PC Infected with 'popup' virus

[LynnJ]

Hello
I booted up my desktop last weekend and found that I just got a series of error messages everytime I tried to run any program eg "McAfee services has encountered a problem and needs to close". Disabling the startup items with the system configuration utility at least helped me to get into My Computer so I could view files. I can't access the internet and could not boot into Windows Safemode either via F8 or with system configuration utility.

A typical (cropped) screen dump is attached.

I followed the 'Malware removal steps with very limited success:

None of the Antivirus programs would run:
Avast due to no internet
AVG - 'something bad happened error message'
Antivir Personal - no Windows installer enabled

I had previously run A-squared and Combofix - logs are attached

I ran CCleaner as directed

SAS would not run due to no internet.

I got the dreaded popup when trying to run MBAM (see screen print)

Couldn't check / update Java due to no internet

Hijack This wouldn't run - again due to a popup

Any help would be gratefully received.

Thanks LynnJ


[Saving space, attachment deleted by admin]

[harry 48]

please try this

Hello and welcome to Computer Hope Forum. The first thing I will need you to do is to go to this link and follow the directions precisely.


 If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected.


 If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

 If you can't run any step, just jump to the next one. Please let me know how you are doing or have any questions. Initially, We will need the SuperAntiSpyware, MBAM and HJT logs. Please post any logs that you can generate

[LynnJ]

Harry
Thanks for your prompt reply. I had previously run through the procedure in the links but (as explained in my posting) I was not able to run SuperAntiSpyware, MBAM and HJT

SAS would not run due to no internet.

I got blocked from running MBAM (see screen print) and HJT due to the popup.

If I could somehow get the internet back again I can run SAS.

I am successfully using a good computer with a memory stick but was not aware previously of the shift key tip.

[harry 48]

I am successfully using a good computer with a memory stick

if you can download sas ,mbam and hjt to it and run on your pc and post the logs

re-name mbam.exe to mbam2.exe and run

re-name hjt to sniper.exe and run

then try sas

[evilfantasy]

Command switches used :: /stepdel

Where did you get this fix from?

[LynnJ]

Re: Command switches used :: /stepdel      Where did you get this fix from?

I don't know - I had followed a series of suggested steps on the Malwarebytes site with little success before finding this forum.


However things are going from bad to worse.
I renamed MBAM as requested and attempted to run it but the PC crashed.
Now I can't boot up at all - the PC goes into the windows screen to select safemode or normal but the keyboard arrows don't work so I have to wait for the normal mode count down.  Windows then starts but freezes at the initial windows screen.
I tried inserting the XP disk but can't select CDROM as there is no response to the keyboard 'enter key'.
I can however get into BIOS via the keyboard DEL key.

I think I may have to do a fresh Windows install?

I need to rescue data from the current hard drive first ( maybe I need to buy a new hard drive for the fresh install?)

I would welcome your suggestions for next steps.

It's tempting to get my biggest hammer out...

[evilfantasy]

Is the keyboard plugged into the tower or is it plugged into something like the monitor?

[Dr Jay]

User's topic on Malwarebytes: http://forums.malwarebytes.org/index.php?showtopic=37440&hl=

[LynnJ]

Is the keyboard plugged into the tower or is it plugged into something like the monitor?

It's plugged into the tower. I have tried different USB sockets with the same result.

[evilfantasy]

Even if you were to need a reinstall you need the keyboard but it isn't loading up like it should so you couldn't even do that.

Since this 'might' be a McAfee issue can you try completely uninstalling it to see if the issues go away?

I'm not seeing anything in the logs that indicate this is malware blocking your functions. Although that does not mean the computer is clean.

None of the Antivirus programs would run:
Avast due to no internet
AVG - 'something bad happened error message'
Antivir Personal - no Windows installer enabled

How many antivirus do you have installed? Remember, only one at a time or it will cause issues.

[LynnJ]

I only have McAfee installed.

 I tried to run the others as part of the 'First step' process suggested by Harry 48 but none of them would run.

Thanks for the suggestion about deleting Mcafee - I'll give it a go.

Should I just delete the Mcafee files / folder via an emergency boot disk?

I am now away for 3 days so won't be able to make any progress until Sunday / Monday

[evilfantasy]

Should I just delete the Mcafee files / folder via an emergency boot disk?

If that is the only option then yes.

Do you have your XP CD to try a Repair Install? http://michaelstevenstech.com/XPrepairinstall.htm

[LynnJ]

I finally managed to get my keyboard working by changing the BIOS settings.
A repair install didn't work so I have ended up doing a fresh install of XP.
Thanks for all the suggestions of help.

[evilfantasy]

I think it was coming to that anyway. Something was really messed up and figuring it out might have taken days.

Glad you got it figured out. Be sure to secure your new install now.

Use the Secunia Software Inspector to check for out of date software.

* Click Start Now
* Check the box next to Enable thorough system inspection.
* Click Start
* Allow the scan to finish and scroll down to see if any updates are needed.
* Update anything listed.

----------

Go to Microsoft Windows Update and get all critical updates.

----------

If you are using or have installed IE6 you are using an outdated and soon to be unsupported version of Internet Explorer and I strongly suggest you update to the latest version directly from Microsoft Internet Explorer 8: Home page.

----------

I recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no realtime protection so will not interfere with each other. They do not use any significant amount of resources (except a little disk space) until you run a scan.

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[LynnJ]

Thanks for your suggestions - I'll take them on board as I don't want to have the same experience again.

One question; I already have AVG anti virus installed - will that clash with any of the software you have suggested?