Stubborn Virus

jiltloop

Hi guys, I have a virus or spyware infection on my pc, I tried the steps above but when I try to inialize any program I get a pop up from the bottom right corner of the screen saying: Application cannot be executed. The file The_Comedian.exe is infected. Please activate your antivirus software.I get this same message when I try to run any of the software in the links above. Is there anyway around this problem? Any help greatly appreciated.

ActorSeeksJob

did it say what infection the comedian was ?


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   • Tools->Options->Main tab
   • Set to "Always ask me where to Save the files".
2. During the download, rename Combofix to Combo-Fix as follows:
   
   
   
   
   
   
3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

   ---

   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

     ---

   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

   ---

7. Double click on combo-Fix.exe & follow the prompts.
8. When finished, it will produce a report for you.
9. Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

jiltloop

Thanks for your help, I'll try that later this evening when I'm using the pc in question.

jiltloop

Sorry no, it didn't say what infection, just that it was infected. It appears to be a bogus antivirus program that's causing all the problems.

jiltloop

I'm getting the exact same message with the combo-fix program. It basically looks like I have a bogus antivirus program which keeps trying to start scans (probably to tell me I have loads of viruses and I need to buy their product to get rid of them), it also seems to block any legit programs and apllications from starting. I can't seem to be able to disable the bogus antivirus program at all and it won't let me delete it.

jiltloop

Not sure if it's any help but the bogus program calls itself "System Security Version 4.51".

ActorSeeksJob

try this

Download RootRepeal.zip and unzip it to your Desktop.

• Double click RootRepeal.exe to start the program
• Click on the Report tab at the bottom of the program window
• Click the Scan button
• In the Select Scan dialog, check:
  
  
• Drivers
• Files
• Processes
• SSDT
• Stealth Objects
• Hidden Services

[*]Click the OK button
[*]In the next dialog, select all drives showing
[*]Click OK to start the scan

Note: The scan can take some time. DO NOT run any other programs while the scan is running

[*]When the scan is complete, the Save Report button will become available
[*]Click this and save the report to your Desktop as RootRepeal.txt
If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.

To attach a file, do the following:

• Click Add Reply
• Under the reply panel is the Attachments Panel
• Browse for the attachment file you want to upload, then click the green Upload button
• Once it has uploaded, click the Manage Current Attachments drop down box
• Click on to insert the attachment into your post

jiltloop

No sorry, still the same issue keeps happening. Winzip won't run because apparently thats infected too. This virus is preventing me from running any program whatsoever except internet explorer and windows explorer. Even solitaire and wmp won't run. M pc seems to be completely crippled.

ActorSeeksJob

do you have an anti-virus or anti-spyware installed on it ?

If so update and run a full scan with them and post the log here

jiltloop

My pc crashed and blue screened there about 30mins ago. I restarted it and the bogus antivirus software didn't start up for some reason, which allowed me to follow the steps above. Everything seems to be working fine now, pc seems to be virus free. Thanks a million for all your help!