"Spyware Protection" Malware

[speters61]

I have what appears to be malware on one of my pc's.  It removed all of my data files from the desktop, opened a window that looks like a virus protection program called " Spyware Protection". Then it popped up a firewall alert warning me that it detected a leak of my files to the internet (I find that odd since i unplugged the internet as soon as it popped up).  It then disabled my ability to open executable files. It gives a taskbar warning that the program won't open because it is infected with the w32/blaster.worm

It seems to have added an application called "Defender" to the C:\Documents and Settings\User\Application Data folder.  I can't delete this file. I tried to run taskmgr.exe but it's blocking executable programs.

I downloaded and copied * Rkill.exe,* Rkill.com,* Rkill.scr onto a CD and tried to run them from the CD and the desktop of the infected PC.... No Luck.

I then attempted to boot my PC in Safe Mode but my usb keyboard would not work on the boot screen. I was unable to arrow up the the boot safe mode.

What Next. I'm out of ideas. 

[jcmack]

Your comment has been removed. Please do not post malware advice, or post here in the malware forum, unless you need help.  If you want to help, please go here. Superdave.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
**********************************************

We are going to be using a Windows Recovery Environment to help disinfect the system so it may boot again.

Download the OTLPE Standard REATOGO Windows Recovery Environment.

• Place a blank CD-R disc in to your CD burning drive.
• Download OTLPEStd.exe and double-click on it to burn to a CD using an ISO Burner. One can be found here.
  
• Reboot your system using the boot CD you just created.
• Note : If you do not know how to set your computer to boot from CD follow the steps here
  
• Your system should now display a REATOGO-X-PE desktop.
• Double-click on the OTLPE icon.
  
• When asked "Do you wish to load the remote registry", select Yes
  
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  
• OTL should now start. Change the following settings
  
• Change Drivers to Non-Microsoft
  
• Press Run Scan to start the scan.
  
• When finished, the file will be saved  in drive C:\_OTL\MovedFiles
  
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.