Please help - computer problem

First of all,I'm really sorry to ask, but I'm having a problem and I've no-one at home who can help me.

I was on ATS a couple of nights ago and I kept getting some sort of pop-up telling me I had a Trojan and a couple of worms on my computer.

These messages were very persistent and wouldn't go away. On the one hand they 'strongly recommend' that I take action and on the other there was a message warning me it might not be safe to do so.

Since then keep getting unwanted websites coming up on my computer even when I'm not online. Some of them casinos and something that looks vaguely pornographic. I'm really worried about what else will come up.

I've gone into the Security System on my computer but it says it has been turned off or stopped.

What I really want to know is how I can turn it on again, please.

I have had terrible trouble getting my computer to start and it won't let me re-set it to an earlier date

My Spyware Protection keeps 'popping up' offering t let me view two blocked items, but I blocked them because they're supposed to be dangerous.

Again, sorry to be a pain but I would be grateful for a nudge in the right direction. I'm afraid to buy anything online with my Security System down.

Edit to add - I tried doing a search about 'pop-ups' but all that did was put me into a pop-up website.

[edit on 1-1-2009 by berenike]

Have you tried starting in safe mode and then doing a system restore?

If that doesn't work, try hijackthis.

Run this program and save a logfile.

majorgeeks.com...

Enter the logfile into this site.

www.hijackthis.de...

It will tell you what the problem files are and you will be able to delete them.

reply to post by berenike


Howdy,

There is a utility you can download for free called "spybot search and destroy." Go to www.safer-networking.org... Make sure you get the one that says spybot S&D.

Download that utility and run all the updates. After running the updates you can run a system scan. It should take care of quite a bit if not all of the spyware and trojans.

Scan once, reboot and scan again. If there are any recurring items after multiple scans let me know.

I do tech support for a major computer manufacturer. Let me know how that works, there are other things to do, but that is a good start.

Don't hesistate to ask any more questions.

reply to post by Incitatus


That is also an excellent utility. If you have any questions while using that post a screenshot of what it finds on here and one of us can let you know what is safe to get rid of.

"I am assuming hijack this still shows all the keys and lets you decide what you can and cannot delete"

reply to post by Incitatus


This is also an excellent utility, if you have any questions on what you can and cannot get rid of post a screenshot on here and one of us will be able to tell you what is safe to get rid of.

Thank you both so very much for your help.

I cannot get into any of the sites though, I am getting the message:

cannot display the webpage

I did try to start my computer in safe mode and tried the system restore option before I started this thread, but the system restore wouldn't work.
So I had to try several times to get up and running in the normal way. I couldn't access the internet in safe mode.

I can't get through to the Security Centre because of the programme being switched off.

Sorry not ot have got back to you before, my ATS page didn't refresh itself so I didn't know there had been replies.

reply to post by berenike


It won't let you go to those pages? If you can go to WWW.downloads.com you should be able to download both utilities from there. When getting spybot make sure it is "Spybot Search and Destroy." There are a lot of imitation programs that are in fact themselves spyware. If you can't access them go to a different computer and download the utilities there and bring them back with a thumb drive or cd.

I have never personally experienced spyware that messes with the network connections, so i would be interested to know what it is.

If you can get both of those utilities it should wipe out any spyware with few exceptions. Do you notice any other indications while this is going on? Bluescreens? Any error messages? Also when it prompts you for protection does it try to force a download of something? Does it show a screen of a virus/spyware scanner that you are unfamiliar with or have never seen before?

I wasn't sure when I got the first messages if they were legitmate or not so I resisted doing anything but they wouldn't go away, so in the end I accepted what they wanted me to do. I believe it was OK - I think they were from Microsoft. (Sorry, I have a hard time remembering names and terminology).

One of the sites is a 'pop-up' site, they want you to subscribe so they can block pop-ups for you.

I haven't had blue screens but twice I have had something that looks like binary coding overlaying the web page I am on - usually here.

