[Resolved] Cocktail of Viruses

Okay guys my computer is partially working.

I think I got that Antivirus Pro 2009 virus.

However when AVG picked it up it restarted the computer and when it came back the computer froze and froze again.
What's worst is that when my computer restarted a new computer account was created. The account name was a series of numbers and it was passworrd protected. I deleted that account as soon as I log into my account.

I ended up unistalling AVG and a^2 Antivirus and instead re-installed McAfee which I had deleted because it slowed my computer down a lot.

However when I finished installing McAfee it wouldn't recognize my internet connection. It said to connect to the internet first. But I have DSL it's always connected.
Because It doesnt recognize my connection in won't upgrade so it's pointless running a scan, which I did but I still have the same Issue.

I cant even access this website, I keep being redirected and when I do type the address directly on the adress bar it says problem connecting.
I can only go to yahoo and google and some other search engine sites but as soon as I click on a link it redirects me somewhere else.

I downloaded the new version of HJT from the school computer but my computer doesn't let me install it when I click on it. It just pauses and doesn't do anything. Therefore I cant post a HJT log file, sorry guys.

What's really weird is that McAfee says that it doenst trust my network, I only have one computer. I think someone else has access to my computer not physically but through the web. When I try to manually run a program as HJT and right click on it and choose "Run Program As" on top of the window it has my account and and a slash and AZKABAM (My Account name/AZKABAM) next to my name. Does that mean that someone else is running my computer, that's why McAfee can't trust my computer?

I think I may have foolishly erased some important registry keys since the internet seems to work but only partly. It doesn't work for updating any Antivirus, not good with McAfee nor with AVG. I'm stuck. I can't update nor can I open HJT. Of Lately the computer keeps freezing after starting up I just get to my desktop background and wham it's frozen.

Hopefully you guys can help. I've tried fixing it my self but to no use, maybe I worsen the problem. But if you guys can't help me I will have no other choice but to go back to Factory settings using my Restore Disc.

Sorry for the lengthy description but I think it was important to get across all my computer symptoms since I can't open/run HJT.

P.S I do have an older verison of HJT which runs and everything but when I tried to post it here I got redirected to download the new version.

It sounds like you got some pretty nasty stuff going on there, one thing I’m worried about here is

I think I may have foolishly erased some important registry keys

But hopefully that’s not going to be a problem, please don’t mess with anything in the registry, or run anything else unless I give you instruction to do so. Ok lets see what were are up against….from you clean computer download the following tool to a portable media devise, such as a flash drive, cd, etc…. Also print out, or save these instructions into note pad on your flash drive. (so you can see how to run the tool)


Please ownload ComboFix from Here or Here

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Do not mouse-click Combofix's window while it is running. That may cause it to stall.

===============================================


Once you have them on your flash drive, plug it into the infected computer. First try saving the tools to your desktop and running them. If you have any trouble doing that just run them right off the flash drive. When you’re done please post the Combofix log and let me know how things are running

All right. So I did download and save Combofix to my flash drive. I was able to save it to my desktop, however nothing happened when I click on it to run. Since I was having problems with my computer since it was continuously freezing I ended up using my restore cd, and chose factory settings. Everything is well now. I installed McAfee and I am now protected. I will never mess around with the registry again. Now I know that I should first do a back up. Thanks for the advice. Great site you guys.

Hi
I was looking forward to working this one , but Im glad you got it sorted….

Here are some simple steps to keep your computer clean and secure:

[external image: Posted Image] 1.) Watch what you download!
Many freeware programs, and P2P programs like Grokster, Imesh, Kazaa and others are amongst the most notorious, come with an enormous amount of bundled spyware that will eat system resources, slow down your system, clash with other installed software, or just plain crash your browser or even Windows itself. If you insist on using a P2P program, please read This Article written by Mike Healan of Spywareinfo.com fame. It is an updated and comprehensive article that gives in-depth detail about which P2P programs are "safe" to use.

[external image: Posted Image] 2.) Go to Intenet Explorer > Tools > Windows Update > Product Updates, and install ALL High-Priority Security Updates listed. If you're running Windows XP, that of course includes the Service Pack 2! If you suspect your computer is infected with Malware of any type, we advise you to not install SP2 if you don't already have it. You can post a HijackThis log on our Forums to get free Expert help cleaning your machine. Once you are sure you have a clean system, it is highly recommended to install SP2 to help prevent against future infections.

It's important to always keep current with the latest security fixes from Microsoft.
Install those patches for Internet Explorer, and make sure your installation of Java VM is up-to-date. There are some well known security bugs with Microsoft Java VM which are exploited regularly by browser hijackers.

[external image: Posted Image] 3.) Open Intenet Explorer and go to Internet Options > Security > Internet, then press "Default Level", then OK. Now press "Custom Level." In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".

Now you will be asked whether you want ActiveX objects to be executed and whether you want software to be installed.
Sites that you know for sure are above suspicion can be moved to the Trusted Zone in Internet Option > Security.

So why is ActiveX so dangerous that you have to increase the security for it?
When your browser runs an activex control, it is running an executable program. It's no different from doubleclicking an exe file on your hard drive.
Would you run just any random file downloaded off a web site without knowing what it is and what it does?

[external image: Posted Image] 4.) Install Javacool's SpywareBlaster

It will protect you from most spy/foistware in it's database by blocking installation of their ActiveX objects.

Download and install, download the latest updates, and you'll see a list of all spyware programs covered by the program (NOTE: this is NOT spyware found on your computer) Press "Enable All Protection", and you're done.
The spyware that you told Spywareblaster to set the "kill bit" for won't be a hazard to you any longer. Although it won't protect you from every form of spyware known to man, it is a very potent extra layer of protection.
Don't forget to check for updates every week or so.

[external image: Posted Image] 5.) Let's also not forget that Spybot Search & Destroy has the Immunize feature which works roughly the same way. Another feature within Spybot is the TeaTimer option. This option immediately detects known malicious processes wanting to start and terminates them. TeaTimer also detects when something wants to change some critical registry keys and gives you an option to allow them or not.

[external image: Posted Image] 6.) Microsoft now offers their own free malicious software blocking tool. Windows Defender improves Internet browsing safety by guarding over fifty (50) ways spyware can enter your PC.

[external image: Posted Image] 7.) Another excellent program by Javacool we recommend is SpywareGuard.
It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

[external image: Posted Image] 8.) IE-SPYAD puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. Another good hosts program is mvpshosts. This little program packs a powerful punch as it block ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial.

*It is important to note that all of the above programs/files can be run simultaneously on your system. They will work together in layers, so to speak, to help protect your computer. However, the following suggestions are designed to only run one of each. It is not a good idea to run more than one firewall, and one anti-virus program. Running more than one of these at a time can cause system crashes, high system usage and/or conflicts with each other.*

[external image: Posted Image] 9.) It is critical that you use a firewall to protect your computer from hackers. We don't recommend the firewall that comes built in to Windows. It doesn't block everything that may try to get in, and the entire firewall is written to the registry. As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions. Three good ones that are freeware to boot are ZoneAlarm, Kerio and Sygate

[external image: Posted Image] 10.) An Anti-Virus product is a necessity. There are many excellent programs that you can purchase. However, we choose to advocate the use of free programs whenever possible. Some very good and easy-to-use free A/V programs are AVG, Avast, and AntiVir. It's a good idea to set these to receive automatic updates so you are always as fully protected as possible from the newest virus threats.

NOTE: DO NOT install more than one anti-virus program. They will conflict, and provide less protection, not more.


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Thanks for letting us help you!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.