Ok, I have Windows XP SP2 and my mom really got some bad stuff on here. She didnt know to install any kind of antivirus software and i think she opened a bad attachment or something.
When you boot in normal mode, it uses active desktop to display some kind of fake spyware removal software, and you get popups for some link it wants you to click. Its hard to get anywhere on the start menu because its like it cycles something and every few seconds it closes explorer.exe and then opens it again, so its like the desktop icons and startbar flicker.
I cant run task manager to manually stop these, as it says its been disabled by administrator. Of course what has actually happened is thet spyware put this key in the registry to disable it. I went in there, but the minute i delete that key, it reappers.
If i open some form of application, like regedit or command window, etc it will work and stay open, but eventually nothing else will. i cant get windows explorer or any browse function to work.
i was able to use the run command and install lavasoft adaware which finds 326 items in 4 categories, including 2 trojans and 1 worm. When i go to remove them it wont, they just keep staying in the screen.. im assuming its because they are locked into some kind of windows service or something, so safe mode is the next try.
However, safe mode doesnt work.. after i log in, i just see the safe mode writing in the corners and the desktop/start bar never shows up
any ideas on what to do?
rebuilding would be a last resort for me, i want to help my mom out but im so busy that im hoping a way to clean, protect and just give her the machine back, i dont want to have to rebuild one right now
thanks!
Related posts:
4 responses so far ↓
1 Matt Rizos // Sep 18, 2008
Sure. Download, Install, Update and do full scans with the following applications in this order:
MalwareBytes (installs, updates and scans in safemode with networking)
AntiVir (installs and scans in safemode)
SuperAntiSpyware (install this in normal bootmode)
I have them all right here:
http://remove-malware.com/downloads
Remove any malware these applications find. You should be done after that.
2 cotojo // Sep 18, 2008
The following programs have high success rates in removing this parasite:
Remove Restrictions Tool:
http://www.softpedia.com/progDownload/RRT-Remove-Ristrictions-Tool-Download-68926.html
Download from Softpedia Secure Download (RO), install, run and check all boxes then click Apply and then reboot. This tool re-enables what codecs/viruses have disabled.
Malwarebytes Anti-Malware:
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?hhTest=1.
Download, install, update and select Full Scan.
Remove all infections that it finds after scan.
Spyware Doctor Free Basic Edition - Realtime monitoring:
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&ciNum=12
Its free with Google pack, untick all boxes except Spyware Doctor. Download install, update and run.
SmitFraud Removal
This tool will remove Desktop hijacking malware. Firstly, download the removal tool from here:
http://siri.geekstogo.com/SmitfraudFix.php
then follow the instructions on the same page
Spybot S&D:
http://www.safer-networking.org/en/download/index.html
Download, install, update and Immunize, turn off Tea Timer then click 'Check for problems' then when complete select all and then 'Fix Checked'
Open Spybot, click on Mode, select Advanced, click on Tools then Resident and untick Resident 'Tea Timer'
Do NOT untick Resident 'SD Helper' as that is your protection.
SUPERAntiSpyware Free Edition:
http://www.download.com/SUPERAntiSpyware-Free-Edition/3000-8022_4-10523889.html
Download, install, check for updates, then select Scan your Computer, select your drive and select Perform Complete Scan
Install Avast anti-virus better definitions, anti-spyware and anti-rootkit built in, faster and more reliable:
http://www.download.com/Avast-Home-Edition/3000-2239_4-10019223.html?part=dl-AvastHome&subj=dl&tag=button&cdlPid=10852750
Setup Guide:
http://tinyurl.com/5lxy24
When setting up select perform Boot Time Scan which will scan the boot sector on reboot.
3 boarddesigner // Sep 18, 2008
Hello,
Yes, my mother in law had the same problem. There are some real bad people on the internet that prey on the unkowing. What it sounds like is the Vundo or Virtumundo virus. If you can get to the internet you can download eitther virtumundobegone or Vundofix.
Also, the files that are infecting your machine will be in C:\windows\system32 directoy. Typically you can catagorize by date and find the culprits. In the case on my mothers machine the files were named: OqppoYay.ini
It was not fun. Good luck and Gods speed
4 Ooops // Sep 18, 2008
Sounds like xp 2008/2009 Go to this site for details. http://www.bleepingcomputer.com/malware-removal/remove-antivirus-xp-2008
Leave a Comment