I am having problems with typing - letters getting missed out.

I am just off to try your new suggestion - thank you.

I downloaded Spybot Search & Destroy but when I tried to install it I got that horrible clunking sound and a message:

A connection to the Server could not be established

I'll keep trying - thank you again.

That is very odd.

It shouldn't need a connection unless you are trying to run updates.

Is there any way you can take screen shots of what is going on in general? It sounds as though your computer has been hijacked, but then again there may be something else going on.

You mention the site that wanted you to download a pop-up blocker. If it was forceful and pretty much gave you no way out then that is likely where the problem started. Unfortunately alot of those utilities are rather aggressive and hard to get rid of if you don't know what they are specifically. See if anything off the following site sounds familiar. www.411-spyware.com... Look through the previous entries as well beacsue There is a lot of things out there just to trick you into spyware. One in particular struck me as similar to what you described and that is security system protection control panel. It fakes something similar to windows security center.

If any of these problems occurred before the download you may also want to download something to test your hardware. www.hiren.info... On this page is a download for a bootable cd that will give you various hardware testers and such.


Hope this helps! Keep me posted I will help as I can.

[edit on 1-1-2009 by dantrav]

What I use is AVG anti-virus. The free edition. I got hit once with a virus that gave me a fake "security center" pop up. After running AVG took care of it.

Download site for AVG free

If the virus blocks your download of updates here is a site where you can download manually the latest update for AVG here

I hope that this is of help.

Sounds to me like the Antivirus was trying to update it's definitions and the virus was blocking it. Sneaky.

I know that the AVG comes built in with a virus definitions. It might be new enough to deal with that threat. I wish you well.

Thanks everybody for all the time you have taken to help me.

I tried to download the AVG Anti Virus Free Edition from safer-networking (or www.downloads)since I couldn't get the Spybot and a message came up from Microsoft saying they wouldn't let me have it.

Then I got a Microsoft Security Warning and they asked me to download Antivirus 2009, which I did even though that's the one I downloaded a couple of nights ago. After it was downloaded it switched off my computer and I've spent all day trying to get it started up in Normal Mode which it won't. I can only start in Safe Mode, then this evening I tried to start in Safe Mode with Networking and that worked. Although I had to try a couple of times to get onto the Internet.

Oh, before I forget when I go to turn off the computer (having started it in Safe Mode) I get the little box coming up telling me it's closing a programme before switching off - twice. Except, I've got not programmes running that I'm aware of.

The Microsoft Anti-Virus identified 3 things, which I'll list. The first one they labelled 'CRITICAL'.

Spyware.\Emonster.b
Z.lob.PornAdvertiser.Xplisit - (how charming!)
Trojan.InfoStealer.Banker.s



[edit on 2-1-2009 by berenike]

reply to post by berenike


I don't know much about PC's as I use a mac. (you might want to consider a switch as I never have any of these issues and have never spent a dime in security software)

Having said that I remember similar issues from a few years ago when I used XP.
First, anytime you get those security pop ups from a third party they are always aggressive spam. I remember always having to force quit explorer to make them stop.

My recommendation is the following: If you are able to or have already saved your personal files from safe mode, and you have the cds/dvd of all your installed software, then go ahead and do a complete OS re-install. I know it might sound like overkill but my experience with these things is that once they have crawled into the OS they are next to impossible to completely flush out.

After a re-install get an aggressive security system, I can't recommend one cause I'm out of touch with Windows software.






[edit on 1/2/2009 by schrodingers dog]

It sounds like the anti virus utilities is the problem.

I am not 100% certain, but i don't know of anything called "Microsoft Anti Virus." I know there are utilities by Microsoft, but none of them named just that. Microsoft's anti virus is called "windows live one care." Below is a list of possible culprits. See if any of these match the description. (The first link sounds like it is it.)

www.411-spyware.com...

www.411-spyware.com...

