So last night i was playing WOW (I deserve a virus for that alone) and my computer froze, completely, no Alt-CTRL-Del, nothing. Although this is pretty damned rare I was tired so i hit the reset button and walked away.
When i woke up this morning i had 24 IE windows open, several error prompts, my Virus detector was going crazy (AVG), ad's everywhere, my background had been changed to a red and white "your windows is not genuine", and WGA tooltip was poping up and down like it was on crack. (My windows is actually genuine)
I Hit the Power button. Since then i have not been back on my computer in regular mode. Everything Detailed here is in Safe Mode, in an administrator account.
In Safe Mode With Networking, the system is a little quieter. The only thing noticably wrong is that the WGA tooltip is still running, and that my computer restarts itself after about 5 minutes, after a window that pop's up saying something about a fault error, and that the computer must shut down in 60, 59, 58.... etc.
I've managed to run hijackthis. I know how to use the program fairly well. I found a number of suspicious entries in both the registry, BHO's, and other areas. i got rid of them and deleted the source files (all in /windows and /windows/system32/)
i cannot install any software or anti-virus-adware-malware programs. When i try the computer says "the admistrator has policies to prevent this action"
When the computer reboots itself, the virus does not seem to re-propogate itself, but the WGA popup and the time limited boot are still in effect. I'm still in safe mode though, so i'm not certain i'm clean. The time limited boot only happens when i'm in the actual ADMINISTRATOR account, and it does not always give me the 60 second warning
What else can i do? Solutions must be short, as i only have about 5 minutes per boot to execute them. I can post a hijackthis log, but i'm not sure where i'm supposed to do this, because you have a separate forum for them.
EDIT: I just found a bunch of links on another accounts desktop, they all link to viruswebprotect---2008.com
EDIT2: More developments. I just noticed that beside my clock is the words "VIRUS ALERT".
Edited by seanb, 16 October 2008 - 10:14 AM.