The desktop is showing a new program called "Additional Guard". It is a fake antivirus-type program that has disabled my McAfee Online service, and it resists removal by Spybot S&D and Hijack This. I even tried manually deleting the hosts file, and was denied access. It would not allow me access to remove the "read-only" file attributes that the malware placed on the hosts file.
I'm obviously going to need someone to walk me through this process, as we have now exceeded my capacity on attempting to remove this malware. Many thanks in advance for your technical assistance!
The malware is preventing me from running either the DDS or RootRepeal on the infected computer. When I tried downloading directly from the link, the malware redirected my browser. When I tried transferring the files from a jumpdrive to the infected computer, neither is usuable. The DDS shows up only as a notepad file, and the RootRepeal simply will not install.
The "Additional Guard" program installed an icon on the desktop, which leads to a file in Documents and Settings/All Users/Application Data/39b4f5f named WI39b4.exe.
It is really grinding the desktop to a screeching halt -- it's not letting me do much of anything. I'm trying to run Spybot again to see what it is calling the remaining malware.
Ok, Spybot listed 3 items (one of which it was able to remove [again], but it will come back again -- attempted removal of the other two results in the error message "Cannot create file C:Windows/System32/drivers/etc/hosts. Access is denied"):
Win32.Delf.uv (this is the one Spybot can remove, at least temporarily)
Spybot had no information about what the WindowsProtectionSuite malware does, or where it resides on the computer. Spybot indicated that for the Delf program, that it is known to hide the various files in the Fonts folder, but I looked and saw nothing other than fonts (and I have the system set to see hidden files). I've already posted above about the access problems with the Hosts file.
Hope this provides a bit more info that is useful.
Merged 3 posts. ~ OB
Edited by Orange Blossom, 08 December 2009 - 10:11 PM.