"Your System is Infected"

chiapped · 08-17-2009, 12:26 PM

First off, I want to say thanks for taking the time to offer your service. I read the rules for posting, possibly too late as I have already tried certain tricks that seem to have made things worse, but I still hope there is a chance for my laptop. Also, I apologize ahead of time for my ignorance in this sort of thing, I will try to be respectful and helpful and can hopefully learn something from all this.

I recently got some sort of spyware on my computer (7 year-old Toshiba Satellite) that hijacked the desktop background with the title message and a blue screen. From what I understand, I am not the only one. However, in trying to get rid of it, I ran a couple of anti-virus and anti-spyware (AVG Free, MBAM) programs that got rid of the toolbar pop-up which was trying to sell a "windows" program to remove the spyware, but did not correct the background. I tried to get into safe mode, but the virus did not allow this, so I used SafeBoot to get into safe mode. However, since the virus will not allow Safe Mode, my computer is stuck in an infinite reboot cycle no matter which selection I choose on the start-up screen. Since I cant get into windows or any other command prompt, I am at a loss for what to do. Any help is much appreciated. Thanks.

Also, to complicate matters further, my CD drive is inoperable.

Ried · 08-22-2009, 10:57 AM

Hello chiapped,

What Safeboot utility did you use?

chiapped · 08-24-2009, 08:24 AM

I believe the program was just called "SafeBoot." I found it through a help forum and thought it would be useful in my situation before I read the introduction advising not to use any info listed but rather start your own thread (I was using google searches to find others in my situation failing to realize there are forums such as this to offer help). Any hope for me at all? Thanks again for your attention to this.

Ried · 08-24-2009, 08:32 PM

We need to get access to your boot.ini, and edit it. This would be a simple task if the Recovery Console were pre-installed on your system already, or if your CD rom drive were working. Otherwise, we'd need to create a bootable usb stick and hopefully your bios supports booting from usb device. If it came to that, I'd have to send you back to Windows XP Support section and have the experts there, guide you through that.

What is wrong with your CDRom drive? Can you borrow an external CDRom drive from a friend? Without the CDRom drive, you won't even be able to reinstall/repair Windows if it came down to it.

chiapped · 08-25-2009, 06:40 AM

I believe that my only chance in salvaging my computer would be the bootable usb, though since my computer is about 7 years old I have read that the chance the bios supports this is slim. I don't have access to an external cd-drive, though would consider buying one if it could fix this problem. However, would I be able to install the hardware without having access to the computer? The internal cd-drive has been inoperable for some time. The cd spins, but is not read, and when I go to open the E: drive icon it always says that my drive is empty. I've been delaying looking into a new computer, and have even been saving money for some time since I'm amazed my computer has lasted this long. Do you think there is hope for the system even with the external cd-drive, or should I cut my losses and look into new systems and then be more diligent?
Somewhat related, what course of action would you recommend to prevent this from happening in the future in terms of anti-virus/anti-malware/anti-spyware protection? Could diligent updating of the OS also have prevented this? Thanks again for all your help, I truly appreciate your time spent on this business.

Ried · 08-25-2009, 07:13 AM

With the computer being 7 yrs old, I doubt it will have usb boot capablility. Do you have access to another computer? If so, your best bet would be to slave this hard drive to another computer, then access the files that way. If you can do that:

1. Ensure Hidden files and folders are viewable:

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading:
* select Show hidden files and folders.
* Uncheck Hide protected operating system files (recommended) option.
*Also, make sure there is no checkmark beside Hide file extensions for known file types.
* Click OK.

2. Navigate to C:\boot.ini. Right click the file and uncheck the 'Read Only box', click Apply. Right click it again, and rename it to boot.old.

3. You should also see a C:\boot.bak. Right click the file and uncheck 'Read Only', click Apply. Rename it to boot.ini.. Copy the contents of that for me in case it is needed later.

Put the hard drive back into your computer, and it should boot for you. If it does, please follow the instructions in our sticky topic New Instructions - Read This Before Posting for Malware Removal Help and post the requested logs in your next reply.

If it still will not boot, post the contents of the boot.ini that I asked you to copy earlier while the hard drive was slaved to the other computer.

Let's get through this first, then I'll have suggestions for protecting your system and how best to prevent this sort of thing from happening in the future.

