Computer is so messed up. Please help.

[Jennie_distress]

Hey guys,

I am beyond the point of despair now. Let me explain what happened:

Just several hours ago my AVG detected ardamax keylogger. I quarantined this keylogger and rebooted my computer.

Upon start up, my computer no longer works. If I open internet explorer for the internet, I see my homepage. If I try to go to another other site or links, a new window opens up. This new window is just a blank white page with nothing in it and freezes until I ctrl+alt+del. But even then the task manager shows no applications.

Nothing will run, not word documents or any programs (They all respond in the same way by opening up a new blank window and freezing). Basically I’m reduced to waving my mouse on the desktop and clicking on icons which then freeze up on starting the application.

I can’t download any windows updates because explorer won’t work, or any anti virus programs to remove ardamax. Even cds and USBs can’t be opened.

I have tried a system restore, but always end up with ‘this restore was unsuccessful’.

I can’t even start in safemode, when I F8 from reboot, it simply takes me back to normal windows mode.

I have also noticed that the icon for internet explorer is a ‘file unknown’ icon instead of the blue ‘e’ (A minor detail but I thought it prudent to add in).

If anyone can share similar experiences and how they solved it, or any technical advice it would be much appreciated. I have so much college work saved on this computer and I absolutely can’t afford to reformat it and have been reduced to an embarrassing crying wreck.

Please help! I’ve been up all night on my room mate’s laptop trying to solve this problem.

If it helps, I am also using windows XP (sp2)

 

[CCT]

And if you click Start, All Programs and launch IE from there?

Or Start, All Programs, Accessories, System Tools, Internet Explorer (no add ons) ?

 

[gbhall]

All those symptoms are fully consistent with a virus, which has infected the windows start-up files such that your PC cannot load anything (even safe mode command prompt) without the virus being present. This includes all your anti-virus and anti-spyware programs, which can often work, say they have removed the virus, but it comes back immediately.

Read this, it is typical http://www.spywareinfoforum.com/index.php?showtopic=114257

To which the only real solution I have ever found is to boot Windows from an install CD. Also have a copy of latest spyware removal, such as 'combofix' on a USB stick. You can boot ok to the recovery console, because the CD cannot possibly be infected.

You are then in a kind of Dos mode, in which you can manually delete the spyware and do other limited things, enough to get to the point where Windows can eventually run the combofix.exe from USB, which will (usually) clean the PC completely.

I mention the link because this is a recent and successful spyware which evades AVG. The point is to find the name of what you need to delete. It can typically be

C: \ WINDOWS \ system32 \ ntos.exe - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted
C:\Documents and Settings\LocalService\Application Data\wsnpoem\audio.dll - Deleted
C: \ Documents and Settings \ NetworkService \ Application Data \ wsnpoem \ audio.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted

Your first, utmost prioity, however, is to do backups, because ultimately, you may have to reinstall Windows. You have now learned the lesson few ever seem to learn until it is too late...backup...backup often...backup every day. How to backup when you cannot run anything, you say? easy peasy, you mount your hard drive in a friendly PC as a slave, and copy your work off.

Once you are running again, buy a cheap USB backup drive, and use it.