Ex-wife's PC is down for the count

[Mergan Bandez]

Yup I warned her but it has finally happened and PLEASE do not ask me why I am helping my Ex-wife, thank you .

 

OK so here it is: Her Security by MacAfee has expired (she forgot OK?). The PC does the restart/shut down thing and we do have her restarting in Safe Mode but we cannot download anything which will then delete the demons . Is this normal in Safe Mode? Or should we be able to access something from PIT?

 

Thanks very much for your help, this may save me from being constantly bombarded by the EX

[ReecoSuave]

When you tap F8 on startup to get to safemode you need to choose "safemode with network connection"

 

Another way to do it would be to go to start on your taskbar > run > type "msconfig" without quotes and hit enter > under BOOT.INI check /safeboot and the network box. Close and restart

 

this should give you the abillity to download install and run any program you want.

 

 

 

I recommend you download Malwarebytes from http://malwarebytes.org it's one of the best free malware scanners out there. If you have further issues which is virus related i would recommend making a post in the virus section of the board. They have trusted advisors that can be of more help

Edited November 24, 2008 by ReecoSuave

[law9933]

You also could burn to CD on a good PC, then install, run & then update, run again.

 

May I suggest MalwareBytes & SuperAntispyware.

[Mergan Bandez]

When you tap F8 on startup to get to safemode you need to choose "safemode with network connection"

 

Another way to do it would be to go to start on your taskbar > run > type "msconfig" without quotes and hit enter > under BOOT.INI check /safeboot and the network box. Close and restart

 

this should give you the abillity to download install and run any program you want.

I recommend you download Malwarebytes from http://malwarebytes.org it's one of the best free malware scanners out there. If you have further issues which is virus related i would recommend making a post in the virus section of the board. They have trusted advisors that can be of more help

 

 

I'll try this tomorrow. Thank you kindly. ReecoSuave. A much needed response to a heck of a problem. I'll get back as soon as I can & it may be a day or 3. Thanks again.

 

Mergan

[Mergan Bandez]

You also could burn to CD on a good PC, then install, run & then update, run again.

 

May I suggest MalwareBytes & SuperAntispyware.

 

Yes that is also a very good option. Thank you law9933. If the suggestion from ReecoSuave does not happen for her, I'll download with my PC & burn then give to her. Much appreciated.

[Mergan Bandez]

When you tap F8 on startup to get to safemode you need to choose "safemode with network connection"

 

Another way to do it would be to go to start on your taskbar > run > type "msconfig" without quotes and hit enter > under BOOT.INI check /safeboot and the network box. Close and restart

 

this should give you the abillity to download install and run any program you want.

I recommend you download Malwarebytes from http://malwarebytes.org it's one of the best free malware scanners out there. If you have further issues which is virus related i would recommend making a post in the virus section of the board. They have trusted advisors that can be of more help

 

I'll follow up with this so if you feel this is virus-related let me know & I'll take this to the virus forum as you have suggested. We have downloaded the mbam-setup & while on my PC I get the select which language, my ex-wife gets nothing after opening the executable file. It simply disappears.

 

So what would you recommend next?

 

Thanks.

[ReecoSuave]

 

I'll follow up with this so if you feel this is virus-related let me know & I'll take this to the virus forum as you have suggested. We have downloaded the mbam-setup & while on my PC I get the select which language, my ex-wife gets nothing after opening the executable file. It simply disappears.

 

So what would you recommend next?

 

Thanks.

 

 

Have you tried copying the program to her computer instead of installing directly from the CD? If not try that and install again.

 

If that fails try going to start > run > type "msconfig" without quotes and hit enter > under 'Start' uncheck everything. Then try starting normally

Edited December 3, 2008 by ReecoSuave

[law9933]

Thanks DRM for the re-suggestion. Is there something about renaming a program then installing, so malware does not know what is happening???

[ReecoSuave]

That i don't know. If you can start in safemode with internet connection. Try and see if you can use any of the online scanners http://eset.com/onlinescan . If you can't access your IE icon on desktop you can get to it by going to run > type C: and hit enter

 

If nothing i suggest works then i have pretty much run out of ideas. You could try and rebuild the boot file in case it got corrupted but that's a lengthy process. Let me know and i'll post how.

[law9933]

After the suggested & no new ideas all that is left is the HJT subforum if there are files that have to be saved. Otherwise a repair install or wipe & reinstall might be the last answer.

 

Better help may still come.

[Mergan Bandez]

Have you tried copying the program to her computer instead of installing directly from the CD? If not try that and install again.

 

If that fails try going to start > run > type "msconfig" without quotes and hit enter > under BOOT.INI uncheck everything. Then try starting normally

 

 

I didn't explain well: At her home, my Son is doing this while I am at my home trying the same, so we are on the same page together, When I downloaded the Malwarebytes antimalware setup, I could then click Run & I would be prompted to choose a language, while my Son did the same, downloaded online on her pc in network safe mode, that option did not appear for him nor did the program begin to execute.

