[SOLVED] Virus, cant run spybot, hijackthis, or any other spyware, no taskmanager

[dgolden]

I have a client running a winxp computer and he got some kind of nasty virus. Now I have tried everything but the kitchen sink that i know of. It seems to recognize any spyware programs or AV and disables or deletes the exe as soon as it shows up. It continuously pops up the beloved browser windows and "your computer is running slow" threats with a strange desktop background saying about the same. When trying to run spybot or hijackthis it does nothing as there is no executable. I cant open task manager and the run entries in registry show no suspicious tasks. I can't even do a search for spyware related stuff as it redirects to some ominous search page. Running in safe mode is no help either because it still runs. Im guessing its attached itself into winlogon or something. This seems to me a new breed, usually its not much of a sweat to get rid of some shoddy hijacker, but some time went into this one. Sorry I have no logs to go from but any help to even get that far would be nice. Thanks

[dgolden]

Ive now tried various anti root-kits with various errors. Including Sophos which even when logged in as admin, says it cannot access hard drives or registry due to permissions. I double checked those and obviously admin has full rights.

[lorjack]

See if you can get to the internet and try to access this site: http://housecall.trendmicro.com/

It is an online virus scanner that i have had very good experiences with. It is free so you don't have to sign up or any of the that other stuff

[MIcred]

I was called by a friend who had a similar problem. The product was called Total Scan 2009 or something like that. It has a fake windows logo on it. It pops up a notice that you have a file called win32.bho on your machine. Then it flips you to a site that *automatically* runs a graphic that makes it look like its scanning your computer. Then it of course tells you have several viruses and you need to buy a product to get rid of them. I opted out of all that and still got a nagger saying "your computer is steel not protected" (actual spelling - so I'm thinking whoever coded the virus doesn't speak English very well).

My guess is its a trojan of some kind. The taskmanager was greyed out from the taskbar
The program files link was removed from the xp start menu. Whenever you opened the internet the fake spyware detector thingee started up. If you close it it starts another one. I uninstalled it from add and remove programs and rebooted - no help there.

I accessed the running processes by switching the start menu back to "Windows Classic Start Menu" where the program files could still be accessed, then went to accessories - system tools - system information. As noted by dgolden, I saw no unusual processes or randomly named files replicating themselves in the running processes.

I decided to run a system restore to a few days back before my friend got the virus. Interestingly, the system restore program did not offer any previous dates, and i could not move the monthly calendar either back or forward. Then in the suggested restore times, it would only show the time the virus was installed (calling it the "last good"), so that if you do a restore it uselessly restores it only to when the virus was installed.

It's going to take some deeper weed pulling to get this one. The process has to be identified, located and removed along with any registry changes.

[dgolden]

I did try the trend housecall prior to post. It won't let me get there. As with searches on anything related to spyware redirects to ominous search pages.(yes i tried typing housecall.trend.com directly in run) I have seen and removed plenty of spyware/rootkits in the past, but this one doesn't allow you to do anything in any way to remove it. As previously posted, it does not affect program files or any other executables that don't have any heuristical scanning. This is the first time I have seen one that I cannot manipulate and remove. This one appears to be nowhere. There are no extra systray icons except the warning that you are infected. And a warning on the desktop, and also constantly wants to open browser pages. I have had it unplugged from my network, just trying to see if i can do anything before reformatting. Programs tried:
Sophos, a couple small anti rootkits i found from searches, spybot, symantec, trend, hijackthis, combofix and some other random apps, most won't even run. Sophos actually runs, but will not scan, it gives a disk access permission error. Thanks to you guys trying to help.

[dgolden]

In addition, I've also tried glorified task manager apps like SysInternals Process Explorer which i've used for years. When trying to run that its a little different. You get the small grey application error. In any case it won't run. Im now getting paranoid about using a floppy or usb key to transfer these apps back and forth.

[dgolden]

Well after a couple days of pondering and having a couple of my peers look it it with an expression of just "wow" I finally ended up just reformatting. Although it would not let me format within windows because it wouldn't let me dismount the drive. Whatever this was locked my disk. I just used the windows xp cd and so far seems ok.

[QtoTheBall]

LOL, formatting the hard drive is considered a solution to this post? Maybe you guys should removed the SOLVED from the threads subject

[koala]

I agree, formatting is not an ideal solution, but the SOLVED tag is there so we don't waste time reading a thread that doesn't need any more replies. If dgolden posts back saying he still needs help with this problem, the tag will be removed.

[scorpionlgr]

I have the same problem in one of my PC's, are you going to deleate this comment if I ask for help, it is 2009 now, maybe there is a new solution?

[koala]

scorpionlgr, if you think your computer is infected please follow these instructions and start a new thread in the Virus/Trojans/Spyware forum where an analyst will help you as soon as possible.