help can't remove malware please can someone take a look

[gringo_pr]

hello jemma_79

I would like you to check if you can go into safemode now

Boot into Safe Mode

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

after you log in reboot the computer to go back into windows mode

let me know how it goes

gringo

[jemma_79]

hi gringo
i have tried unsucessfully to boot into safre mode
when the advanced options screen shows it gives me 2 options the first being start windows xp
the second start recovery i am unable to do anything at this point the first option is highlighted and i can't move it from this
windows then starts

[gringo_pr]

hello Jemma_79

when the advanced options screen shows it gives me 2 options the first being start windows xp
the second start recovery

that is not safe mode that sounds like the recovery console we just installed
we are going to try one more time follow the instructions below carefully

Boot into Safe Mode

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key over and over about two times every second
  keep doing this untill The Windows Advanced Options Menu appears.
• Ensure that the Safe Mode option is selected. you select this by using the up arrow key untill safe mode is highlighted
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

reboot the computer

and let me know how it goes


Gringo

[jemma_79]

hi Gringo
I have once again tried to boot into safe mode
same problem no safe mode options just the recovery console can't move from the highlighted choice
thanks
Jemma

[gringo_pr]

Hello Jemma_79

This is my general post for when your logs show no more signs of malware

now this does not mean that I am giving up on you but I wanted to get this part over with before we move on


Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
• 

remove tools

Let's clear out the programmes we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if used inappropriately.


Please download OTMoveIt and save it to desktop.

• Double click OTMoveIt.exe to launch the programme.
• Click on the CleanUp! button.
• OTMoveIt will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• When finished exit out of OTMoveIt
• The tool will delete itself once it finishes, if not delete it by yourself.

Set correct settings for files that should be hidden in Windows XP

• Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
• Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
• If unchecked please check Hide protected operating system files (Recommended)
• If necessary check "Display content of system folders"
• If necessary Uncheck Hide file extensions for known file types.
• Click OK

Make your Internet Explorer more secure - This can be done by following these simple instructions:

please visit this page that gives instructions to do this
http://surfthenetsafely.com/ieseczone8.htm

Turn On Automatic Updates

Turn On Automatic Updates
1. Click Start, click Run, type sysdm.cpl, and then press ENTER.
2. Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them

If you click this setting, click to select the day and time for scheduled updates to occur. You can schedule Automatic Updates for any time of day. Remember, your computer must be on at the scheduled time for updates to be installed. After you set this option, Windows recognizes when you are online and uses your Internet connection to find updates on the Windows Update Web site or on the Microsoft Update Web site that apply to your computer. Updates are downloaded automatically in the background, and you are not notified or interrupted during this process. An icon appears in the notification area of your taskbar when the updates are being downloaded. You can point to the icon to view the download status. To pause or to resume the download, right-click the icon, and then click Pause or Resume. When the download is completed, another message appears in the notification area so that you can review the updates that are scheduled for installation. If you choose not to install at that time, Windows starts the installation on your set schedule.

or visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



antispyware programs

you have a couple of good antispyware programs on this computer but you still can try some of these others to see if you like them also

I would reccomend the download and installation of some or all of the following programs (all free), and the updating of them regularly:

• WinPatrol As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
  
  
• Spybot Search & Destroy - Spybot is a tool like Ad-Aware SE whereas it seeks out and removes known spyware from your machine. These two tools (Ad-Aware & spybot) are perfect complements to each other as one will most always find something the other missed.
  
• Spyware Blaster - By altering your registry, this program stops harmful sites from installing things like ActiveX Controls on your machines.
  
• IE_Spyad - Works by placing known "bad" sites into your Internet Explorer "Restricted Zones" prohibiting them from doing potentially problematic things to your computer.


Consider a custom hosts file

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.


Also please read this great article by Tony Klein So How Did I Get Infected In First Place

now I have been told that the problem with the safe mode could be the kind of keyboard you may have
pay close attention to the part in blue

Reboot your computer in Safe Mode.



• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

This can be tricky. If Windows starts up in normal mode, repeat the process. If you have a keyboard with a "F Lock" key click it so that the "F" light is on when you start tapping the "F8" key.

If that is not the problem let me know what model number of A4Tech keyboard you have and is there writing on the f-keys besides F-8





Gringo

[jemma_79]

gringo
i am unable to download OTMovelt the link isn't working

[gringo_pr]

sorry try here

http://download.bleepingcomputer.com/ol ... oveIt2.exe


Gringo

[gringo_pr]

Hello jemma

: three day bump :


It has been three days since my last post.

• do you still need help with this?
• do you need more time?
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

[Elrond]

Due to lack of response this topic is now closed.

If you still need help open a new thread in the Malware Removal forum and wait for a new helper.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Elrond