 

This afternoon when I get home I'll try your next suggestion using the uncheck choices under BOOT.INI config. Again I'll be doing this from my pc while he is at her home on her pc. I have just burned the cd & will drop it off after work, then we can try that way also.

 

I'll get back to you guys, and thanks

[Joe C]

You might want to try to boot into safe mode with networking like suggested earlier and then do an online scan....There are some malware programs that block malwarebytes from updating and running properly. After you scan and it can clean anything up, you should try to download MB again from safe mode and try another install and update to run a quick scan

 

eset, kaspersky, trend micro all offer good on line scanners

[mme]

I didn't explain well: At her home, my Son is doing this while I am at my home trying the same, so we are on the same page together, When I downloaded the Malwarebytes antimalware setup, I could then click Run & I would be prompted to choose a language, while my Son did the same, downloaded online on her pc in network safe mode, that option did not appear for him nor did the program begin to execute.

 

This afternoon when I get home I'll try your next suggestion using the uncheck choices under BOOT.INI config. Again I'll be doing this from my pc while he is at her home on her pc. I have just burned the cd & will drop it off after work, then we can try that way also.

 

I'll get back to you guys, and thanks

 

try doing a chkdsk /r from safemode

 

Start Button/ Click Run/chkdsk /r/click ok

 

notice the space between the k and the /

 

At the command prompt type the letter Y

press enter

chkdsk cannot run at this time...another volume is using it

restart your computer....

This will take some time to run about 1 Or 2 hours

DO NOT DISTURB THIS

 

and run a cleaner

heres clean-up

http://www.stevengould.org/index.php?optio...9&Itemid=70

 

Start Button/Run/dfrg.msc/click ok

 

click defragment.......This will take some time to run about 1 Or 2 hours

DO NOT DISTURB THIS

 

If you cant install clean up from any safemode options

you can clean out the following files using Internet Options

From your Start Sutton on the bottom left of your screen

Go to Control Panel

Click on Internet Options

Under General Tab

Click Delete..Temporary Internet Files..Cookies...History... Passwords ..Saved Forms(Everything)

Then restart........try Windows Normally or Safemode with Networking

Try installing MalwareBytes Or cleanup

Heres another download to try and install

 

http://filehippo.com/download_superantispyware/

 

Update the program and run it

Save the logfile for the hijack forum

 

If you dont have a working or updated Antivirus Program

Download and Update this one

Run it and let it complete

 

http://filehippo.com/download_avast_antivirus/

 

Disable McCaffee 2 antiviruses running are no good

 

Hopefully this will help

 

GOOD LUCK

EDWARD

Edited November 25, 2008 by mme

[Mergan Bandez]

try doing a chkdsk /r from safemode

 

Start Button/ Click Run/chkdsk /r/click ok

 

notice the space between the k and the /

 

At the command prompt type the letter Y

press enter

chkdsk cannot run at this time...another volume is using it

restart your computer....

This will take some time to run about 1 Or 2 hours

DO NOT DISTURB THIS

 

and run a cleaner

heres clean-up

http://www.stevengould.org/index.php?optio...9&Itemid=70

 

Start Button/Run/dfrg.msc/click ok

 

click defragment.......This will take some time to run about 1 Or 2 hours

DO NOT DISTURB THIS

 

If you cant install clean up from any safemode options

you can clean out the following files using Internet Options

From your Start Sutton on the bottom left of your screen

Go to Control Panel

Click on Internet Options

Under General Tab

Click Delete..Temporary Internet Files..Cookies...History... Passwords ..Saved Forms(Everything)

Then restart........try Windows Normally or Safemode with Networking

Try installing MalwareBytes Or cleanup

Heres another download to try and install

 

http://filehippo.com/download_superantispyware/

 

Update the program and run it

Save the logfile for the hijack forum

 

If you dont have a working or updated Antivirus Program

Download and Update this one

Run it and let it complete

 

http://filehippo.com/download_avast_antivirus/

 

Disable McCaffee 2 antiviruses running are no good

 

Hopefully this will help

 

GOOD LUCK

EDWARD

 

Thanks Edward

 

We are at the stevengould cleaner & it actually downloaded & is running, so I am now hoping that the McAfee uninstall completely uniinstalled. And we can proceed. This is showing some progress. Thank you.

[law9933]

Did anyone mention McAfee has a removal tool?

 

http://www.pchell.com/virus/uninstallmcafee.shtml

[Mergan Bandez]

Thanks Edward

 

We are at the stevengould cleaner & it actually downloaded & is running, so I am now hoping that the McAfee uninstall completely uniinstalled. And we can proceed. This is showing some progress. Thank you.

 

 

Every link we tried gets us to a download but nothing can execute. We are stopped even with filehippo.com. Installing does not allow filehippo until .netframework 2.0 is downloaded & when trying to download a "Failed to Connect" message appears, which we have seen bunerous times now.

 

If you have any suggestions please let me know otherwise if this looks like a virus then I'll go to the virus forum, once I find it.

