System security problem

**jrfoy2** · **jrfoy2** on 22nd June 2009, 5:31 pm

I have downloaded anti-virus programs but the virus won't allow me to run them. I opened the first time users guide here and it wouldn't let me open the Java download either.
Help.....
John

**Origin** · **Origin** on 22nd June 2009, 5:53 pm

See if you can run HijackThis:

Please download the current version of HijackThis from HERE

Double click and run the installer.
It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
After installing, you should get the user agreement, press accept and Hijack This will run.
Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.

**jrfoy2** · **jrfoy2** on 22nd June 2009, 6:10 pm

Still blocked it.
John

**Origin** · **Origin** on 22nd June 2009, 6:40 pm

Download IceSword from here:

http://rapidshare.com/files/246323341/IceSword.exe

Tell me if it stays open.

**jrfoy2** · **jrfoy2** on 22nd June 2009, 10:01 pm

I still get the "warning the file you are opening is infected" on lower right when I try to open it. It starts to open for less than a half second and stops when the warning comes on. This also happens when trying to open a program like Window Washer on the windows screen. It also delays getting onto IE but finally lets me on.
John

**Belahzur** · **Belahzur** on 22nd June 2009, 11:29 pm

Hello.
Right click the IceSword you have now, select Rename. Rename IceSword.exe to winlogon.exe and see if it will run now.

**jrfoy2** · **jrfoy2** on 23rd June 2009, 2:57 am

couldn't open it as winlog.exe either. It opens momentarily then goes away.....CRAP
I'm donating anyway. Thanks for trying so hard for someone you've never met. A great service. I need an updated computer anyway.
John

**Origin** · **Origin** on 23rd June 2009, 4:16 pm

See if you can run ComboFix:

Download combofix from here
Link 1
Link 2

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:

3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

See HERE for how to disable your AV. (Mcafee)
Double click on ComboFix.exe.
Follow the prompts. NOTE:
ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
Allow combofix to run
Post C:\combofix.txt back here.

Note:
Do not mouse click combofix's window whilst it's running. That may cause it to stall.