Computer has major issues!

penab · Nov 24, 2007

I could use some help....my computer is having major "issues". My son was surfing the web and obviously clicked on something he should not have. We now have many viruses in the AVG virus vault, my printer is no longer working, the "control panel" option is gone from the start-up menu, I cannot add or remove programs. When I try to access the control panel I get this error:

"Restrictions - This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."

The following keeps popping up on the screen:

"Windows Security Alert - Warning! Potential Spyware Operation! Your computer is making unauthorized copies of your system and internet files. Run full scan not to pervent and unathorised access to your files! Click YES to download spyware remover..."

Note that prevent and unauthorized are spelled incorrectly (I typed exactly as they appear).

I have attached logs from all my scans. I could not get runkeys to scan. I got an error saying that the registry has been disabled by your administrator. The error also came up when I ran shownew, but it came up with a log.

Thank you ahead of time for any assistance.

penab · Nov 24, 2007

more attachments

TimW · Nov 24, 2007

Download this file - Combofix.exe
Double click combofix.exe & follow the prompts.
When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Please rename HJT:
C:\Program Files\Trend Micro\analyse\HijackThis.exe ---> C:\Program Files\Trend Micro\HijackThis\Analyse.exe

Then:
Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\msanton.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\timoty.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - AppInit_DLLs: C:\WINDOWS\System32\sol748.txt
Click to expand...

After clicking Fix, exit HJT.

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* Check the 'Input script manually' box.
* Click on the magnifying glass icon.
* Copy everything in the Quote box below, and paste it in the box that opens:

Files to delete:

C:\WINDOWS\system32\msanton.exe
C:\WINDOWS\system32\timoty.exe
C:\WINDOWS\System32\sol748.txt
Click to expand...

* Now click the 'Done' button.
* Click on the traffic light icon and OK the prompt.
* You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt
Attach new logs for:
ComboFix
ShowNew
GetRunKeys
HJT
Avenger

penab · Nov 25, 2007

Thank you for taking the time to look at my problem. My husband reformatted the computer while I was gone.....

TimW · Nov 25, 2007

That'll cure it ....sorry we couldn't save you the trouble.

Log in or Sign up

Computer has major issues!

penab Private E-2

Attached Files:

Bit Defender Scan.txt

Activescan.txt

penab Private E-2

Attached Files:

AVG Scan.txt

hijackthis.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

penab Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member