been infected with antivirus xp 2008 can't get pass log in screen

[sodbuster2x]

now I have my I cons up on screen

[evilfantasy]

OK, open your antivirus and do a scan and let it fix what it finds.

If that doesn't work go to Start > All Programs > Accessories > System Tools > System Restore and choose a Restore Point to before this happened.

Then go here and follow the steps http://www.computerhope.com/forum/index.php/topic,46313.msg290095.html#msg290095

[sodbuster2x]

I still have this antivirxp08 program that will not delete

[evilfantasy]

Without the logs I can't help. I need to "see" what is infected and where to help you remove it.

[sodbuster2x]

I hope this works sending you this log because it will not let me copy and paste. Sorry for taking so long to get back to you going to install last steep now of hyjack


[recovering disk space -- attachment deleted by admin]

[sodbuster2x]

Thank you, rhank you it took out xp antiviri08 finally computer is running a hole lot better. could you recommend a good program mc Afee or something?

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Disable Spybot's TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can also interfere with HijackThis fixes Please disable TeaTimer for now until you are clean.

1. Right click Spybot in the System Tray (looks like a calendar with a padlock symbol). Choose Exit Spybot S&D Resident
2. Run Spybot S&D
3. Go to the Mode menu, and make sure Advanced Mode is selected.
4. On the left hand side, choose Tools > Resident
uncheck Resident TeaTimer and OK any prompt and Restart your computer.

Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

----------

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

- O2 - BHO: (no name) - {395058E2-6B1D-415C-9F2B-D5E2B3BF1334} - C:\WINDOWS\system32\jkkIBQih.dll (file missing)
- O2 - BHO: (no name) - {5151d1e3-7d95-44e9-b329-29e178e19d4e} - (no file)
- O2 - BHO: (no name) - {A481C9BE-5B42-4ACC-A6DA-A51140BB2A66} - (no file)
- O2 - BHO: (no name) - {BFBE97FA-87A1-4C36-BFFC-32080D79ACA0} - (no file)
- O2 - BHO: (no name) - {F7E31739-AD66-4BEB-A33A-81490746DBAC} - (no file)
- O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
- O20 - AppInit_DLLs: nhdrsi.dll jsxzkf.dll
- O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)

Important: Close all open windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Go to Start > Run and type Notepad.exe then click OK.

Copy and paste the following text within the code box into the new Notepad file.

Code: [Select]

@ECHO OFF
sc stop "MyWebSearchService"
sc delete "MyWebSearchService"
sc stop "Viewpoint Manager Service"
sc delete "Viewpoint Manager Service"
exit
In Notepad select File and Save as
Choose the Save to location to be the Desktop and for the File name: type in fixme.bat making sure that the Save as type field says All files.

Next double click fixservice.bat to run it.
A black box should open and close after a short time, this is normal.
Do not continue until the black box has closed
Delete fixservice.bat from the Desktop.
Restart the computer.

----------

Download ViewpointKiller.zip

• Unzip the program and all of the contents of ViewpointKiller.zip to a location such as your desktop.
  
• Double click the ViewpointKiller icon to run ViewpointKiller.exe.
  
• Select the File menu, and select Check to see if you have Viewpoint installed.
  
• If ViewpointKiller indicates that any of the Viewpoint variants are installed, select the proper Kill option in the File menu.

• Follow the prompts and instructions very carefully, answering Yes or No depending on which option you are most comfortable with.
  
• The MsConfig instructions are very important, so be sure to read them carefully.

• Note: When done with ViewpointKiller right click and delete all files that were unzipped.

.
----------

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

[sodbuster2x]

I have tried everyway I can to diable my antispy ware but I must be missing something because it keeps tell me can't down load combo fix antivirus running-geekgoto.com

[evilfantasy]

Which one is blocking the download?

[sodbuster2x]

that is my problem it says your internet security has blocked this download. I do not know what to look for.

[evilfantasy]

Try downloading it with a different browser.

[sodbuster2x]

here is the combo log and new hijack log I used a different browser must have been firefox that kept it from downloading

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Please disable TeaTimer now and leave it OFF until we are done cleaning the computer.

1. Right click Spybot in the System Tray (looks like a calendar with a padlock symbol). Choose Exit Spybot S&D Resident
2. Run Spybot S&D
3. Go to the Mode menu, and make sure Advanced Mode is selected.
4. On the left hand side, choose Tools > Resident uncheck Resident TeaTimer and OK any prompt and Restart your computer.

Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

----------

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O8 - Extra context menu item: &Search - ?p=ZSfox000

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis and restart the computer to register the changes made by HijackThis.

----------

How is the computer now?

[sodbuster2x]

computer seems to be running like it should now thank you thank you

[evilfantasy]

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide
.
----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.