Virus denies web connection

[Richard V]

I am having my first virus on my wife's computer. A pop up AV Pro Security has sent us porno and says we can only get rid of it by buying their fix. A scam of course. I have looked on line and found many was to combat this, but they all say you have to download them into your computer. How can I do this if the virus will not let me connect to the interenet?? Please help, wife in tears.

Richard V

[jonsca]

Try the viruses etc forum (also on DW)
http://www.daniweb.com/forums/forum64.html

[Richard V]

I will try that. I tried putting in an anti virus on a CD and the virus will not let me do that. Nothing seems to work.
R

Try the viruses etc forum (also on DW)
http://www.daniweb.com/forums/forum64.html

[Richard V]

The virus will not let me download from the internet or from a CD. drive. It will not let me into system restore or any other in computer fix that I have tried. Is the computer trashed? Do they have ways of fixing this in a repair shop?

I will try that. I tried putting in an anti virus on a CD and the virus will not let me do that. Nothing seems to work.
R

[Nick Evan]

moved.

[jholland1964]

Hi, welcome to daniweb,
See if you can boot to Safe Mode with networking, this might be a way to keep this from loading itself at start up. If you can then try to do the following:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop but when it asks where to save it, it should say "Save As..." give it a new name, like wife.exe. Be sure that .exe is there and save it to the desktop.

For this FIRST run, go ahead and run it in Safe Mode if you can get it downloaded. This is not the recommended way to run because Safe Mode doesn't allow this tool to load all of it's drivers, but since you can run no tools in Normal Mode this would be better than no run at all. If you can get it to run and remove some infection then I will have you try normal mode later.

* DoubleClick mbam-setup.exe (remember you should have renamed this so it won't have that legal name but whatever new name you gave it) and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
If it tells you it has to reboot...wait and post the log before I give the OK to reboot you do so we can see what it wants to remove with the reboot.
Post back with that log.
Judy

[Richard V]

I am afraid I do not know how to "boot to safe mode"

R

Hi, welcome to daniweb,
See if you can boot to Safe Mode with networking, this might be a way to keep this from loading itself at start up. If you can then try to do the following:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop but when it asks where to save it, it should say "Save As..." give it a new name, like wife.exe. Be sure that .exe is there and save it to the desktop.

For this FIRST run, go ahead and run it in Safe Mode if you can get it downloaded. This is not the recommended way to run because Safe Mode doesn't allow this tool to load all of it's drivers, but since you can run no tools in Normal Mode this would be better than no run at all. If you can get it to run and remove some infection then I will have you try normal mode later.

* DoubleClick mbam-setup.exe (remember you should have renamed this so it won't have that legal name but whatever new name you gave it) and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
If it tells you it has to reboot...wait and post the log before I give the OK to reboot you do so we can see what it wants to remove with the reboot.
Post back with that log.
Judy

[PhilliePhan]

I am afraid I do not know how to "boot to safe mode"

Hi Richard,

-- What is the OS?
-- Are you posting from a clean computer?
-- Do you have a USB thumb drive?
-- Are you able to get a command prompt on ill machine?
(START > RUN > Type cmd > OK
or
(START > RUN > Type command.com > OK

PP :)

[Richard V]

XP

I downloaded the programs that Judy advised me to on a flash drive, opened the computer in the safe mode and downloaded all of them. I don't know which one worked but one did and the virus is gone!!!

I then loaded AVG free program and scanned the files. No trace of the virus.

THANK ALL OF YOU SO MUCH FOR YOUR HELP!

Richard

Hi Richard,

-- What is the OS?
-- Are you posting from a clean computer?
-- Do you have a USB thumb drive?
-- Are you able to get a command prompt on ill machine?
(START > RUN > Type cmd > OK
or
(START > RUN > Type command.com > OK

PP :)

[jholland1964]

Not so fast!!! There is NO guarantee the infection is gone yet. Even though things seem to be working well at the moment. We need to see the log from MBA-M.
Plus you need to now Update MBA-M and run a Full Scan in NORMAL mode.
Have it Remove Everything it finds.
Reboot.
Then download and run HiJackThis. Save the log.
Post back here with the MBA-M log done in Safe Mode, the MBA-M log done in Normal mode and the HJT log.
Judy