HELP - Massive System Problem

chrisjones · 07-09-2008, 11:05

Ok where to start.
I was using my PC this morning running XP SP3 when my desktop background suddenly changed to a screen advertising something like XP adware remover or something similar. Ive no idea how it got there!

Next thing I know a program called 'a' is trying to access the net so I immediately do a full system clean up, Ccleaner and Adaware. Next thing I notice is all my URL's are being redirected to odd sites and the system locks up. Upon rebooting I get as far as the 'Welcome' page and no further. Ive tried re-booting in safe mode to no avail... I really am stuck!

Any ideas??

Russ · 07-09-2008, 11:08

Run msconfig to see if there's anything there that could be causing it?

Have you tried Spybot as well? I have it as well as Adaware but that often misses things that Spybot catches.

Raistlin · 07-09-2008, 11:14

Sounds like you've somehow got yourself a pretty nasty malware infection there. If you can't boot into safe mode then there's not a lot else that you can really try.

You could try putting the drive into another working machine with up to date AV and Spyware scanners and see if you can clean it that way [Warning: You could end up infecting the other machine this way].

You could try booting the machine with a live CD of some sort (either Windows based, or Linux) and see if you can scan for/clean the infections that way.

Failing that your best bet would be to completely rebuild the system, to be honest that's what I'd normally recommend in situations like this anyway.

Here's my post from another thread (which was similar to this one) which explains why:

Quote:

Oh, yeah, almost forgot.

My standard advice for this sort of thing is this:

Your machine has probably been compromised, you should now consider whether you can trust it even after you think you have removed the infection. Best practice in this situation is to re-install everything, after completely blanking the drive, from known good/clean media, and to thoroughly scan any media created with the old system before importing any data from it.

Many nasty programs can hide themselves from the operating system, and even subvert anti-virus software to make it appear as though the machine is now 'clean'. You need to be aware of, and consider this, before you decide how to proceed.

As a final precaution (and certainly if it is the only thing that you do), you should also change all passwords for all accounts that you might possibly have accessed from this machine - this is just in case anything on the machine has been storing/transmitting those without your knowledge.

chrisjones · 07-09-2008, 11:14

Problem is windows WONT load in any way. Not even in Safe mode. Is there anything I can try before windows boots?

Russ · 07-09-2008, 11:18

Sounds like a format is your only option

chrisjones · 07-09-2008, 11:23

Ok update, ive managed to get XP to reboot in one of the many options of safe mode, ive unplugged my wireless dongle just to be sure, and ive just updated my internet banking details via my laptop.
I'm running an adaware scan at the moment, is there anything else I can try whilst ive got the bloody thing at least running in some form?

BTW if anyone wants to be uber helpfull, my msn chat address is chrisjones 88@msn.com im online now if you want to message me.... please lol

admin edit (Russ): I've added a gap to stop the spambots going mental with your email address...

Raistlin · 07-09-2008, 11:29

Get a copy of HijackThis (http://www.trendsecure.com/portal/en...kthis/download) and post the output here. Someone should be able to point you at the nasty entries.

Seriously though, you might be better rebuilding - I'd never trust a machine again that has been infected at the level yours seems to have been unless I had.

chrisjones · 07-09-2008, 11:33

I know what your saying, but for my own sanity I need to try, even if its just to back up game files or GFX settings before re-build.

Dai · 07-09-2008, 11:39

Google for 'xp antivirus 2008'

It sounds to me like you've picked up one of the many variations of this particularly nasty parasite.

chrisjones · 07-09-2008, 11:46

Yeah I looked at 'windows warning message' too, problem is, ive no idea how I picked the bugger up!

Ive still got windows running in safemode, adaware has picked up one or two nasties so I might have caught it soon enough.

Any other ideas for programs I could try? Ive also got spybot sat ready to run.

Ive downloaded HijackThis to a memory stick, will try that shortly.

jellybaby · 07-09-2008, 11:47

Quote:

Originally Posted by DaiNasty

Google for 'xp antivirus 2008'

It sounds to me like you've picked up one of the many variations of this particularly nasty parasite.

and if thats the case, there is a removal tool for it. I had to sort out mother-in-laws last weeek.

Once you've used the removal tool, give a full system scan with an anti-virus ( I used Avira )

Also gave it the one over with some anti adware software and all seems fine now.

Good luck

chrisjones · 07-09-2008, 11:52

Could you direct me to the removal tool by chance? That would be great.

jellybaby · 07-09-2008, 11:54

http://fix-computer-problem.com/rogu...antivirus.html

Thats if it is xp antivirus 2008.

Also some manual instructions here

http://www.windowsvistaplace.com/xp-...pyware-removal

chrisjones · 07-09-2008, 12:14

Whilst im at the half way point (windows is busying itself) I would like to take the time to thank everyone - The community spirit you have all show has been fantastic. Really thankful to you all.......... especially if I dont loose my Rfactor, Live4Speed and GTR2 sim settings haha.

Raistlin · 07-09-2008, 14:14

Well, if we can save your gaming settings it will all have been worth it