Need serious help - my computer is ****ed
 

Mods - I know you'd rather have this in the Media Forum, but if you could leave this in the Lounge for a bit I'd appreciate it. I need all the help I can get.

Everything was working fine this AM, and all of a sudden this scan started from "AV Security Suite" saying m computer is infected. I stopped the scan because I don't recall downloading anything called AV Security. AVG scans nightly.

I can't open AVG. I can't open anything. I've tried restarting and using F12 to boot into Safe Mode, and I'm not even given the option.

Literally everything I try to open comes with a prompt that says that the file cannot be opened because it is infected.

I'm ****ed. Please help. FWIW, the computer in question is a desktop PC running Vista.

I thought F8 was safe mode?

BING BING BING!!!!

Yep. I'm an idiot. I just found that out via a google search. Thanks. F2 and F12 were the only options showing, so I assumed F12.

Let's see if I can run AVG from Safe Mode.

Re-format...

Restore to a previous date is usually my first option.

I'm running AVG in Safe Mode as I type.

I was planning on going to the restore point I just created Thursday, but couldn't open Control Panel to get to it.

I'm not very computer savvy, folks - so if the scan doesn't work - could someone walk me through getting to that restore point in Safe Mode?

TIA

Go to this forum. These guys ROCK! Post your issue on their forum and someone will be able to help you. It's free.

http://forums.techguy.org/

****.

I may be overreacting, but the scan doesn't appear to be going very well.

c:\boot\bcd locked file. not tested
c:\boot\bcd.log locked file. not tested.
c:\documents and settings\ locked file. not tested.
c:\pagefile.sys locked file. not tested.

Currently scanning program files.

Pour antifreeze in the cup holder thingy that slides out of the tower :thumb:

Download Combofix and run it. It will remove the virus and reset your comp clock and such. Just google combofix, i have had similar experiences with bogus antivirus virus programs that pop up from out of nowhere. I believe the virus also has a key logger with it to track personal info.

Hope this helps.

Also a regular everyday freeware antivirus program will not remove the virus. I have tried everything and the only thing that seems to work on the bogus antivirus virus is combofix.

Combofix is the only way to go. Might have to download it on another PC and copy it over.

My only other computer is a Macbook. That's what I'm using now.

Can I download on the PC in Safe Mode?

Kick it?
Posted via Mobile Device

What OS are you running?

Trust me, I'd ****ing love to.

**** Microsoft. **** Windows. **** Vista. **** shit like this happening too ****ing often.

I've had my Macbook for 4 years, and never had a problem, other than replacing the battery.

Vista.

The first thing you need to do is to set a restore point. Preferably, a week past. If you haven't downloaded anything this week that is important, then restore your computer to a week ago. Do NOT restore it to yesterday or 48 hours ago.

If you have an external hard-drive, I'd save whatever you can to that.

What does combofix do? does it erase everything or just remove the spyware/malware and virus shit?

ive never had problem this severe, just curious.

I actually backed up all my files and set a restore point on either Wednesday or Thursday, because I was going to upgrade to W7, and never got around to it.

Can I get to that restore point in Safe Mode?

FWIW, AVG is still scanning, so I'll have to wait for it to finish.

download and install. run a full scan. this program has been my go to for years now.

http://download.cnet.com/Malwarebyte...-10804572.html

AV Security is a junk virus program that wants you to pay in order to remove "viruses" that are installed in your system. malwarebytes should squash that no problem.

/work in tech support
//deal with this issue on a near daily basis

just remove the spyware/malware and virus shit.

I have used twice now.

You can try to restore it, but the virus will still be there. Trust me on this, it has happened to me. I think you might be able to download Combofix in safe mode, because the program will boot you into safe mode when it runs. If i remember this process correctly. Try it and see if it will let you.

This was below was posted before:
ttp://www.chiefsplanet.com/BB/showthread.php?t=214468&highlight=virus&page=3

first off, you need to uninstall that AVG trash(and any other anti-virus or monitor)and run the Gauntlet.
Behold, Combofix:
http://www.bleepingcomputer.com/comb...o-use-combofix

**** the instructions, SAVE the download(don't run), and make sure ALL anti-virus or malware monitors are DISENGAGED before running.

