In addition to demanding that she buy their poison, WPP disabled Firefox and Windows Explorer, plus whatever onboard virus protection software she had.
She had Netscape installed, though, and was able to access the internet through it.
I visited this site and printed out the removal instructions and followed them. We downloaded fixtm.reg and fixexe.reg, as well as mbam.exe.
i was never able to get mbam to run on her computer, though, but after a number of efforts (i.e., reboot, fixtm.reg, delete the 2 files from processes list, then fixexe.reg, then an abortive attempt to run mbam), we noticed that WPP and svchast.exe had disappeared from the processes list on task manager. The extortion demands stopped and access to all functions seemed to be restored.
Two days ago, though, she told me she can't access the internet - in fact, she can't even open any of her browsers, even Netscape.
I ran Avast, and during the memory and startup check, it hangs up when scanning svchast.exe. However, when I look a the list of processes in task manager, svchast.exe isn't there, and there's nothing that looks like Windows Police Pro, either.
I rebooted and ran fixtm.reg, and then accessed task manager, but svchast still wasn't there.
I tried running mbam but it hung up after 1 or 2 seconds. The most it ever scanned was 2 files. More recently it displays an error message: "An error occurred. Please report the following error code to the Malwarebytes Anti-Malware support team: 703(0,14)." Sometimes the error code is 703(0,13) or 703(0,9).
I've used something called Startup Mechanic to keep track of startup items, and it hangs after a while, but it didn't display anything that looked like svchast.exe.
I'm assuming that the current problem is related to the previous problem. Because we can't access the internet from that computer, whatever tools i download have to be on a flash drive from this computer.
This is getting frustrating, as I'm sure you can imagine, and i sure would appreciate a hand!
Edited by Dale in GA, 17 October 2009 - 12:03 PM.