I think I'm in way over my head, but...

[Goldenvoice]

I think I'm in way over my head, but...

Well, a "friend", if I can still call him that, thought he'd download and install a VST plug-in for use in Reaper (recording program). Once we fired up Reaper, and scanned VST's - whammo.

Anyway, what this bug does, among other things, is made both AVG and Spybot crash upon loading. Also changed things like how 'my computer' screen displays.

I'm not a total computer dummy, but not far off either. AVG will neither un-install, nor function. I can't re-install it either. Trend micro's Housecall won't run...

I tried System Restore - a hand full of points - but it wasn't able to restore the system.

I've tried to start in Safe Mode - but get the dreaded Blue Screen, saying there's a virus, and so won't start windows...

Is there a magic pill for guys like me? Or do I just re-format, and re-install XP, and pretend I got a new computer?

Also, is this bug likely to write itself to any files I back up from this point?

Thanks so much - it's been a long day.

G

 

[Osiris]

Can you access msconfig?

Go to start, run type msconfig and press enter. Then go to startup click disable all and then reboot.

Let me know if that changes anything and we will go from there

 

[Goldenvoice]

oK, did as you say, and upon restart, after the initial 'warning - you changed' window, the System Config Utility comes up. The first time around, I simply hit OK, and checked thinks out - seems no change.

Now I've restarted again, and simply left the System Config Utility up, without hitting anything...

 

[Osiris]

Can you download combofix and then malwarebytes and run them in that order and post their logs?

What OS you running?

 

[Goldenvoice]

XP Home SP3. I downloaded combo fix to the desktop, and also printed out the 14 page tutorial. However, a quick google search of the word "malwarebytes" instantly closes IE ! (so I think you're on to something

So, I'm using the DAW in the studio to write this. I'll use it to get malwarebytes, and transfer over with a thumb drive...

Is there any risk as far as bringing "results" of these scans back to this 'healthy new' computer to post online?

Way thanks - Joe

 

[Osiris]

Well you should scan it before bringing it back over to the nonifected pc.

Well go ahead and run combofix and see where that gets you.

Where did you get the tutorial?

 

[Goldenvoice]

yeeeaa - scan it with what? (ha ha) - none of the anti-virus stuff runs... Well, the infected computer will work online, but acts like I'm sharing the connection with somebody - but the LAST thing I need to do is infect my brand new DAW!

Oh, tutorial at A guide and tutorial on using ComboFix

OK, so, when I attempt to run combofix, I get this:
C:\ (location)\ComboFix.exe is not a valid Win32 application

?

 

[Osiris]

Will hijackthis run?

If this doesnt work we will need to use a bootable cd with some removal tools

 

[Goldenvoice]

OK, I tried to google for hijackthis on the infected computer, and once again, explorer instantly shut down.

I am now going to try going directly to a download link, as I would prefer to let hijackthis install directly to the correct location.

IF that doesn't work, can I simply save it into 'My Docs' here, on the DAW, then move it over with a thumb drive? And if so, to where in the infected computer do I save it, or does it matter?

 

[Osiris]

Here are direct downloads

http://go.trendmicro.com/free-tools/hijackthis/HijackThis.exe

http://go.trendmicro.com/free-tools/hijackthis/HijackThisInstaller.exe