Can't ever get rid of this virus, please i need help

[Bassem]

i have been having this problem for few months now, the virus disables task manager , registry editor , windows firewall , safe mode. i tried to download avast but the virus automaticly closed it and deleted the setup. i even tried to reinstall windows b4 but the virus still living in my pc  :'(

[essexboy]

Could you follow the first post here http://forum.avast.com/index.php?topic=53253.0

Then once done post the resultant logs in this thread

[Bassem]

here are the logs

[Bassem]

here are the logs

[essexboy]

I am afraid you may have Sality

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  DRV - File not found [Kernel | On_Demand | Running] -- -- (amsint32)
  O33 - MountPoints2\{da8b492e-0756-11e1-8fa9-0008021de32e}\Shell\AUtOplAY\comMAnd - "" = G:\kqmg.exe
  O33 - MountPoints2\{da8b492e-0756-11e1-8fa9-0008021de32e}\Shell\AutoRun\command - "" = G:\kqmg.exe
  O33 - MountPoints2\{da8b492e-0756-11e1-8fa9-0008021de32e}\Shell\eXplore\COmManD - "" = G:\kqmg.exe
  O33 - MountPoints2\{da8b492e-0756-11e1-8fa9-0008021de32e}\Shell\opEN\commanD - "" = G:\kqmg.exe
  [2011/08/22 17:59:02 | 000,103,140 | ---- | M] () -- C:\eswatj.exe
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download  Sality Killer zip to your desktop and extract SalityKiller.exe

Run the utility SalityKiller.exe on the infected computer
A reboot might require after disinfection.

Download the file Sality_RegKeys.zip
unpack the file Sality_RegKeys.zip 
run the file Disable_autorun.reg from the archive Sality_RegKeys.zip

Once the scan is over, from the archive Sality_RegKeys.zip run the file of the registry key: 

under Windows 2000 run the registry file SafeBootWin200.reg 
under Windows XP run the registry file SafeBootWinXP.reg 
under Windows 2003 run the registry file SafeBootWinServer2003.reg 
under Windows Vista / 2008 run the registry file SafebootVista.reg
under Windows 7 / 2008 R2 run the registry file SafebootWin7.reg

[Pondus]

just adding some info

from malwarebytes log

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.

Sality is a file infector...

Virut and other File infectors - Throwing in the Towel?
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

[Bassem]

uh the OTL took more than 1 hour already and still working, is that normal?  

[essexboy]

Only if you have never emptied your temporary files.  Close OTL out and run the sality fixes please

[Bassem]

hey i just cleared my temp files now and the OTL worked but iam unable to download the sality killer with or without IDM

[essexboy]

I have just uploaded them to my skydrive here https://skydrive.live.com/?cid=32d8666f4048075b&sc=documents&uc=2&id=32D8666F4048075B%21117

[Bassem]

hey ive completed all the steps here, are there other steps or i can be sure that iam 100% sality free 

[essexboy]

Could you now download and install Avast then run a full scan and let me know if it finds anything at all

[Bassem]

i took 2 screen shots of the 15 infected files found by avast before deleting them, but they are
1.37 Megabytes does it mean i cant upload here?

[DavidR]

It would be too large, the image/file size for attachments is 200KB.

When saving screenshots, only capture the active window, save in .gif format (good enough for quality) and gives a smaller file size.

That said there is no need to do screenshots when you can copy and paste from the scan logs. For detection on on demand scans, check C:\Documents And Settings\All Users\Application Data\Alwil Software\Avast5\Log  (Windows 2000, Windows XP). Or C:\ProgramData\Alwil Software\Avast5\log (windows Vista, windows 7).

Also - Deletion isn't really a good first option (you have none left), 'first do no harm' don't delete, send virus to the chest (a protected area) and investigate.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

[Bassem]

i rushed to deleting them cause i dont use those infected programs anymore so i dont need them, but the problem is i still cant find the log file, iam using the latest version of avast by the way...