Spybot S&D not loading up, programs not installing, and Google redirects.

[anoney]

Hi,

Windows Vista user here, I seem to have caught a few nasty viruses which are doing the following:

1) Spybot S&D will not load. The .exe file seems to be missing from the install folder. I have uninstalled it for the time being.

2) Google searches are redirecting me to weird adware sites. This happens in Mozilla and IE (Mozilla is my main browser).

3) I read the stickies and tried to install HJT, but the first time I tried to install it I got the blue screen of death (have not seen that for a while). The second time I tried it does not seem to have installed correctly. I have a shortcut on the desktop (which doesn't work) and in the install directory I have one .exe file (does not run).

Any help with this would be much appreciated.

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

You must have read and followed the "Before you Post" instructions.

HijackThis is a starting point, please try this self-installer:

Download Trend Micro Hijack This™ to your Desktop
http://download.bleepingcomputer.com...HJTInstall.exe
Doubleclick the HJTInstall.exe to start it.
By default it will install HijackThis in the Program Files\Trendmicro folder and create a desktop shortcut.
HijackThis will open after install. Press the Scan button below.
This will start the scan and open a log.
Copy and paste the contents of the log in your next reply.

You may also try changing the name of the executable before saving it to the Desktop to anoney.exe. This is the hackers work, the junk they put on your computer is looking for programs like HJT and blocks them.

As far as Spybot S&D goes, it is a good program but likely will not remove this junk, so don't try to run it again until we remove the junk.

Thanks

[anoney]

Hi pskelley. Thank you very much for helping me with my problem.

I read the "BEFORE you POST" link and I understand all that is required of me in this process.

I tried to reinstall HJT as per your instructions, but I got the blue screen of death again. I tried to rename the installer to anoney.exe but again after clicking the INSTALL button I get the blue screen of death.

[pskelley]

Are you using a router?

BSOD's come with error messages, please post any error message you receive "word for word" Please keep in mind as we proceed, that you are in front of the computer and I depend on your feedback to know what occurs.

http://kadaitcha.cx/vista/index.html
http://www.edbott.com/weblog/?p=576
http://www.google.com/search?hl=en&e...t+BSOD&spell=1

Thanks

[anoney]

Yes, I am using a router to connect to the internet.

I tried reinstalling HJT one more time, and after pressing the INSTALL button nothing happened. I checked my PROGRAM FILES directory and found the TREND MICRO folder, with a HIJACKTHIS folder in it, and then a single file called hijackthis.exe in that folder. I tried to run that file and got the BSOD. Here is the error info of that BSOD as was shown:

Technical Information:

*** STOP: 0x0000008E (0xC0000005, 0x81A740B4, 0x97B8F3A4, 0x00000000)

[pskelley]

That's for the feedback, if I have not mentioned it, do not expect this to be easy. The hackers do all they can to keep you from removing their junk.

Have a look at this information:
http://blog.washingtonpost.com/secur..._wirele_1.html

Sure you got that error exact? Here is what Google has to say:
http://www.google.com/search?hl=en&q...&aq=f&oq=&aqi=
Your search - STOP: 0x0000008E (0xC0000005, 0x81A740B4, 0x97B8F3A4, 0x00000000) - did not match any documents.

It is very rare when that happens?

See if you can get combofix to run, be sure you read and follow these directions carefully.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use

Download ComboFix from here:

Link 1

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Tutorial if needed
http://www.bleepingcomputer.com/comb...o-use-combofix

Thanks

[anoney]

I just got the BSOD again after trying to run that single .exe file found in c:\Program Files\Trend Micro\Hijackthis folder. There was a new error message this time:

*** STOP: 0x0000008E (0xC0000005, 0x81AA60B4, 0x953CB3A4, 0x00000000)

I have not yet followed your instructions for combofix, because I thought it best to run this new BSOD error message by you first. Should I now run combofix as per your instructions?

[pskelley]

*** STOP: 0x0000008E (0xC0000005, 0x81AA60B4, 0x953CB3A4, 0x00000000) <<< returns nothing when Googled, please follow the directions to run combofix.

Thanks

[anoney]

I followed your instructions carefully for using combofix, but when I double-click the file to run it nothing happens. I am using Windows Vista so the UAE window comes up when I double-click it, but after that nothing happens.

[anoney]

Sorry, I meant the UAC prompt windows comes up, but after that nothing.