I hate to say it, but if the issue persists and nothing on 411-spyware matches the description of what you have, you may want to do a re-install of your operating system. That honestly may be the best bet. You will loose anything you haven't backed up, but you will be able to start with a clean slate. It is a last ditch thing to do though as i am sure there is a way to solve this.

If you take that route immediately after doing so download the Spybot Search and Deystroy and it will inoculate everything preventing those issues from even starting.

If you can take screenshots of what is going on i will likely be able to identify the problem. I understand if you can't as spyware literally immobilizes your computer alot of the time.

[edit on 2-1-2009 by dantrav]

Try this to rid your machine of all the virus' and malware.

Please download Malwarebytes' Anti-Malware from the link below:

www.majorgeeks.com...

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
_____________________

And IF you are not able to download these tools on your machine, please use a friend or family member's computer and download the Malwarebytes tool and it's manual update from the link below.. Once downloaded, rename the program installer "mbam-setup.exe" file to something else like "Gogetum.exe", then copy the installer file and the update file to a CD or flash drive.. Transfer the file to the problem machine, then install the "Gogetum.exe" file, then run the update to get the program current.. After that, run a full system scan and delete anything it finds.

Malwarebytes Download Link (Clicking on the links below will immediately start the download dialogue window.)
www.besttechie.net...

Malwarebytes Manual Updater link
www.malwarebytes.org...

____________

Source


I have used those links, they do work if you follow the directions.

Good Luck.

[edit on 2-1-2009 by elevatedone]

I've been on ATS for a little while and got a box saying:

DrWatson Postmortem Debugger has encountered a problem and needs to close. (Then the option to tell Microsoft or not)

Then everything froze and I had to do ctrl alt del to get out.

I will copy all your suggestions and have another go at fixing this tomorrow.

I've been wondering whether I'll need to get a new computer, but then I don't know how to get my internet service back.

I'm just not very technically minded unfortunately. But I'll definitely take on board the suggestions to be better protected next time. Curses heaped upon my housemate who swore we had adequate protection from our server.

It's great out here in the country miles from anywhere...... If I get a new computer I'll have to try and order it online while I still can.

Thank you all again - I'm so grateful.

Just a thought, there's lots of helpful advice here that may benefit other people. The thread title doesn't do justice to the content, if a mod would like to re-name it so others can pick up on it I'd be more than happy.

I just had a go at the 411-spyware and it said a 'rootkit infection' was trying to block the scan.

Anyway, eventually the scan as done and I wanted to register and pay for the protection.

BUT, I put all my credit card details in and they weren't accepted. It said my address was incorrect. Upshot is, I can't register.

My aol spyware just popped up to say 'no infections found' - thanks.

I will start to put all my 'stuff' onto discs, thanks for that suggestion. It hadn't occurred to me.

Oh, the scan thingy wanted to reboot my computer, which it did perfectly.

I checked the security system protection control panel - that's one of the things that came up. I seem to remember I was suspicious of that, but can't remember if I just got rid of it or let it do a scan. The night the problems started these things kept coming up and wouldn't go away.

[edit on 2-1-2009 by berenike]

reply to post by berenike


DO NOT GIVE YOUR CREDIT CARD INFO

for spyware removal....

you can do it for free....

that is a ripoff, you'll lose your money.

Use the links I provided, they'll work.

reply to post by elevatedone


I can't get into majorgeeks - I tried the other links in the article you posted but I can't get into them either.

I don't know anyone else with a computer and I don't think I can download things from the library or internet cafe.

I would pay for the service because it seemed the easiest solution.

reply to post by berenike


It's really sounding like it is time for the re-install.
Save your files on an external hard-drive or a virtual one on the web and do it.
Truth is after a while if you keep using different cleanup/spyware tools those tools themselves will start conflicting with each other and the OS.
Re-install and commit to one protection tool. I'm sure other qualified members will be able to point you to the best one.