Special Case of the Antispyware Soft Disease

**FearTheUnseen** · **FearTheUnseen** on 3rd June 2010, 7:59 pm

Here goes.
The pop-ups and everything started yesterday night. It has now progressed to redirecting me to porn sites. I have several users on my computer. Mine (admin) is the only one affected. I downloaded Mozilla on my father's account (not-so-admin) and put it on the All Users' desktop. That is how I am talking to you now. I also just fixed my LAN Settings for Internet Explorer.

I've tried the F8 thing.
When I hit F8 repeatedly before the start-up, a quick message flashes and says 'Keyboard failure'. I went to Safe-Mode as directed. Turns out, my mouse works fine.. until I hit a key on the keyboard. Then neither works. Hooray. This makes it extremely difficult to type in a web address or the like.

I downloaded the MBAM software as prescribed. First I did this on my father's account because I figured the trojan would prevent me from doing it on my Admin account. Well, turns out you HAVE TO be on an Admin account to download it fully. I can't even make my father Admin because the trojan prevents me from opening the User Account portion of the Control Panel.

I'm getting very stressed over this. Please respond with helpful advice ASAP.

Whoa!

**Dr Jay** · **Dr Jay** on 3rd June 2010, 8:44 pm

Hello, and welcome to GeekPolice.

Please note the following information about the malware forum:

Only Tech Officers, Global Moderators, Administrators, and Malware Advisors are allowed to give advice on removing malware from your computer.
From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
If you have already asked for help somewhere, please post the link to the topic you were helped.
We try our best to reply quickly, but for any reason we do not reply in two days, do one of two things:

Reply to this topic with the word BUMP, or
see this topic.
Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.

**FearTheUnseen** · **FearTheUnseen** on 3rd June 2010, 9:00 pm

I cannot access ComboFix. I get the error message saying that it has been infected.
I will try on a different account.. but I have doubts.

**Dr Jay** · **Dr Jay** on 4th June 2010, 3:45 am

Please download Malwarebytes Anti-Malware from Malwarebytes.org.
Alternate link: BleepingComputer.com.
(Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

Double Click mbam-setup.exe to install the application.

(Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If you are prompted to restart, please allow it to restart your computer. Failure to do this, will cause the infection to still be active on the computer.
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
The log can also be found at C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
Copy and paste the entire report in your next reply.

**FearTheUnseen** · **FearTheUnseen** on 14th June 2010, 3:34 pm

None of that worked.
Because I couldn't click on the icon in the first place.

But I fixed it on my own XD
Thanks anyways.

**Dr Jay** · **Dr Jay** on 15th June 2010, 12:42 am

Most of the time, when you have originally detected the malware issue, it means the computer is infected by malware of some sort. Antivirus scanners may not show a sign of the malware still being there, which could be a sign of a rootkit.

Whenever rootkit scanners, and antivirus software scan for the rootkit, it gets as close to the system kernel as possible. If the rootkit is beyond that point, it will not be detected.

So, the idea is, is when you post to a forum that you need help removing malware, it is best to stay with the helper, to ensure your computer is clean. However, it is up to you to continue or not.