2 replies to this topic

[jholland1964]

Helping a lady clean up a used computer she received. Way of of date, running XP SP1
Loaded with malware. Have used Full Scan with MBA-M and it found and removed Vundo, Rapid Antivirus, MyWebSearch from the following;
Registry Keys Infected: 147
Registry Values Infected: 13
Folders Infected: 21
Files Infected: 111
Computer had/has eAcceleration software installed, the full package, Stop Sign AV, the firewall, anti-malware, everything. She didn't want it on there and began trying to remove it, first from Add/Remove. Blocked. Then from Start, All Programs listing, Blocked. We have now done the following;
safe mode file search which resulted in "cannot remove program in use message" , Killbox, Unlocker, File Assassin, Combofix with a CFScript being used also. Nothing removes it. It will appear the program is gone then she will run HiJackThis, doesn't show anywhere and then "bingo" there is the Stop Sign antivirus again popping up saying she has a virus and then all Stop Sign processes show up again in Task Manager. We were able to finally get the firewall to stop running via Services. I even "broke down" and tried to use their "special uninstall tool" available on their own web site, which I was hesitant to try because I didn't want to add another piece of their software for fear it too would be unremovable but...when I tried the download from their own website I get the message "bad link" "please report to webmaster" message. So I gave up there. Any suggestions from anyone?

[Tigger93]

Hello.

Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

Someone will be happy to assist you further with cleaning your system.

During this scan and cleanup process you should not install any other software unless requested to do so.

Please don't post your log in this topic or start another thread in this forum, but post them in the Malware Removal - HijackThis Logs forum linked to above.

[jholland1964]

Tigger93, on Jan 10 2009, 11:34 AM, said:

Hello.

Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

Someone will be happy to assist you further with cleaning your system.

During this scan and cleanup process you should not install any other software unless requested to do so.

Please don't post your log in this topic or start another thread in this forum, but post them in the Malware Removal - HijackThis Logs forum linked to above.

Sorry, her system failed and she is doing a reformat. Thanks for the response.