Cannot even see Control Panel...Loaded with restrictions

[db10]

Sorry in advance if I missed something referring to this topic.  Maleware is certain, mostly causing IE to go where it wants IN ADDITIONS to restricting my access to places like the Control Panel.  Can't even use Add/Remove programs by going directly to appwiz.cpl.  Cannot download anything with this computer due to IE's "mind of its own regardless of which browser I am using.  Running XP Home Edition (friends computer) mine is win98SE and working if that will help me get her going.  I did read "steps to take before requesting assistance but they require doing things that require access to add/remove programs and running (and/or) installing such.  I can't even install a anti spy/adware program from a disk.  The "install wizard" stops just before or after the "accept agreement."  Note I am in "owner" mode and there should be no restrictions.  Any suggestions before I can attempt to start doing your preliminaries?  Thanks, Dan in NY.   

[evilfantasy]

Welcome to the Computer Hope Computer Viruses and Spyware Forum.

In order to help you clean any malware on the computer we will need some more information from you and about the computer. Please go to this thread and read the instructions for posting the required logs.

Once the logs are posted a member of the malware team will be along to assist you in further removal instructions.

[db10]

Thanks for the reply...unfortunately, I have read the "thread" and realize that you require certain information and that there are certain steps I should take prior to requesting help to "clean" this computer.  However, as my initial "Post" indicated, I am unable to perform the steps outlined in the "thread" for reasons stated in the original post.  Any help you can offer which will get me to a point of being able to submit the required information would be appreciated.

I will be off line for a while now but will check here when I come back.

Thanks again for any help you can give.  Dan

[evilfantasy]

Try to get the Hijackthis program installed. If needed download the installer then restart the computer into safe mode then run the installer and see if it will install like that.

Let me know.

[JPH]

Just a suggestion in case the install still fails...

Since you cannot install anything why not download the stand-alone HiJackThis.exe onto your machine and then transfer it to your friend's machine via a flash drive or something similar? Then manually create a new folder and place the HJT exe there and run it. You could then transfer the logfile it generates back to your machine using the same method and post it. That should at least get the ball rolling...

- JPH

[db10]

Thanks both of you.  Will give both suggestions a shot.  Seems that I tried starting in "safe mode" a few times but kept locking up.  Will come back as soon as possible.  Dan

[db10]

Hi again...When I try starting in safe mode, all I get are about two screens of drivers displayed and then all stops and locks up.  Have to power down to restart.  Tried "safe mode" and "safe mode" with prompts.  Both the same.

The ending screen is full and all lines are the same save for the driver name:

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS\System32\DRIVERS\driver name

Stop...Now after third time and long wait, kind of in "safe mode" but screen is blank except for "safe mode" in all corners and "Microsoft Windows...etc across the top.  No icons, nothing but black screen.  Pressing "Ctrl Alt Del" brings up the "Task Manager."  There are 11 processes running and no applications.  In XP, is it normal for "Ctrl Alt Del" to bring up the Task Mngr?"
I can navigate in the task manager.  Any of this tell you anything? tks, Dan 
 

[evilfantasy]

See if you can get this zip file to run. Do you have a flash drive to transfer it if needed?

Download to your Desktop this self-extracting ZIP archive FixPolicies.exe
 

• Double-click FixPolicies.exe
  
• Click the Install button on the bottom toolbar of the box that will open.
  
• The program will create a new Folder called FixPolicies
  
• Double-click to Open the new Folder, and then double-click the file named  Fix_Policies.cmd
  
• A black box will briefly appear and then close. This will enable your Control Panel, Task Manager and stop any Administrative warnings.
• Delete the FixPolicies files and folders.

.
Then see if you can get a Hijackthis log.

[db10]

Hi evilfantasy, Before anything else, a huge TY (one of many to come I'm sure) from me and my lady in TX.  I'm in NY.  I downloaded both "FixPolicies.exe" and "HiJackThis.exe"  After running FixPolicies, I didn't get sight of the Control Panel BUT, I was NOW able to open Add/Remove Programs (without "Restrictions" as I had last night) with appwiz.cpl.  Major advanecment SO FAR!  Had to put them on floppy from my sys as currently don't have CD-R and x-fer that way.  I have removed a few programs with a list of ???programs.  Have not rebooted yet, however, was now able to install SpyDoctor (in hopes that I might be able to get her sys on line) and it shows a load of problems.  If removal of these "bugs" is a step I should take prior to continuing with you, I will either have to get her sys on line or order the disk?  Pls adv.  I did download CCleaner...too large for floppy.  Can try to get a CD-R working in my sys if I can't use hers on line.  Your time means a lot to us...no flash Dr.. Dan       

[db10]

One last thing, do you think removing IE (since that is what keeps opening) might help me to get on line?  Or will any download probably get corrupted as long as I have this many problems?...Dan

[evilfantasy]

I would suggest to only use the tools in the removal instructions for now. They create logs which I need. The logs let me see what we are dealing with and in turn know the correct steps to take in removing everything.

You can post a Hijackthis log now if you can get that to run. I would like to see what is going on in case you run into any more obstacles.

[db10]

Ok, thanks...will try to do that now.  Be back as soon as I get something..Dan

[db10]

I hope this opens for you, will be here.  By the way, SD indicated I had 2.889 Infections Detected.  I haven't done anything else other than shut down SD and re-start.  Hijack opened without any problems but I have it in C:/ instead of Program Files...DB


[recovering space - attachment deleted by admin]

[evilfantasy]

This is the worst I have see in a while.

Please download Combofix by sUBs from one of the below links.
(Try all three if necessary)

• Link #1
  
• Link #2
  
• Link #3

Important! Combofix.exe MUST be saved to and ran from the Desktop.

• Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
• Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
  • Click this link to see a list of security programs that should be disabled and how to disable them.
    
  • If yours is not listed and you don't know how to disable it, please ask.
• Warning: Combofix disconnects your computer from the internet. The connection is automatically restored before Combofix completes its run.
  
• Double click combofix.exe & follow the prompts.
• 
  
  • From the keyboard select 1 and press Enter[/COLOR]
  • When finished, it will produce a log for you.
  • Post that log in your next reply.
  Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall
  
  • If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
    
  • Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.
  .
  ----------
  
  Create An Uninstall List
  • Start HijackThis
    
  • Click on the Open the Misc Tools section
    
  • Click on the Open Uninstall Manager button.
    
  • Click on the Save list button and specify where you would like to save this file and click Save.
    • When you press Save button a notepad will open with the contents of that file.
  • Copy and paste that list in your reply.
  .
  ----------
  
  Run a new Hijackthis scan and post the log.
  
  ----------
  
  Next post please add
  Combofix log
  Uninstall list
  New hijackthis log

[db10]

Good morning,
?: "Combo Fix will reconnect to the net prior to completing its run"  Does this mean that Combo Fix "has" to connect to the net to complete its run?  If so, I will default her sys to my dial-up.

I haven't "connected" with her sys since we started working on this as when I do, I immediately get no less than 8 to 12 instances if IE popping up making it impossible to go to any site I try to address.

I've downloaded Combo Fix to my sys, now all I have to do is get it to hers.

Please adv. and thanks again...Dan