a virus has hijacked my internet, HELP!!

baron777red

i was trying to download some music and thinki inadvertently downloaded a virus onto my pc, i now cannot get access to any websites, my homepage has changed, items have dissapeared from my desktop, my C drive has gone from my computer, and i am not able to access control panel, searcj, run or all programs

i ran a virus scan with mcafee, and it found nothing, i ran a antispyware and malware scan with system mechanic (and a pc repair) and it found nothing, i tried to do a system restore and it did not give me any restore points to use (this was after reverting to start mentu to classic windows)

ive tried to restart my PC,but nothing,

the virus keeps displaying error messages saying that there has been an attack on my internet and it has disbled task manager,

how can i remove this virus?

will i need to re-install windows?

ive got most of my files and folders backed up on an external hard drive.

thanks

baron

murph71

Boot into safe mode before doing anything and rescan your system. Make sure your Antivirus definitions are up to date before you scan.
Check your hosts file as well as homepage hijacking often goes hand in hand with unwanted entries being added here.
You may be able to use system restore in safe mode if it was switched on and restore points have remained intact but you should remove any offending files first as they will still be on your system somewhere, even after a restore.

Browntoa

download this onto another pc and burn to a CD

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Browntoa

or if that not possible then this will let you boot from the CD drive and virus scan

http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html

Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore. Thus it is possible to:

• repair a damaged system,
• rescue data,
• scan the system for virus infections.

Just double-click on the rescue system package to burn it to a CD/DVD. You can then use this CD/DVD to boot your computer.
The Avira AntiVir Rescue System is updated several times a day so that the most recent security updates are always available.

Reluctant_spender

If you can start post a hijack this log also;

Click here to download HijackThis.
Save HJTInstall.exe to your Desktop.
Double click on the HJTInstall.exe icon to start the program.
By default it will install to C:\Program Files\Trend Micro\HijackThis
After the final dialogue box it will launch HijackThis.

Click on the scan button. It will scan and then ask you to save the log.
Save the log, and post me it in your next reply.

aliEnRIK

What program where you using? Can you describe what happened?

baron777red

hi i can't thank browntoa enough, your a life saver, malwarebytes removed the virus completely after i ran a scan.

the virus was antivirus 2009

thanks

Browntoa

good old antivirusxp2009 !!

do one of these hijackthis logs for me

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

so I can see if there are any other nasties hanging around

MrsE_2

Browntoa:beer:

Can I just say I'm in awe of how clever you are with tech things (& I'm NOT taking the mick).

Can I remember your name & come running the next time I have a problem?:o