FakeAlert Trojan-Can't Log on to computer

First topic message reminder :

It seems my computer became infected with the FakeAlert Trojan (Internet Security 2010) several days ago. It had prevented me from running Taskmgr and initially seemed to prevent me from using regedit to change settings for taskmgr. After a few attempt to run regedit I was finally able to. Before discovering this site I located a site that gave directions on how to manually delete files associated with it and edit Registry settings. I followed the directions and was able to locate and delete everything except helper32.dll file. I decided to disable helper32.dll before rebooting the computer in safe mode. My attempts to re-boot have failed. When I re-boot in safe mode I cannot use my mouse or keyboard. When I re-boot normally, I get logged off immediately after trying to log on to my user account or others on my machine. I assume my next step is to re-boot from a re-boot disk if possible. I do have the reinstallation CD from when I bought the computer but i'm not sure I can use it to boot up the computer without losing all my data on the computer. What do I do??? Once I am on the infected computer I will then run Hijack This for additional help removing the virus.

Yes.

Just got home from work and typed in the command...

I get the message:

Alert!

There is no A: diskette drive defined in the CMOS!!

Some viruses, such as ExeBug use this trick to prevent a "clean" boot from a floppy.

In the event that this computer really does not have a drive A: or has an external floppy drive (as Compaq Aero does), you need to run F-PROT with the /NOFLOPPY command-line switch.

Otherwise you should fix this problem with SETUP, save the changes, turn the computer off and boot from a "clean" diskette before running F-PROT.

Since I don't have a drive A:, do I just follow the directions and add that the /NOFLOPPY to the command sequence?

Yes, please add the nofloppy command.

I've tried it twice with; with the /nofloppy at the end of the command line or after the /hard. Both times I get the message:

Error: SIGN.DEF not found

Do I re-boot and try again?

Let me look in to it. Sorry this is so complicated, but this happens when trying to do diagnostics.

No problem. I am extremely appreciative of all the help you are giving me. I will await your response.

From what I have been reading F-Prot and about sign.def, this is a signature definition file that is supposed to be downloaded when F-Prot is loaded from the UBCD. When I was loading f-prot I received a message a few times that it was unable to establish an internet connection (I don't recall the exact wording). Is this the problem? I use Comcast as ISP with cable modem and Linksys router to connect.

I am aware of that, but I am researching the ability to patch the CD, to include the sign.def, instead of wasting time waiting for it to get the file from the internet...when it won't connect.

#BUMP#

Seems that we have reached a dead end.

We have tried what could be done, but unfortunately, this infection could have disabled your network card, and totally infected some of the core system files that are required for Windows to boot.

With these infections, the best thing to do is a reformat and reinstall.

There are options:
1. Get a Windows install disc from a friend, or buy one. (If you don't have it)
2. Get a free operating system, called Ubuntu Linux. It is a fast, friendly OS that is aimed at making computer life easier. It can be found at Ubuntu.com.
A tutorial on installing Ubuntu can be found here: [You must be registered and logged in to see this link.]

=====

We have both been patient, but it seems we are seriously wasting time.

I wish Windows were made to be more stable, but unfortunately it is not.

The good part about Ubuntu Linux is that it has a stable core, which means malware is unable to infect the computer.

Is there any way I can recover files from the hard drive before re-formatting?

Yes. You can use Ubuntu as a LiveCD, which means you do not have to install it right away to use it. You can transfer files using the LiveCD.

Here's how:

Burn the disc as the installation says, then use it to boot the computer. The computer should recognize the disc and boot from it.

Now, on boot you will see a language selection screen. Choose the language.

You will see option on the menu. Select the one that says "Try Ubuntu without any change to your computer."

It will then begin loading Ubuntu from the disc.

You will then see a "human" background. Select at the top "Places" and then down to Computer.

It will display all of the drives. You can freely access that data and transfer it to an external drive or flash drive. It will probably be labeled "00 GB Media" - that is the hard drive. If you see another drive in there, like a flash drive then it might say "00 GB Media" as well. Try to tell the difference. (00 is just a generic idea for the number of GB in the drive)

Plug the flash drive in, and copy and paste the files you want from the hard drive on to the flash drive/external drive.

Ask questions if needed.

First of all, Thank you so much for all of your help. I truly appreciate it.

Second, on to business...

I successfully transferred files to a flash drive using Ubuntu. I have a few questions at this point.

1) what do I need to do to ensure that the files on the flash drive are "clean". The files include a lot of photos, Word and Excel docs, emails and attachments (I use Eudora) and a large database. Is simply scanning using Avira (on this other computer) sufficient?

2) I have a re-installation CD for Windows. Can I use this to re-format and re-install Windows?

3) While checking out Ubuntu, I discovered that I am able to access the internet and reach my email account. Am I able to exploit this to clean up the computer without re-formatting?

1. Scanning using an antivirus is sufficient.

2. Yes that CD can do the job.

3. You are able to use Ubuntu to do your Normal tasks. But, due to the complexity of the issues here, it is hard to tell what system files are infected that are preventing Windows from booting.

Thorough recovery is probably not possible due to how damaged Windows was. The best thing to do is reformat and reinstall to make sure your system files are intact and you have a nice clean feeling.

I rarely ask people to do this task as it is a "final way out" - but if I was able to help disinfect those system files, then I would have to know which ones are damaged. And since your computer cannot boot, except from the LiveCD, you cannot get blue screens which would tell us what is wrong.

Indeed this is a crazy situation, but the feeling of having a totally clean computer with a fresh install is incomparable. Once you get it set up, get a good security load, to further keep yourself safe on the Internet. I promise you, it will not be a bad decision.