Unable to install Kaspersky

What should I do now?

Is this account the admin account?

Yes previously I was working with another account but when I ran Lop S&D, it showed me that
"All files cannot scan, you need to log as Administrator", so i logged as admin and again ran Lop S&D and then gave you the details of Lop.
But I used hijack this and MalwareBytes with nitin account (not admin). Didnt they worked properly? Tell me if I have to run both hijack and Malware again with admin, I will do it.

Yes, the fix worked fine, but if the account isn't admin, it won't allow a deep scan like catchme.

Please tell me what should I do now?

Okay.
Not an infection causing this, so lets look elsewhere.
Press Start > Run, type in cmd and press enter.
When the command prompt opens, type in:
netsh winsock reset
Press enter.

Reboot normally.
Try updating Avira now.

I did the same as you told, but Avira is not updating now too. I am using XP SP3.

Anything more that I can do?

Last edited by coolnitin on Tue Feb 10, 2009 1:40 pm; edited 1 time in total

Lets have a look around the registry for that DNS hijacker.

Download the Registry Search Tool from HERE

Unzip to your Desktop and double click on regsrch.vbs
(if you have script protection, please allow this to run)

In the dialog that opens, enter the following:
85.255.112.39

Press 'OK'

The search will run for a while then alert you when it is finished.
Press 'OK' and copy the contents of the WordPad window and post in this thread.

I am using XP SP3. And after running that vbs file, it showed a message:

"Search completed in 19 seconds. No instances found for 85.255.112.39"
or something like that.
then i clicked OK button and nothing came in wordpad.

Strange.
Lets try a different command.
Open the cmd window again, but type in this command:

ipconfig /flushdns

Note the space between the g and /

I did that and message came:
Windows IP configuration
Successfully flushed the DNS resolver cache.

But Avira is not updating now too.

Okay, lets see if this makes any difference.

Please download the LSPfix from here: LSPFix
Unzip it to the Desktop (Important!!) and run it. Check the box that says "I know what I'm doing", and then click Finish to allow LSPfix to rebuild the LSP chain.

I did that exactly as mentioned, there were 3 files in "keep" portion:
1- mswsock.dll (Tcpip)
2- winrnr.dll (NTDS)
3- rsvpsp.dll (protocol handler)

and i click finish after checking the box of "I know what I'm doing" then it showed a message :

Repairs complete:
0 namespace provider entries removed
0 namespace provider entries renumbered
0 protocol provider entries removed
0 protocol provider entries renumbered

So I clicked OK button there, but again still having the same problem.

Should I put any file in "remove" section?

No, doing that will cause you to lose your internet access all together.
I'm out of ideas, so I'm gonna move this over to internet and networking forum.

Then where should I go now or will you provide further help here only?

I'll be watching over the topic still, but my colleagues may have other ideas I don't, I specialize more in malware removal than networking.

Thanks Belahzur, I dont have any such problems in formatting again but I want to solve this. So I need your suggestions.

And Belahzur if I want to learn something from you, then will you help me?
I mean the way you find out virus name and then tries to remove it. I want to learn this.

Can anyone tell me, now what should I do?

You say your formating the drive and clean installing windows, yet when i look at your HJT log after the event your still infected.......something doesnt add up here!

Your either really good at contracting malware or your format install's are done the wrong way.

If you want to format correctly refer here:

http://www.cpusolutions.com/mm8004744CPU/HTML/Guides/Installing%20Windows%20XP%20after%20a%20Clean%20Format.htm

If you still cant install KS correctly then you have a bad file version of the software, or bad burn to disc if this is where you are installing from. (try mounting the image with power ISO or similar and install from there).

Buying a genuine version instead of downing cracked copies may also help if this is the case!


Regards