Lots of problems with Laptop, Windowx XP

[slafa23]

My sister is having lots of problems with her Dell Laptop. It is occasionally not booting up all the way after reboots and she says she is getting "virus protection" messages. Also, her Windows Automatic Updates are set on off, and I can't turn them on. Even when I do it manually, it won't change.
Is there a good anti-virus software I could download? Or maybe some sort of error checking software to see what the heck is wrong with this machine?
Thanks.

[slafa23]

More about the "virus" messages-
Apparently, an internet explorer box pops up and shows it is "running virus scans" and when it finishes, it gives a link to purchase the program.

[slafa23]

So it clearly has a virus. When I tired to google and download Spybot, it went right to "StopZilla."
Any advice?

Also, should I post this in another area of the forums?

[patio]

Actually she has most likely somehow contracted a form of virus we refer to here as "Scumware"...
This is a small program that runs alleged scans and says the only way to fix your issues is to send them $39.95 and all will be right with the World...

Clik Here  and follow the instructions for posting your logs and one of our Malware Removal Specialists will be along to assist.

I'll move this to the proper section.

[slafa23]

Ok I am starting to work on this but I am going to need some help. There's Mcafee on the system so I am running a virus scan.
In the add or remove programs window, there's a program called "Advertisment Service", which sounds kind of sketchy to me.
Any advice?

[evilfantasy]

I don't see that exact term in the unwanted list but there are some that are abbreviated with the same name. I would remove it. http://www.bleepingcomputer.com/uninstall/Cat-A.html

[slafa23]

That link didn't work.

[slafa23]

When using Mozilla Friefox, I would use Google to search something. When I click on a link, I get "hijacked" and brought to the website that has the "virus scan." I really don't know where to start with this.,

[evilfantasy]

Click Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

• Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.
  
• Then search for TDSSserv.sys
  
• Let me know if you find this or not.
• If you do find it, right click on it, and select “Disable”. Do not try to uninstall it.
  
• Also if this is found and you disable it.
• Now reboot and see if you can run the other scans that would not run.

[slafa23]

I did have the TSDserv on there. It had an "!" on it. I disabled it and rebooted.

A lot of things keep happening, among them:
An error message for an "invalid picture" and MSN just tried to install something without me pressing anything...

[slafa23]

The first error message I just talked about is...
"Rendll32.exe-Bad Image. The application or DLL C:\WINDOWS\system32\sawubiyi.dll is not a valid Windows image. Please check this against your installation diskette."

also, I get a...
"Error loading C:\WINDOWS\system32\sawubiyi.dll %1 is not a valid Win32 application"

[evilfantasy]

Those are all part of the virus. Do this.

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.

For Windows XP Systems install the Recovery Console:

- If you are using Windows XP and do not already have the Recovery Console installed, please ensure your Internet connection is active (if possible) and click Yes.
- If for some reason your Internet is not working click No.
- If you are not using Windows XP, you will not be prompted.
- When prompted to accept the EULA click OK.
- Accept Microsoft's EULA (Click Yes).
- When you are told that the RC is installed correctly click YES to continue scanning for malware.

When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

[slafa23]

Will this repair the error messages?

[evilfantasy]

This is usually a multiple step process. Each step we take will get you closer to being malware free.

[slafa23]

Ok. Out of curiosity, what is the TDSS thing. Becuase it appeared as a "problem" on a Spybot search.