Once that's done, get the REAL DEAL in Maintenance. These apps kick ass and are FAST.

Behold, IOBIT:
http://download.cnet.com/1770-20_4-0...form%3DWindows

Download the first three. Install and run the maintenance suite first( the blue one ).

Then install the security program( the red one )and run a full scan.
(Get Reminderfox, and set to remind you once a day to do the 'quick scan')

Then install the Defrag program and follow it's instructions.

Then get this:

http://download.cnet.com/Avira-AntiV...html?tag=mncol

This program ****s AVG in the ass, and you only have to run it once a week once you do the initial full-system scan. And you can schedule this program.

(renamed it alg.exe)

Paragon backup

http://www.elitekiller.com/malware.htm

http://www.malwarebytes.org/

It doesn't change any settings or actually wipe the pc right? so is it only used when you are just totally ****ed and the virus scanner/antispyware-malware programs dont load or catch the problem?

I have malwarebytes as well and the only thing that stops this bogus antivirus from popping back up again seems to be combofix. I was down for 2 weeks before i found a forum on the net that directed me to the program.

I use malwarebytes, avast antivirus and spybot s&d weekly

I heard avira is real good too but avast works fine for me

Regardless of whether I use Combofix or Malwarebyes, can I download in Safe Mode?

No it will not delete files or wipe out the pc. It will remove infections from the files they are in.

Thanks, ive saved the link for that in future use if i ever need it.

Yeah, but if you have a faux scanner running this morning, your earlier restoration didn't remove any possible trojan you might have.

After completing the full scan, you should run a root file and copy the txt and PM it to me and I can see if you have a trojan on your computer from the root scan. But, it's fairly easy to see for yourself, because the root scan will not only show the trojan, but what exact trojan you will have.

Not to hijack OTWP's thread, but has anyone ever heard of File Cure? Bogus, I'm assuming, and should be removed?

Try downloading it in safe mode. I think you can, but im not 100% sure.

Safe Mode doesn't allow you to use Network settings, therefore, you cannot download in Safe Mode.

yes, as long as you do SafeMode with Networking.

If you can access the net while in safe mode, you should be good to go

It's still scanning. Will it ask me to run a root file? I'm telling you, I'm a tech-idiot. You guys are going to get some really stupid questions.

Which is it, fellas?
:D

yes you can.

http://www.mattiasgeniar.be/wp-conte...robleem_01.jpg

File Cure has actually corrupted files before on my computer before, so from experience no i would not use File Cure.

Interesting.

The only line from the AVG scan thus far that hasn't ended with "locked file. not tested":

c:\windows\system32\drivers\netbt.sys Virus identified Win32/patched.DX

This mean anything to anyone?

Well, he's using Vista. I thought Vista had some funky thing with their Safe Mode.

not off hand

Not that I know of. Granted, I used Vista for all of 30 days before going back to XP and eventually moving on to 7 which still does the safe mode with networking.

Nope, just did a goodle seatch, Vista should give the same options.

Thats the thing though OTWP, there very well could be multiple viruses running on your comp and AVG caught one of them.

Next question:

I'm currently in just regular Safe Mode.

How am I going to be able to copy the text of the root file and PM it to Cosmic?

I can't use the internet in regular safe mode, can I?

nope. you need to reboot and go back into safe mode with networking

I had the "safe mode with networking" option earlier - I just chose not to use it, because I didn't know if I should.

So, will the "copy" of the root file still be available?

****, I don't even know what a root file is, or how to run one.

LMAO

THIS ****ING SUCKS.

It means your system file is infected.

Honestly, I'd go to the tech support forum I suggested earlier: post your OS info, a copy of AVG result, and what issues you are having. They'll be able to assist you better than we can.

In the meantime, I wouldn't remove it, it might render your PC unusable.

Good advice from capone. Get into safe mode with networking and download combofix and your problems will be over.

Sorry, can't get around to helping. But don't connect a HD to this PC. The infection can easily transfer to that HD unless you are connecting an iPod, a phone or anything that is not windows.

**** AVG. Switch to Kaspersky and W7 after this.

Why not run that combofix that people have been suggesting?

AVG is STILL scanning.

