I've got the MOTHER of all infections!!!

I'm using Windows XP SP3 and AVG Free. My definitions are updated every morning. While surfing some cheap airfare sites, all of a sudden I started to get messages in a balloon pointing to a green security icon in my toolbar. It says my computer is now infected and do I want to upgrade to AVG Suite to remove the infections, or continue unprotected. Then I was getting MS Security messages saying my computer is under attack from various IP address and the port they are trying to enter and do I want to prevent these attacks because they are trying to steal information.

The green shield in my toolbar is supposedly from AVG Suite and it's scan shows 34 different Trojans, most of them critical. Every time I try to open a program like: AVG, MalwareBytes, SuperSpyware, CCleaner, etc...I get a message saying the program can't open because it's infected. If I try to open a browser, I get a similar message saying Chrome.exe is infected or IE.exe is infected. If I try to do a search, or open "add / remove programs", I get a message saying rundll is infected. The only thing that does appear to work is the option to upgrade to a paid version of AVG premium. I'm leery about that because the order page doesn't appear to be a secured page to enter payment info. Is this part of the infection, or AVG blackmail? After a reboot, I was able to quickly open AVG Free and run a scan, which said it found nothing. I haven't been able to open AVG again since then.
I disconnected my computer from my Linksys router (which I use encryption), but I can't get anything to work. Now my computer keeps trying to open IE pages and no matter how many times I try to close them, they keep opening. Even though it's disconnected from the internet, I keep getting MS Security windows popping up saying I'm under attack and it keeps showing different IP addresses as well as different ports under attack.

I'm screwed, aren't I? :cry
Any ideas, suggestions or advice would be greatly appreciated. Thanks.

 

Sorry, I didn't mean it was caused by AVG, it is just AV Suite. So I apologize for implicating AVG in my original post, however, I am curious as to how this slipped passed my AVG Free.

 

Thanks for your suggestion, however, I was unable to open any browser, so going online to download anything was impossible!

BUT, I did find a solution!


Well for a little while yesterday, I thought I was doomed with my computer. As ingenious and invasive as that virus was, it was surprisingly simple to remove. I looked for something installed with yesterday’s date. I found inside:
Documents & Settings\(User)\Local Settings\Application Data
I found a 276kb folder with random letters(GXLEPYT), inside that was a file with a similar name (DQPWXHY.exe). No company was listed in properties and I never saw this folder before. I tried to delete it, but it kept coming back. I renamed the folder / file: virus.exe. It took a couple of times to stick but after a few reboots, it stuck. Then on a whim, I simply dragged the folder to the Recycle Bin and it stayed. I quickly emptied the Recycle Bin and it was gone!!! At least now I was able to open programs. I immediately ran MalwareBytes and it found 3 objects:

• C:\System Volume Information\_restore{5911E5E7-4FCE-4E6B-99BB-EC65B32FDDBA}\RP65\A0013664.exe (Rogue.AVSecuritySuite)

• C:\System Volume Information\_restore{5911E5E7-4FCE-4E6B-99BB-EC65B32FDDBA}\RP66\A0013688.exe (Rogue.AVSecuritySuite)

• HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite)

Malwarebytes removed them successfully. Then I ran: AVG Antivirus, SuperAtntiSpyware, BitDefender AntiRootkit, JV16 Registry Cleaner, CCleaner, etc. and everything came up clean.

The only other issue was my inability to open a web browser. After checking IE Tools, Options, Connections, I realized that my LAN settings were configured to connect via a Proxy server. After changing that, everything worked fine. I just did another battery of tests today and everything seems to be running perfectly!

It could have turned out a lot worse! I hope this solution I found helps others with the same problem.

Thanks again for your help!