BleepingComputer.com: Tried to remove Personal Shield Pro but failed

Hi everyone,

I'll try my best to be precise but please bear with me , I am an end-user and could misuse a term or three. If something is confusing or just plain wrong terminology please let me know. I apologize for the length too, I'm just trying to give as much info as I can.

Earlier this evening my Dell (Windows XP Home) was infected with the Personal Shield Pro virus. All icons disappeared from the desktop and taskbar and most programs ceased to function. Desktop background turned blue. Internet Explorer still worked and I followed the advice in this topic:

http://www.bleepingcomputer.com/virus-removal/remove-personal-shield-pro

After the restart following the Malwarebytes Anti-Malware scan, most issues were resolved initially. My icons reappeared on my desktop, and my background reverted to the correct image. Some problems persisted:

1) My quicklaunch icons did not appear on the taskbar but the space for them was still reserved (ie there was still the space between the "Start" button and the first box for programs running)
2) My Start Menu had issues - when I selected "All Programs" the list was severely shortened. Most programs did not appear, only the most basic such as the Accessories option, and a couple of games I had installed, so I know they're being hidden. Where my list used to span the height of my monitor, it was now roughly 8 entries long (more on why I say "roughly" in a moment). The programs still appear in My Computer.
3) Google redirected to various sites from the Search Results screen.

While I was opening a topic here for help I was suddenly RE-infected by a cosmetically different virus, "Security Protection" which also ran a bogus scan and listed scary sounding infections. It opens automatically upon booting up.

Now, no programs will run in Windows, from IE down to Notepad, so I cannot even pull logs in Windows except in Safe Mode. When I tried to run Malwarebytes in Safe Mode the virus kicked back in (it didn't start immediately upon booting).

The friend who set this computer up for me installed Ubuntu as well so I'm currently running in Ubuntu which works fine, and I can see the hidden programs fine here. I can pull the logs from the attempted removal, and one Quickscan from Malwarebytes I did right after restarting but currently absolutely nothing works in Windows.

Um, help, please?

This post has been edited by th3d00d: 07 July 2011 - 09:39 PM

While in Safe Mode with Networking....

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

Try to update and run MBAM right away.

Hi Broni, glad to meet you! Thank you very much for replying so quickly; I'm wicked impressed with this site! You guys do a good thing here.

In Safe Mode with Networking, I ran Rkill.com from the first link and it seemed to work just as described in the topic "What it does and doesn't do". At the end, the message that appears when I enter Safe Mode reappeared as Rkill finished running. The log's list of processes terminated was empty. I tried running MBAM but it immediately activates Security Protection and then no programs work, no MBAM, IE, notepad, etc.

.scr and .exe did the same thing.

Currently I'm back in Ubuntu to post this reply.

With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread and post a DDS log HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!

Thanks Broni

I have followed the steps and posted here:

http://www.bleepingcomputer.com/forums/topic408479.html

I really appreciate it!

Thank you

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.