My daughter downloaded a very tricky virus that doesn't seem to do much harm, yet. There is clicking going on as if someone is executing programs, and short audio advertisements that play without a program being open, as well as the occasional pop up of cartoon characters or a box titled "Crush Report", saying "someone you know has a crush on you, click here to find out who". Of course if I exit that pop up, a box comes up asking if I am sure I want to exit, one of the oldest virus tricks in the book because if I select OK, Cancel, or x out of the the pop up I will execute more of the virus. The only way to get out of a box like this out traditionally is to end the process through Task Manager, however when I open Task Manager there is no program running there to end. I have run Malwarebytes, Hijack This, Norton Professional and Smitfraud without being able to detect the virus. It is only a nuisance now, but will become stronger as my laptop has begun to shut down randomly. This is a very tricky virus, it will not allow me to restart in Safe Mode, and it will not allow me to run SpyBot.exe. I have a Toshiba laptop running Windows XP Professional. I have read opinions that this virus can be downloaded through YouTube, and may have something to do with Iexplore.exe. Aside from reformatting my hard drive and reinstalling Windows XP Professional as well as all my programs I don't know what else to do. There has to be an answer though because it is mentioned as a past topic in your as well as other blogs/chats.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.
Beings the pc won't stay connected to the net, you'll need to download the tools to a USB device like a flash / thumb drive.
Also if you have Vista Vista and Windows 7 users: 1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")
I'm going to have you download Combofix to the USB device, after the download, plug the device into the non working pc and run it from the device.
Download ComboFix from one of these locations to the USB device.
Link 1 Link 2 If using this link, Right Click and select Save As.
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Give it atleast 20-30 minutes to finish if needed.
Please do not attach the scan results from Combofx. Use copy/paste.
Also please describe how your computer behaves at the moment.
