BleepingComputer.com: Virus Help

Hello administrator, I was wondering if i could receive a little bit of help in eradicating a pesty problem that I have.

several days ago I was at a website(i dont remember which one) and a video was supposed to play in windows media player but there was an error message that said 'click here to download proper codec for this video' so i downloaded and installed the codec......however, it turned out to be a virus.

now, an alternating blink between a green (wheelchair picture found in control panel) and a red (it looks like a stop smoking circle with a line drawn through it) icon. whenever my computer starts up, it is the first item to load into my lower right hand corner taskbar where the clock is. and a message pops up right above the clock area stating exactly:

critical system error!
system detected virus activities. they may cause critical system failure. please, use antimalware software to clean and protect your system from parasite programs. click here to get all available software.

when you click on that popup bubble....it opens up an internet site referring me to download Pesttrap, Spy Falcon, and various other spyware programs

i know that these additional programs are junk and is just more spyware/viruses...so i didnt download them.

to try to solve this problem i ran norton antivirus(albeit the 2004 version), ad-aware SE, windows defender, and AVG free edition........a couple items came up in AVG and i deleted them, but the little icon in my lower right hand taskbar is still showing up.

in addition, i read another post and downloaded noahdfear's smitrem, but that didnt delete it either

so my question to you is, how do i get rid of that icon from showing up and flashing a popup bubble asking me to download more infectious spyware?

i would really appreciate an answer. thank you very much

If the information below fails to help you, you may be might want to consider submitting a hijackthis log to the HJT Forum.

How to submit a hijackthis log

Download Hijackthis

Try running the following from safe mode (Getting to safe-mode) Sysclean you'll also need the virus template file from here lpt***.zip remember to extract the contents of the zip file into the same folder as Sysclean.com

or

DrWeb CureIT

or

KASFX which is powered by the Kaspersky AV engine, you will need internet access to update it. If you haven't got net access in safe mode, update it before you use it.

If your good with the command line also try Sophos Command Line scanner this command will scan all of your hdd's SAV32CLI.EXE -F -di -remove -dn -mbr -all -zip -p=avscanlog.txt and give you a log file to review afterwards.

Also try installing and running A2 Free and Ewido (Ewido Updates) again run from safe mode.

I'd also run Spybot(Spybot Tutorial) and Adaware

If your using Win2K/XP run adaware/spybot from "safe mode with command prompt" If your using Win9x just run it from safe mode the command line options aren't needed..

At the C:\ prompt type the following:-

cd\
C:\progra~1\spybot~1\spybotsd.exe /autocheck /autofix
cd\
C:\progra~1\lavasoft\ad-awa~1\ad-aware.exe

Other tools to try from Safe Mode
Trend Micro Spyware Scan you will need to run this with a internet connection first to get the updates.

Xblocker
[quote]

Hello ayhockey88

Try this:

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please download and install Ewido Anti-Malware v3.5. DO NOT perform a scan yet..
Print out the Ewido Install and Scan Instructions.

Go here and follow the instructions for using SmitfraudFix.
After using the tool reboot again in "SAFE MODE" and

Clean out your Temporary Internet files as follows:

• Quit Internet Explorer and quit any instances of Windows Explorer.
  
• Click Start, click Control Panel, and then double-click Internet Options.
  
• On the General tab, click Delete Files under Temporary Internet Files.
  
• In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  
• Click OK.

Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

Then perform a scan with Ewido and reboot back to normal mode.

If this does not resolve your problem, then post a hijackthis log.