[Resolved] PC infected, stops everything so I can't do anything

I'm trying to do the self help steps before posting here, but I can't. Win XP Media Center, HP computer. If I boot in safe mode I get a "this computer is infected…" message. If I hit Alt F4 this goes away and I can see the desktop and icons, but I can't click anything. The only thing I can do is move the mouse and watch the cursor move on screen. It seems I have something blocking the entire OS. I'm stuck on this. I tried visiting the self help forum and downloading all the antispyware programs on a USB thumbdrive thinking I can then just access them on the PC, but everything is blocked. Hopefully someone can help. Thanks. Mike

Restart in Safe Mode and try System Restore. 1. Click Start. 2. Point to All Programs. 3. Point to Accessories. 4. Point to System Tools. 5. Click System Restore. 6. Follow the instructions on the wizard. See if you can find a date the the PC worked.

Thanks for the reply. I was able to get into system restore and pick a date, but it hangs at the Confirm System Restore Date screen. I can click next but nothing happens. I let it at this screen for several hours thinking it was just slow, but it's not responding. It will let me click Back and pick another date, but it never lets me confirm the restore date. Mike

Using Internet Explorer, click on Kaspersky Online Scanner * You will be prompted to install an ActiveX component from Kaspersky, Click 'Yes'.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save as Text' button:
* Save the file to your desktop.
Please post the Kaspersky report

The link to Kaspersky goes to a page where the online scanner is unavailable while they update it. I tried instead to use their free trial, which downloads, but then gets terminated when windows is starting the installation. Could this be because i have another antivirus/antispyware program on the computer? Mike

http://www.kaspersky.com/kos/eng/partner/d…kavwebscan.html

http://www.kaspersky.com/kos/eng/partner/d…kavwebscan.html

Here's the report. Thanks.

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, January 20, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, January 20, 2010 01:41:34
Records in database: 3335466
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
I:\
J:\
K:\

Scan statistics:
Objects scanned: 212342
Threats found: 3
Infected objects found: 7
Suspicious objects found: 0
Scan duration: 03:31:47


File name / Threat / Threats count
C:\WINDOWS\system32\smss32.exe/C:\WINDOWS\system32\smss32.exe Infected: Trojan-Downloader.Win32.FraudLoad.gjq 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Kklb.exe Infected: Trojan-Downloader.Win32.FraudLoad.gjq 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\n.exn Infected: Trojan.Win32.Tdss.avkh 1
C:\Program Files\Online Services\AOL\United States\AOL90\comps\toolbar\toolbr.EXE Infected: not-a-virus:AdWare.Win32.SearchIt.t 1
C:\WINDOWS\system32\smss32.exe Infected: Trojan-Downloader.Win32.FraudLoad.gjq 1
C:\WINDOWS\system32\spool\prtprocs\w32x86\18B.tmp Infected: Trojan.Win32.Tdss.avkh 1
C:\WINDOWS\system32\winlogon32.exe Infected: Trojan-Downloader.Win32.FraudLoad.gjq 1

Selected area has been scanned.

1. Please download The Avenger by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All…"
• Follow the prompts and extract the Avenger folder to your desktop
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to delete:
C:\WINDOWS\system32\smss32.exe/C:\WINDOWS\system32\smss32.exe
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\Kklb.exe
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\n.exn
C:\Program Files\Online Services\AOL\United States\AOL90\comps\toolbar\toolbr.EXE
C:\WINDOWS\system32\smss32.exe
C:\WINDOWS\system32\spool\prtprocs\w32x86\18B.tmp
C:\WINDOWS\system32\winlogon32.exe

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply

OK, I'll try that this evening once home from work. Thanks. Mike

When I click on the Avenger link Explorer can't find the site. Yet if I click the link from my other computer it goes right to a download screen for the zipped file. Any suggestions? Mike

Doesn't matter how you get it. Download it to a thumb drive, copy it to the infected pc and follow the directions I gave you to use it

OK the Avenger scan is done and went back to my log on screen. If I type in my password and log in, I see my desktop background for about 5 seconds, then it logs me out right away, back to the log in screen. Should I turn it off and boot in safe mode again? Mike

yes and create a new user. Restart and if you can't login using your login, try the new user.

Rebooted in safe mode with networking and it still won't let me log in. starts to then logs me back out instantly. Mik