TechSpot

Fake security pop up -- even in safe mode.

By danpf
Nov 9, 2007
  1. Starting 2 days ago i started getting fake security pop ups about viruses infecting the machine with links to a website for security software. Internet explorer also started by itself numerous times trying to get me to follow links. I followed the directions in a previous post here :

    http://www.techspot.com/vb/topic58138.html

    and followed all the directions. While doing some of the scans in safe mode, i continued to get the pop ups. After completing all the instructions i have just restarted this computer in normal mode and immediately get a message from internet explorer that I was not connected to the internet: work offline or try again. That was the last thing that has happened. I have not gotten any of the popups or explorer starting. (yet)

    here's my logs... i would appreciate any help/advice you can give.

    Thanks
    Dan

    attachments didn't post... i'll try it again
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Delete all files in AVG Antispyware quarantine.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Bodog Poker

    Close control panel.


    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Code:



    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

    [​IMG]

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

    Please open notepad and and copy and paste next bold in it:
    (don't forget to copy and paste REGEDIT4)

    Save this as "fix.reg" Choose to save as *all files and place it on your desktop.

    Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

    Regards Howard :)

    This thread is for the use of danpf only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. danpf

    danpf TS Rookie Topic Starter

    done...

    however when combofix was finishing and restarting windows a error message came up in a box:

    "nircmd.cfexe dll init failed"
    it said it was because windows was shutting down.

    here's the logs
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Code:



    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

    [​IMG]

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

    Regards Howard :)

    This thread is for the use of danpf only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. danpf

    danpf TS Rookie Topic Starter

    here's the new ones
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    All clean.

    Delete the following folder.

    C:\qoobox.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of danpf only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. danpf

    danpf TS Rookie Topic Starter

    Thanks tons for all your help!!!!!

    You guys are GREAT!

    This thread is now closed: If you need this thread unlocking, please pm a moderator with a link to the thread.

    Only the original thread starter can do this. Anyone else, will be ignored.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...