Blue Screen Virus

[MichelleBB]

please help. i'm having problems with Blue Screen virus and XP Antivirus. how do i attack problem? thanks!

[MichelleBB]

okay, i've run all the programs in the read and run and i think everything seems to be back to normal. "joke blue screen" seems to be gone...hopefully it will stay that way. whew..this was pretty labor intensive, but hopefully will have saved me lots of money!

i've attached a few of the files you requested. let me know if more are needed. thanks again for your help. Michelle

[chaslang]

If you are not having anymore problems, then it is time to do final cleanup.

First we need to cleanup some items from running ComboFix.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_CURRENT_USER\Software\Kazaa]
[-HKEY_LOCAL_MACHINE\SOFTWARE\knight]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now it is time to do our final steps:

1. You can uninstall SUPERAntiSpyware now.
2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combo-fix" /u
     • Notes: The space between the combo-fix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combo-fix folder from combofix.
4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
6. Go to add/remove programs and uninstall HijackThis.
7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
8. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
9. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

[MichelleBB]

okay...here we go: (i'm a beginner at fixing my computer, so have patience)

1. i did get a success message when added the fixme.reg to the registry
2. i did unistall SuperAntiSpyware
3. it kept giving me an error message when i tried to uninstall ComboFix..couldn't find the string. Can i just uninstall it from control panel...add/delete programs?
4. i did delete MGtools and .exe file
5. you lost me on the Deable System Restore....how do i do that? and then how do i enable system restore? sorry..so confused.
thanks for the help,
MichelleBB

[chaslang]

Originally Posted by MichelleBB

3. it kept giving me an error message when i tried to uninstall ComboFix..couldn't find the string. Can i just uninstall it from control panel...add/delete programs?

Sorry about that. The procedure had recently change slightly. You need to do the below:

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

Originally Posted by MichelleBB

5. you lost me on the Deable System Restore....how do i do that? and then how do i enable system restore?

As stated in my instructions

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Below is a direct link! See step 4:

Windows XP Cleaning Procedure

[MichelleBB]

okay...that new combo-fix string worked.

I still am having problems with your "Disable System Restore" directions. I do not have a system protection tab as you show in your example. i only have a system restore tab and under that tab, i don't have an option to check boxes as you show.

it only shows me available drives that are being monitored, but it doesn't seem like i can select or de-select them.

your thoughts? thanks again. MBB

[chaslang]

Originally Posted by MichelleBB

I still am having problems with your "Disable System Restore" directions. I do not have a system protection tab as you show in your example. i only have a system restore tab and under that tab, i don't have an option to check boxes as you show.

it only shows me available drives that are being monitored, but it doesn't seem like i can select or de-select them.

You are looking at the procedure for Vista. You need to follow the instructions for Windows XP. Look further down the page.

[MichelleBB]

okay...thank you. sorry for the confusion. i have three very young children that use the majority of my brain cells during the day. thanks for all your help.

i think i'm good to go and may look into a few of your suggestions for further protection.

[chaslang]

You're welcome. Surf safely!