This started about three days ago.
First, the fake programs:
- Windows Antivirus Pro
- Advanced Virus Remover
- Some red X in the system tray that displays "Your computer is infected! Windows has detected spyware infection!It is recommended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you." (Don't know if this is part of one of the above fake anti-spyware programs or its own).
I've had one or two of them before. (Gotta love the obvious misspellings and grammatical errors).
Secondly, the Task Manager is disabled.
So I go ahead and try some virus programs. None of them can get a few seconds into the scan without terminating such as MBAM and SpyNoMore (from what SpyNoMore showed while scanning, I saw the file that disabled the task manager and "Advanced Virus Remover", so if I could somehow get that to do a complete scan, I'm pretty sure it could work.)
I came across a program that did, however, do a complete scan. It was called A-Squared. When I began to quarantine the files, though, the window where it says there has been a fatal error and Windows must terminate with the countdown from 1:00 occurs. After that, If I boot up my computer again, explorer.exe is gone AND the task manager is disabled. So I had to boot it up in Safe Mode with Command Prompt. I then took Browse function in the "Select program to open this with" window to my advantage by navigating over to my flash drive, running Task Manager Fix, and copying explorer.exe (which was copied from the computer in the living room) to my Windows folder (it was missing, but there was a fake "explorer.scf" that I deleted). I then ran explorer.exe through the Task Manager. However, unfortunately explorer.exe also enables the fake programs, disabling Task Manager again. If I were to run Task Manager Fix with explorer.exe enabled, I would be able to open Task Manager for about half a second and then says "This file is infected! Please activate your antivirus software."
I then tried A-Squared again, this time on "Deep Scan" mode, but ended up with the same unfortunate result as I had to do the Command Prompt thing once more.
And lastly, the next day (today), "Windows Antivirus Pro" joined the ever-growing epitome of annoyance (It wasn't there at the beginning). This fake program had me rendered unable to open almost any application I wish with a pop-up system tray message saying something along the lines of "Opening this file impossible. It is infected. Please run your antivirus software."
And yes, I tried to run DDS.scr. That would not open as well, so I cannot give you a HJT log at the moment.
I have, however, run GMER a couple days ago (I read about it on another site) and have the log for that if you require it. Sorry for the inconvenience.
This infection I give much applause to as it has been the first in all of my years of dealing with them to actually post on a forum for help. Bravo.
Your assistance would be much appreciated.
EDIT: I forgot to add, on startup there's always programs such as "838.exe" and other odd numbers crashing with the "This program has encountered a problem" and the error reporting system. They don't seem to have an effect on anything, though.
EDIT 2: Another thing I forgot to add. I have tried to reinstall Windows XP with the original disc. It however just freezes on the screen where you select if you want to install, repair, or quit.
Edited by Orange Blossom, 17 August 2009 - 10:33 PM.
Moved out of HJTLogs Forum - AA Moved back since it's picked up. ~ OB