08-17-2009, 12:26 PM	#1 (permalink)
chiapped Registered User Join Date: Aug 2009 Posts: 5 OS: Win XP	"Your System is Infected" First off, I want to say thanks for taking the time to offer your service. I read the rules for posting, possibly too late as I have already tried certain tricks that seem to have made things worse, but I still hope there is a chance for my laptop. Also, I apologize ahead of time for my ignorance in this sort of thing, I will try to be respectful and helpful and can hopefully learn something from all this. I recently got some sort of spyware on my computer (7 year-old Toshiba Satellite) that hijacked the desktop background with the title message and a blue screen. From what I understand, I am not the only one. However, in trying to get rid of it, I ran a couple of anti-virus and anti-spyware (AVG Free, MBAM) programs that got rid of the toolbar pop-up which was trying to sell a "windows" program to remove the spyware, but did not correct the background. I tried to get into safe mode, but the virus did not allow this, so I used SafeBoot to get into safe mode. However, since the virus will not allow Safe Mode, my computer is stuck in an infinite reboot cycle no matter which selection I choose on the start-up screen. Since I cant get into windows or any other command prompt, I am at a loss for what to do. Any help is much appreciated. Thanks. Also, to complicate matters further, my CD drive is inoperable.

08-22-2009, 10:57 AM	#2 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,977 OS: WinXP and Vista	Re: "Your System is Infected" Hello chiapped, What Safeboot utility did you use? __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

08-24-2009, 08:24 AM	#3 (permalink)
chiapped Registered User Join Date: Aug 2009 Posts: 5 OS: Win XP	Re: "Your System is Infected" I believe the program was just called "SafeBoot." I found it through a help forum and thought it would be useful in my situation before I read the introduction advising not to use any info listed but rather start your own thread (I was using google searches to find others in my situation failing to realize there are forums such as this to offer help). Any hope for me at all? Thanks again for your attention to this.

08-24-2009, 08:32 PM	#4 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,977 OS: WinXP and Vista	Re: "Your System is Infected" We need to get access to your boot.ini, and edit it. This would be a simple task if the Recovery Console were pre-installed on your system already, or if your CD rom drive were working. Otherwise, we'd need to create a bootable usb stick and hopefully your bios supports booting from usb device. If it came to that, I'd have to send you back to Windows XP Support section and have the experts there, guide you through that. What is wrong with your CDRom drive? Can you borrow an external CDRom drive from a friend? Without the CDRom drive, you won't even be able to reinstall/repair Windows if it came down to it. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

08-25-2009, 06:40 AM	#5 (permalink)
chiapped Registered User Join Date: Aug 2009 Posts: 5 OS: Win XP	Re: "Your System is Infected" I believe that my only chance in salvaging my computer would be the bootable usb, though since my computer is about 7 years old I have read that the chance the bios supports this is slim. I don't have access to an external cd-drive, though would consider buying one if it could fix this problem. However, would I be able to install the hardware without having access to the computer? The internal cd-drive has been inoperable for some time. The cd spins, but is not read, and when I go to open the E: drive icon it always says that my drive is empty. I've been delaying looking into a new computer, and have even been saving money for some time since I'm amazed my computer has lasted this long. Do you think there is hope for the system even with the external cd-drive, or should I cut my losses and look into new systems and then be more diligent? Somewhat related, what course of action would you recommend to prevent this from happening in the future in terms of anti-virus/anti-malware/anti-spyware protection? Could diligent updating of the OS also have prevented this? Thanks again for all your help, I truly appreciate your time spent on this business.

08-25-2009, 07:13 AM	#6 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,977 OS: WinXP and Vista	Re: "Your System is Infected" With the computer being 7 yrs old, I doubt it will have usb boot capablility. Do you have access to another computer? If so, your best bet would be to slave this hard drive to another computer, then access the files that way. If you can do that: 1. Ensure Hidden files and folders are viewable: Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading: * select Show hidden files and folders. * Uncheck Hide protected operating system files (recommended) option. Also, make sure there is no checkmark beside Hide file extensions for known file types. Click OK. 2. Navigate to C:\boot.ini. Right click the file and uncheck the 'Read Only box', click Apply. Right click it again, and rename it to boot.old. 3. You should also see a C:\boot.bak. Right click the file and uncheck 'Read Only', click Apply. Rename it to boot.ini.. Copy the contents of that for me in case it is needed later. Put the hard drive back into your computer, and it should boot for you. If it does, please follow the instructions in our sticky topic New Instructions - Read This Before Posting for Malware Removal Help and post the requested logs in your next reply. If it still will not boot, post the contents of the boot.ini that I asked you to copy earlier while the hard drive was slaved to the other computer. Let's get through this first, then I'll have suggestions for protecting your system and how best to prevent this sort of thing from happening in the future. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."