When it's done, I'll likely do just that, especially if I'm going to lose my copy/paste when I reboot in safemode/networking.

My W7 disk is in the mail. Just waiting.

I wanted to just do the download, but was told that I couldn't upgrade from my version of Vista without the disk.

OTW, this is the rootkit I'm referring to.

After restoring to an earlier date, if you're still having issues, download this and you will see if you have a trojan or not.

http://sites.google.com/site/rootrepeal/

As capone suggested malwarebytes is the best to fix this problem along with combofix.

Ah. Got it. So after the AVG scan, I can reboot in safemode/networking and jump on CP, and click that link?

Got another "patched.DX" line - but pretty long - not worth typing out.

Many thanks to all of you for your help thus far.

The thing about this virus is, is that some antivirus programs will remove viruses from your comp, but will not remove the worm that is sending these viruses through.

So if you find viruses with regular antivirus programs and remove them, the worm is still there and the bogus antivirus WILL pop back up again later.

Combofix kills it.

Hope to hear this combofix thing gets you back and running OTWP

I understand.

So is there any reason to continue the AVG scan, or have I just wasted my time?

And how to I stop the scan, assuming you guys suggest that I should?

Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore. System Restore starts.
On the Welcome to System Restore page, click Restore my computer to an earlier time (if it is not already selected), and then click Next.
On the Select a Restore Point page, click the most recent system restore point in the On this list, click a restore point list, and then click Next.

Note A System Restore message may appear that lists configuration changes that System Restore will make. Click OK.
On the Confirm Restore Point Selection page, click Next. System Restore restores the previous Windows XP configuration, and then restarts the computer.
Log on to the computer as Administrator. The System Restore Restoration Complete page is displayed.
Click OK.

After you do that then go and download Temp File Cleaner at http://www.geekstogo.com/forum/TFC-T...r-file187.html

Then run whatever AV scanner you have along with Malwarebytes at http://majorgeeks.com/download.php?det=5756

Use the system restore to go back a few days to let's say, atleast Friday. The TFC will remove all places the virus/spyware would hide. Malware bytes will get rid of any remnants that the first two didn't get. I'd also recommend the combofix too but alot of spyware virus's do something to not allow it to run. You can still run it at any point after the System Restore.

The Idea behind using multiple applications and utlities is to get things off the system that may have been missed by the others.

Me too, man. Thanks.

Mrs. OTW58 had some work to do from home today, and before she started, this happened - so she had to drive downtown to the office to get it done.

She works from home a lot, so I need to get this thing up and running ASAP.

You can stop the scan by canceling it, i believe it says cancel scan. Or you can ride it out remove a virus that it caught. Then download the program.

System restore will not affect the worm.

You need to make her happy because obviously she is looking at porn sites with viruses on them. :)

OTW,

I had that very nasty little **** of a virus. I went over every line of code for 8 hours. And in the end I kicked that POS off my computer.

Then just for fun I reformatted and reloaded. Should have done that first. Took less time.

But my six year old Toshiba laptop is running like a dream. And if it happens again, I'll reformat again.

You need to remove the worm or it could result in hardware failure down the road.

No cancel scan option. I figure I can just click the "Close" X and cancel it that way.

At this point, I've already wasted over a ****ing hour on this scan, I might as well see it through and then reboot - unless you guys think that's pointless.

Did any of ya open any e-mails recently?

I'm not sure how comfortable I'd be reformatting and reloading. I've backed up all my files, but let's just say that I'd lose a lot of software. And it would take forever to re-install the "other" programs.

I'll absolutely do it if I have to, however.

Nope.

I never check e-mail on the PC - all of my e-mail is sent to my iPhone.

I was gone all day yesterday, so I went to check the mail hoping that the W7 disk had arrived.

No such luck.

I didn't have anything real important on it to begin with. But now that I've done it, I'd do it again in a heartbeat.

It's that simple.

Just wondering, cause if AVG caught 2 viruses already, i guarentee there is a worm sending more through. Damn freeware antivirus programs hardly ever catch anything.

OTW do you have another PC in your house? If you do you could use a USB stick to download Malwarebytes and combofix and whatever else and then plug it in your infected system.