Windows Restore Virus

Third virus in two weeks! This is out of control! Of course this is happening on the work computer, my home computer I run a tight ship. I had the Windows Restore virus that gave me all these error messages (RAM is low, hard disk failure, etc) and a fake Windows Restore screen popped up and did a "scan". I manually killed the processes and ran Malwarebytes. Then I restarted and did SuperAntiSpyware. The worst part is over, now there are a few issues to deal with. 1. The Internet Explorer script error windows that pop up, 4 in a row, every few minutes. Even when I don't have IE open. It always contains a link to some weird random site. 2. Google search redirecting. Clicking on a search result link and being forwarded to some wierd random page. 3. My Quick Launch icons are gone and I can't figure out how to get them back. Properties - Taskbar - "Show Quick Launch" is checked. Toolbars - Quick Launch is checked. 4. Start Menu - Programs list is gone. I recovered a few items but most of the listings are gone. Can someone please help me?

Well, I have figured out how to get the Favorites/Programs/Quick Launch back. I couldn't find anywhere online that said how to do this so hopefully by posting it I can help someone else. * Make sure SHOW HIDDEN FOLDERS/FILES is on * GO TO: My computer - C:/ - Documents and Settings * I went to every user folder and made sure everything was unhidden (right click - properties - uncheck Hidden) * When I un-hid Application Data under Administrator, all my start menu programs came back. * Quick Launch and my Favorites are back too. Now I just need to fix these script errors, get Windows Update to work, and stop the Google redirecting.

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

• Absence of symptoms does not always mean the computer is clean
• Please do not run any scans or fixes without my direction.
• Finally, stay with this topic until I give you the final 'All clear' post.

1) DDS
[external image: Posted Image]
Please download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  
  • DDS.txt
  • Attach.txt
• Save both reports to your desktop.

2) GMER
Please download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and put it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

3) What You Will Need To Post:

• DDS logs
• GMER log

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic