Really bad virus Please HELP!

[isabelle13]

Hi everyone. I'm new here, a friend of mine suggested that i come here and tell you all about my problem so that you can try to help me. Thanks in advance, and here goes:

Laptop:

I think i have a spyware type virus on my laptop. I don't know how i got it as i didnt download anything but i did open a torrent file. It has caused a lot of problems for me, including:
...not allowing me to access my email account. I can sign in normal but when my page comes up, the font is twice the size it should be and my inbox isnt clickable. I had to have a friend use a different email address and verify it for me in order to join up here as i just cant use mine.
...i can't use google. when i try to click on one of the google links, it opens a new tab and takes me to an irrelevent page. sometimes from there it even shuts down my laptop.
...it has seemed to block any site that might help me, including anti virus sites, and McAfee live chat. I tried to get avast (friend recommended) but it blocked it. I managed to get a free trial of AVG, but now the virus seems to have gotten into that and is disrupting all my virus scans. When i first used it, it told me i had 2 trogan horses and 4 Adware something or other. But now, i the scan barely last 5 seconds before its stops and an error report pops up.
...it frequently shuts down my laptop
...am i gonna have to wipe the whole thing and start again??

PC:

I have an even worse virus on my PC. I don't know what happened and i didnt get the chance to do a virus scan because now only the background comes up when i switch it on. I don't even have a start bar anymore.... It isnt allowing me to do anything!
...I fear that your going to tell me something about using safe mode and command prompt and i'm gonna be so clueless....

EDIT: If necessary, how/how long would it take to copy my hard drive to an external hard drive with only using command prompt in safe mode?

PLEASE HELP!!!! :'( :S :confused:

[jholland1964]

Hi Isabelle, welcome to daniweb. Let's begin with that laptop first ok, see if we can get it cleaned up and THEN go onto the desktop. It would be too confusing for both of us to try to work on both at the same time. First of all, you have answered one of your own questions;
I don't know how i got it as i didnt download anything but i did open a torrent file.
That is more than likely how you got it.
What operating system do you have on the laptop? XP....Vista?
I would like you to try to do this ;

Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

...I fear that your going to tell me something about using safe mode and.... i'm gonna be so clueless....

Just take a breath, be calm. Very easy to do, really. Here are instructions for both XP and Vista since I don't know your operating system.Windows XP

Using the F8 Method

1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
3. Select the option for Safe Mode with Networking using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode with Networking.

Windows Vista

Using the F8 Method

1.Restart your computer.
2.When the computer starts you will see your computer's hardware being listed. When you see this information start to gently tap the F8 key repeatedly until you are presented with the Windows Vista Advanced Boot Options.
3. Select the Safe Mode with Networking option using the arrow keys.
4.Then press the enter key on your keyboard to boot into Vista Safe Mode with Networking.
5. When Windows starts you will be at a typical logon screen. Logon to your computer and Vista will enter Safe mode.

Now I ask for Safe Mode with networking because this way, when in just Safe Mode this loads the computer with the barest essentials necessary to run and without the modem files. Safe Mode with Networking will also allow the modem files to start too and therefore you should be able to also get online and download the necessary programs. Let me know if this is possible for you. If you can do this then download Malwarebytes' and install, update and then run the scan and let it fix whatever it finds while it is STILL in safe mode.
It may say something will be deleted on reboot. If so just shut down and reboot the computer as you normally do...this time it will boot into normal mode and remove the bad files while it boots up.
Post back here with the log.
Judy

P.S. also while in Safe Mode with Networking download HiJackThis Just save it to the desktop or My Documents. Don't run it yet.
Once you have done the Malwarebytes' and rebooted to normal mode then run a full system scan with HiJackThis and save the log and post it back here with the Malwarebytes' log.

[isabelle13]

hi. firstly, thankyou for taking the time to try to help me. its appreciated.

Ok, i tried to download the ani malware you recommended but i couldnt even get onto the site. Its blocked. I am in safe mode right now and i just tried it again, but even in safe mode, the site is still blocked. what should i do? Is there any way around it? Can i still download it if it is uploaded somewhere other than the official site?

:S

[jholland1964]

Not sure what is going on here, this is not actually a website but the actual executable file. What happens when you double click on that in my post, does it actually say the website is blocked?
In Internet Explorer go to Tools, Internet Options, Security. Click on Trusted Sites and put in there
http://www.besttechie.net/tools/
and click OK.
Also make sure your security settings are not too high. Move that glider over for now to Medium-Low and also click on Custom Level and scroll down and put "dots" in the following;
Automatic Prompting for File Downloads Enable and in File Downloads Enable
Click Ok and close that out.
Now first try to click on my link for the Malwarebytes' program and see if you still get a blocked message. What you SHOULD get is a prompt about downloading the program and where do you want it saved, desktop is what you should say. If that doesn't happen then go directly to the website above and the very last item on the list is mba-m. click that.
Judy

[isabelle13]

Just tried all that. Security settings were already lowered, tried it with both Internet exploer and Firefox. This is what i get:

"Unable to connect

Firefox can't establish a connection to the server at www.besttechie.net .

* The site could be temporarily unavailable or too busy. Try again in a few
moments.

* If you are unable to load any pages, check your computer's network
connection.

* If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web."

This comes up for pretty much all sites that might help me, anti virus sites, McAfee live chat etc. Do you think its the virus interferring? This only happens for pages i try to load that are connected with helping me get rid of the virus.

what you said i should get is what i usually do get but since i have had this virus i havent been able to access anything that would help get rid of it!

It did let me dowload a trial version of AVG, which said it got rid of it, but actually didnt. Plus i already had McAfee but that doesn't even pick up the virus. Any ideas?

[jholland1964]

Can I ask what was the exact name of the virus? Did you ever have an antivirus program on the computer or only install one after the fact? Do you have a firewall? Is it enabled? How are you connected to the internet?

[isabelle13]

Sure, i'll do my best. Virus name: A virus scan i did said i had Trogan horses and Adware, plus there is other stuff but i dont know it. I think part of the virus is go.google.

I had McAfee on the laptop before i had the virus, and that doesnt pick up on it. I downloaded the trial of AVG after i had the virus as it as the only thing it would let me download. That did one successful virus scan but didnt get rid of it all properly, and now all the scans i try cut out 5 seconds in.

Firewall: Yes we do, and yes it is enabled, but its not locked down. (

[jholland1964]

Number one, if you all ready had McAfee on the system you never should have added AVG.
The rule is only ONE antivirus program installed on the computer.
Now you said
A virus scan i did said i had Trogan horses and Adware,
I need to know the name of the virus scan...where did you get it and why? Especially if you all ready had McAfee. If it was an online scanner that is different but if it is another program you downloaded then this is and has compounded your problem. What happened to the McAfee program, where is it? Why did you run another scan if you all ready had that one?
Your firewall "could" be blocking the downloading of these programs, though if you couldn't do it in Safe Mode with Networking I don't know. There firewall shouldn't have come on in safe mode I wouldn't think.