jimbo887

I have been working at this for the past 3 days searching various forums trying to disinfect my PC. Here are the issues I've found and what I've done about them to no avail. Any assistance is greatly appreciated. Thanks for advance.

1. Notepad won't open. When I attempt to review a .txt file, I get a data execution prevention message stating it is helping protect me against viruses.

2. My browser has been hijacked. I can open IE7 and navigate to search sites like google or yahoo.com, but whenever I type symantec or trend micro in the url or search field, I get diverted to some type of advertisement.

To resolve this: I have used browser hijack retaliator 4.5. I've tried some of the knowledge base articles on MS website. I modified the registry values as suggested to make sure there was no winsock corruption. Didn't work. I have tried just about everything. Nothing is working to bring it back to normal.

3. I can't run most .exe files downloaded to get rid of the spyware (I cant run HJT either).

To resolve this: I ensured the registry was set up properly to execute the files. I also found this exefile repair utility and that didn't work either. I tried everything in safe mode as well. Nothing

4. I can't update any of the definition files within the antivirus or spyware prevention applications I attempt to run. I have an internet connection but when I click the update buttons within the applications, the error states I should check my internet connection. I have been manually extracting the files and inserting them in the appropriate directories.

I know the computer had a virus because I disabled the NAV and ran the scanning tool that kaspersky has and it found some worms and some hidden objects in registry but that didn't resolve any of the issues mentioned above. I still can't use the browser, i still can't run any exe files, I can't open notepad, etc. Any help or recommendations is greatly appreciated. Thanks.

chauffeur2

Hello jimbo, Welcome to TSF! :Wave:

Please read this article… "Having problems with spyware and pop-ups? - First Steps"; follow the instructions very carefully; then, post all the requested logs and information; as instructed, in the HiJackThis Log Help Forum.
(Simply, click on the coloured links to be re-directed.)

Please ensure that you create a new thread in the HiJackThis Log Help Forum; not back here in this one.

When carrying out The 5 Steps, if you cannot complete any of them for whatever reason, just continue on with the next one until they are all completed.
However,it is extremely important to make mention of the fact that you could not complete any of the steps in your post to The HJT Help Forum; where an Analyst will assist you with other workarounds.

Once done, please be patient, as the Security Team Analysts are usually very busy; one of them will answer your request as soon as they can.

Good Luck with it.

Kind Regards,

__________________
Dave T.

Submit New Articles

Especially if Bill Gates had anything to do with it!!

tetonbob

@jimbo887 -

In your efforts to try various things, it's hard to say what might have happened to the machine and the OS. In some cases as this, it may be more time effective to perform a restore from the manufacturer's disks or restore partition, or format and install clean should you have the Windows installation media.

If you want to try to get some help before going down that road...

Since you say most .exe files will not run, try this instead.

Please do this:

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

1. Close all applications and windows.
2. Go to My Computer->Tools->Folder Options->View tab:
   * Under the Hidden files and folders heading, select Show hidden files and folders.
   * Uncheck the Hide protected operating system files (recommended) option.
   * Also make sure there is no checkmark beside Hide file extensions for known file types
   * Click Yes to confirm and then click OK.
3. Rename dss.exe to dss.com (right click on dss.exe > Select rename)
4. Double-click on dss.com to run it, and follow the prompts.
5. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt <-this one will be minimized
6. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt in your thread in the HijackThis Log Help Forum.
7. Please attach extra.txt to your post.

To attach a file to a new post, simply

1. Click the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
2. copy and paste the following into the "Upload File from your Computer" box:

   C:\Deckard\System Scanner\extra.txt
   

3. Click Upload.

What DSS will do:

• create a new System Restore point in Windows XP and Vista.
• clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
• check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

---------------------------------------------------------------------------------------------

__________________

** PC Safety and Security--What Do I Need? **

Proud Member of ASAP since 2005
Proud Member of UNITE since 2006

jimbo887

Thanks for the speedy responses. I completed the steps and the system appears to be stabilizing but I will wait on the recommendations from the txt files I uploaded to proceed any further.