 

Thanks guys this is a real beast & I appreciate your detailed help.

 

Mergan

[law9933]

The Virus forum is mostly the same help as here, it is just the subject title.

 

The Virus subforum HJT Logs is where the masters of malware are located,but if you cannot download & run programs I do not know-results.

 

You can install a infected HD as a slave in a good PC & clean it that way???

[mme]

Check your Add/Remove programs

see if net 1.1 and 2.0 are installed

after you open Add/Remove

Put check in Show Updates

They should be listed as updates

If you dont have it download it from here

click save a and save it to desktop

 

Microsoft .NET Framework Version 2.0 Redistributable Package (x86)

 

http://www.microsoft.com/downloads/details...;displaylang=en

 

See if it can be installed later

 

Also see if you have windows installer 3.1

if not............ download save as or try to install

It maybe installed aready

 

http://www.microsoft.com/downloads/details...;displaylang=en

 

See if this online scanner will run

 

http://housecall.trendmicro.com/

 

Can you please tell us what Toolbars you got on your browser

right click on top of any blank/empty space on browser

in the White Box It show show...Menu Bar...Links ...Status...Lock Tool Bars etc:..........Does it show other toolbars......

Check in program files on C:drive What other type of toolbars may show

they can be folders....

this an example of one ....Mywebsearch....

 

Providing information of usual folders and toolbars can help....

Malware/hijackthis expert maybe able to help.........

 

GOOD LUCK

EDWARD

Edited November 26, 2008 by mme

[TheKastOne]

There are viruses that keep you from installing certain programs and also hijack your browser. My only suggestion would be to save any important files and boot from xp disc.

[law9933]

Sounds good & does not need installed?

 

http://majorgeeks.com/Hitman_Pro_d5283.html

[Mergan Bandez]

Sounds good & does not need installed?

 

http://majorgeeks.com/Hitman_Pro_d5283.html

 

Well guys I think by now I am fairly convinced that the worst has happened. I have tried everything you all have suggested, and every attempt has been prevented. Every download has started, looked good then as quickly been stopped. I think we have a virus & I am certain the browser, Firefox has been hijacked. It takes several attempts to get to a website link after failures to connect & we know that the home page always loads.

 

So I am going to ask now if anyone can direct me to a wipe utility, paid or unpaid which is trustable. We do have the cd with dell code from original purchase, so I'll hope that code is still executable. It's been almost 2 years though. Otherwise since my Son is a student we can probably buy XP @ a discount.

 

I want to thank you all for the input & your expertise in suggestions, and I'd like to wish all of you who celebrate Thanksgiving a happy Thanksgiving Day.

 

All the Best

Edited November 27, 2008 by Mergan Bandez

[law9933]

I am sure one of the HJT advisers have read your post by now with no input, so that is not a option, so you are right,sorry.

 

http://www.killdisk.com/features.htm

[adam22]

Hello..I'm not sure if this will work, but I think it's worth a shot. After following these directions, try to download some of the suggested programs or run an online scan here (you must use IE) and let us know how it went.

 

Download HostsXpert v4.1 and unzip it to your computer, somewhere where you can find it.

• Double click on HostsXpert.exe to launch the program.
• Click on Restore MS Hosts File to restore your Hosts file to its default condition.
• Click on Make ReadOnly to secure it against further infection.
• Exit the program.

Then, go to Start >Run and enter: cleanmgr

• Select the drive to clean: C:\
• Check the following boxes and then press OK to remove:
• Temporary Files
• Temporary Internet Files
• Recycle Bin

Agree to the prompt to perform the action. Edited November 27, 2008 by adam22

[Mergan Bandez]

Hello..I'm not sure if this will work, but I think it's worth a shot. After following these directions, try to download some of the suggested programs or run an online scan here (you must use IE) and let us know how it went.

 

Download HostsXpert v4.1 and unzip it to your computer, somewhere where you can find it.

• Double click on HostsXpert.exe to launch the program.
• Click on Restore MS Hosts File to restore your Hosts file to its default condition.
• Click on Make ReadOnly to secure it against further infection.
• Exit the program.

Then, go to Start >Run and enter: cleanmgr

• Select the drive to clean: C:\
• Check the following boxes and then press OK to remove:
• Temporary Files
• Temporary Internet Files
• Recycle Bin

Agree to the prompt to perform the action.

 

 

Many thanks, we will surely try this in IE but perhaps not till tomorrow as I don't want to disturb them today. So unless my Son calls I'll hold off, but thank you kindly. And we'll keep our fingers crossed.

[adam22]

Your welcome. I think that because you are having trouble going to certain sites and downloading/running security software, that your hosts file may be messed up. Restoring to the original will fix that, so if you can at least download that program and clear out temporary files you may be able to download some anti-malware software. Have you run any of her on-board security programs? Even if they cannot be updated, scanning in safe mode may still be of help. I'd suggest going with this order: first scanning with existing security software, then clearing out the temporary files, and then restoring the hosts file and then attempt to download the other security software that was suggested/run an online scan.