horrible virus...please help.

[Jimbo73]

i downloaded what i thought was a package of office programs, as i needed to do some work beyond my current tools, and instead got a very nasty virus. the first things that happened -

it changed my wall paper to a biochemical sign saying my computer is infected blah blah

it changed my desktop icon fonts

it didnt make tons of popups, but a few, all of them saying something along the lines of " your computer is infected " or " get privacy now " " malware has been detected ! "

it changed my IE homepage and keeps coming up with all kinds of crappy windows / popups

it made an administrator account, i can't delete it from mine as it doesn't show up when i go into account options.

it keeps opening random folders

solutions -

ive run trojan hunter, nod32, hijack this.

nod32 got nothing but TONS of locked files.
trojan hunter got 3 trojans.
here is my HJT log

 

[howard_hopkinso]

Hello and welcome to Techspot.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard :wave: :wave:

This thread is for the use of Jimbo73 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Jimbo73]

howard you keep deleting my posts. when i try to post my hijackthis log, it says i need the posts. it contains links or something, and i can't post it. please stop..

edit - DLing avg now.

 

[howard_hopkinso]

You need to follow the instructions I gave you and post the requested log files etc as Attachments.

You won`t have a problem if you post them as attachments.

Regards Howard

This thread is for the use of Jimbo73 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Jimbo73]

im following the steps, couldnt do the IE scan due to all these popups and it keeps switching pages.

 

[howard_hopkinso]

Ok, no problem mate, just skip that and carry on with the rest of the steps.

Regards Howard

This thread is for the use of Jimbo73 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Jimbo73]

attached should be the hijack files

the second should be as it's renamed Crust. it came out very strange when attaching though o.O

 

[czplayer]

well this virus on your pc sounds like a huge ***** and if you cnat even run anti
virus stuff and what not because its too slow then i would suggest fining your
cds and reformating

but if you can fix it with it reformating then go for it im just puttin that option in
front of you

 

[howard_hopkinso]

I don`t know why you found it necessary to post two HJT logs, but we`ve already established that your system is infected.

Follow the instructions, then post the requested log files and let me know the results of the Panda Antirootkit scan.

Until you do that, I can`t help you.

Regards Howard

This thread is for the use of Jimbo73 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Jimbo73]

search and destroy stopped the browser popups, but im still getting little bubbles / folders. scanning with it now, and avg hasn't picked anything up yet.

 

[howard_hopkinso]

No need to keep posting giving progress reports, unless you have a problem.

Just try and complete the instructions and post what It asks for.

Regards Howard

This thread is for the use of Jimbo73 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.