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
[*]ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
[*]When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
done
but i think win32:FileInfector-A [Heur] still roaming freely in my XP
that’s what avast said, i scanned C:\windows also after the combofix