PC infected cant run any programs. Solutions?

Yellowshirt

Downloaded music file, now pc is infected cant open any programs or cant open malwarebytes. When I try to use some other anti-virus, it says file infected and opens website to buy anti-virus program. What can I do?

Kenny DNK

did ya try a system restore? got me one of dem bad boys a few days ago, ran a system restore to the week before, and got rid of it.

Yellowshirt

Tried system restore, wont run, says file rstrui.exe is infected

Yellowshirt

Any program i try to run it says the .exe file is infected and it gives me the option to activate my anti-virus software when i select "yes" it send me to a webpage called anti-virus live "winguardsite.com"

johnny_adidas

is the program 'antivirus live' by any chance?
try starting your computer in safe mode and removing it from there. or if you are familiar with task manager etc, get the problem program's process name and get task manager open immediately after starting up windows, then end the process and proceed with removal

this will allow you to run system restore from safe mode, but obviously will reset system back to your last system restore
http://support.microsoft.com/kb/304449

Yellowshirt

yes 'antivirus live'

johnny_adidas

http://www.2-spyware.com/remove-antivirus-live.html

if its above your computing level, prob best to do the system restore as per my previous link

Yellowshirt

ok will try that, thanks

johnny_adidas

no problem

xbox gamer

Just to let you know same thing happened me today. It pops up as 'antivirus live' and directs you to a site to download a virus removal software. I have Windows Vista and any file or software i tried to open, including anti-malware and pc doctor (that i had just installed on it), said that it was infected and didn't open. The message gives the file name with .exe afterwards. I got somebody to look at it and he tried getting the safe mode to run. Not too sure if he did it or not but when the computer restarted, windows defender acknowledged the threats and took action against them. It didn't recognise any threats earlier when i ran a scan on the infected computer. It is working as usual now, touch wood.

Yellowshirt

started in safe mode but cant log in with my username and password, says their incorrect

ActorSeeksJob

hi

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is Unchecked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Yellowshirt

Logged in using administrator username/password - its my work PC - ran system restore, seems to be running ok now, programs opening up fine.

presotrader

I would still run a full scan on it afterwards, maybe get a hijackthis.exe log and post it here or on a similar forum.