BAD virus. can't open hijack this, firefox or any other apps.

[landa321]

This thing has taken over! I am posting from another PC since I can't go online on infected computer. Please help!

Total security has installed itself, as well as Windows Antivirus Pro.

I can't open regedit, task manager. I am able to use IE, although it is redirecting some sites.

I started in safe mode and it still won't allow me to open regedit.

I am not able to use hijack this.

Running XP Pro on infected PC.
thanks

[SuperDave]

Download HijackThis from this site to the computer you're using now. Burn it to a CD-RW and load it on your infected computer. Make sure you change the name from hijackthis.exe to something else and try to run a scan. If you're successful, copy the post here. Transfer the log to your good computer using a CD-RW.

[landa321]

hijack this is opening and i am able to run it, but as soon as it runs the scan, the malware closes hijack this.

i have to install hijack this for it to work, right? as soon as i install it, i change the name of the exe file, but the malware still closes the program as soon as it scans.

[Karnac]

Try run it in safe mode....

[landa321]

ok, tried in safe mode. same results. this is a bad one i think

[Karnac]

Have you attempted to run Malwarebytes and Superantispyware at all?

Try transfer the setup files via USB stick to your infected machine, then run them in safemode.

[landa321]

ok all bad news.

first... let me say that when i boot up in safe mode, it now asks me whether i want to log in as adminstrator or as my regular user login. i did not even have an admin user set up before.

i tried to do what you said while logged in as admin and it says "cannot access the path" and "you may not have the appropriate permissions to access the item" when i try to access the setup files on the usb.

i tried to do what you said while logged in as my regular user and here is what happened -
malwarebytes... it opens up, but as soon as it starts to scan, the program closes.
super anti- this one i can't even install because it says i have an older version installed and i can't install the new version unless i uninstall the old version. i try and try and try to install the old version but it won't let me.

also - i did change the names of all the exe files before executing them.

this is bad.

[landa321]

i ran Avira Rescue CD. it found hundreds of infected files and renamed them.

now my PC won't start up... not even in safe mode. what to do?

[landa321]

my system is a mess now. i was having better luck before the Avira scan.

When i try to start up now, it is saying "Windows could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Did Avira wipe out my HDD?

[SuperDave]

Can you boot from your Windows CD?

[landa321]

Tried booting from Windows Cd and I get this:

This computer is already in the process of being upgraded to Microsoft Windows. What do you want to do?

*To continue the current upgrade, press ENTER
*To cancel the current upgrade and install new version of Microsoft Windows, press F10
*To exit Setup without installing Microsoft Windows, press F3

What do I do here? I can't lose what is on my HDD. I have hundreds of important photos. everything else i really don't care about. just the photos.

[SuperDave]

That's strange. When you boot from the Windows CD you should get two options: To re-install Windows or to do a repair. Just to be on the safe side can you put your HDD in another computer as a slave and recover your important information?

[roserose]

Take it to a professional? srry no help

[landa321]

I bought a HDD enclosure and connected the infected HDD to this laptop and my files all appear to be OK. if I transfer all my jpgs to a new hard drive..

1. will those jpgs on the new hard drive be safe?

2. should i then try to fix the existing infected HDD or just reformat and start from scratch?

[Archer]

"Windows could not start because the following file is missing or corrupt:
\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Try this link. And if it helps to boot from the infected HDD:

malwarebytes... it opens up, but as soon as it starts to scan, the program closes.

You might need to create a different account, boot into it and run Malwarebytes Anti-Malware and SUPERAntiSpyware from it (and after you reboot after the request the new account most likely gets 'killed' too, so you'll have to create another new account to run the next scan if the previous does not help).