11 replies to this topic

[Sharley14]

My computer displayed screensaver saying my computer was infected,and I needed to buy more antivirus soaftware.Which I allready had bought and installed antivirus software.I couldn't get rid of screensaver warning.Computer seemed to be runing fine,except aradio station or something I don't know where it was coming from,Youd hear it through the computer even if you wasn't even logged on.It would just start talking when it wanted to and stop when ever,Weird.Eventually the computer just quit responding.And the other computer I had connected to it sharing network did the same thing.Is there anything I can do to fix it.A technition says he can wipe harddrive and fix it. If I bring him the computers and he wants $100.00 ahr for each computer.can someone help me please?

[exile360]

Greetings and welcome to the forum.

To get you fixed up please read the instructions here: http://www.malwareby...?showtopic=2936
and post your logs in a new topic here: http://www.malwareby...php?showforum=7

Please be sure not to install any software or use any removal/scanning tools exept those that you are instructed to by the expert who will be assisting you as doing so can make their job much more difficult.


I hope I was helpful.
Good luck and safe surfing.

[exile360]

If the computer isn't functional enough to follow the above steps, please let me know and I'll help you get it to the point where you can.

[Sharley14]

exile360, on Dec 20 2008, 07:22 AM, said:

If the computer isn't functional enough to follow the above steps, please let me know and I'll help you get it to the point where you can.

[Sharley14]

No the computers are not functional enough to follow those steps you recomended.

[Sharley14]

exile360, on Dec 20 2008, 07:22 AM, said:

If the computer isn't functional enough to follow the above steps, please let me know and I'll help you get it to the point where you can.

[Sharley14]

Sharley14, on Dec 20 2008, 08:06 AM, said:

No the computers are not functional enough to follow those steps you recomended.

[nosirrah]

I do not know how advanced you are but this can work .

Install windows into a second windows folder (DO NOT ACTIVATE THIS COPY OF WINDOWS) .
Boot into this temp install .
Copy the infected registry to a safe location and then replace it with the one stored in C:\WINDOWS\repair (this is the default first run registry copy) .
Boot into the infected install , it will now be functional but because the registry is default all of your applications will be broken (we will undo this later) .
Download , install and run several malware cleanup tools . Without their load points all of the malware will be easy to remove .
Boot back into the temp install .
Move the infected registry back to its home on the infected drive .
Boot into the infected drive in safemode .
Run reg cleanup tools and load point check tools like CCleaner and Hijackthis to clear out all of the load points that now point to nothing .
Boot into regular mode and delete the temp windows install making sure to correct boot.ini .
At this point the system might not be clean but it should be functional enough to work with .


I left out a LOT of info here because if you get all of this its very likely going to work for you and fix the issue , if not you are better off looking to a repair shop .

[exile360]

Hello again Sharley14, if you can't do what nosirrah suggested, then please try to download the Avira Rescue CD from here: http://dlpro.antivir...cd/rescuecd.iso

Then open the .iso file with Nero or whatever software you use to burn CD's.
If you don't have Nero or a similar application installed, then please
download the .exe version of the disc here: http://dl.antivir.de...cd/rescuecd.exe
It will allow you to burn it to disc, just run the rescuecd.exe file.

Once the disc is burned, boot the infected computer with that disc in the drive.
Select option 1 to boot into AntiVir Rescue System.
Click on the British flag on the lower left to switch to English
Proceed through the settings and be sure to select the option to scan and remove infections.

[Sharley14]

exile360, on Dec 20 2008, 09:20 AM, said:

Hello again Sharley14, if you can't do what nosirrah suggested, then please try to download the Avira Rescue CD from here: http://dlpro.antivir...cd/rescuecd.iso

Then open the .iso file with Nero or whatever software you use to burn CD's.
If you don't have Nero or a similar application installed, then please
download the .exe version of the disc here: http://dl.antivir.de...cd/rescuecd.exe
It will allow you to burn it to disc, just run the rescuecd.exe file.

Once the disc is burned, boot the infected computer with that disc in the drive.
Select option 1 to boot into AntiVir Rescue System.
Click on the British flag on the lower left to switch to English
Proceed through the settings and be sure to select the option to scan and remove infections.

[Sharley14]

I did every thing you said .after I scan the computer with the rescue cd what do I do?I still cant start windows so I can log on to the computer

[exile360]

Hello again, to use the rescue cd to disinfect the computer, please boot from it again and select option 1, then when it loads the main screen select english by clicking the British flag, then click the button on the upper left that says Configuration. Once in the configuration menu, select Try to repair infected files and under that select the check box that says Rename files, if they cannot be romoved?. Leave all other settings as they are and then click the Virus Scanner button on the upper left and click th button on the bottom that says Start scanner. Hopefully this will help (due to my lacking instructions, I don't think you had the cd set to remove what infections it found). Sorry about that, they recently changed the cd's menu structure and I hadn't familiarized myself with it. Let me know if it helps.