Computer help forum: AHH! MY COMPUTER IS INFECTED!!

Which operating system? EXACTLY what are you seeing as far as popups and what types of spyware have been detected so far? Which antispyware programs are you using?

Can you still access the internet using the infected computer? If so, please start like this:

First, Download Smitfraudfix.exe to your desktop from the link below.

http://siri.geekstogo.com/SmitfraudFix.php

Once that's done, download the free tool below, install it, then update it.. Once that's done, restart the computer into Safe Mode..

Please download Malwarebytes' Anti-Malware from Here

Once in Safe Mode, run Smitfraudfixe.exe, select Option #2. Wait for the tool to complete and disk cleanup to finish. You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter. The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if your computer does not restart automatically please do it yourself manually.

After restarting the computer into "normal" Windows, Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Hope this helps and let us know how it goes. Exact malware names and the names of infected files would help.

Grif

I am using Windows XP - was using Logitech webcam - scanned the computer with anti-spyware and re-started, found webcam not operating- tried to install the software again , but the following msg appears "audio tuning wizard has encountered a problem and needs close down" then tried to un-install the existing driver which process could not complete and computer freezes - someone can help me with advise how to overcome this problem

regarding what u have posted... will this completely wipe like every downloaded thing or anything? or will it simply wipe all infected things?

gahhhhhhh!!!!! my keyboard isnt working! omg im screwed!

omg i used that malwarebytes thing and i turned off system restore and scanned and i havnt gotton the message that im infected! i hope this really worked :P

from a System Restore point or (if you have one installed) a third party similar program. You need to turn off System Restore to delete all restore points before you can consider your computer clean. If you have a similar program installed, follow the instructions to clear any backup copies of an infected system.

It is possible that this is the step you have been leaving out.

Denise

Go to control panel. Click on "system" (or system properties). Click on the "System Restore" tab. Under this tab, there is a box to check labeled "turn off System Restore for all drives." Check that box. Proceed to clean your system. When you reboot, check your system to see if it is still clean. If this does it, then go back and uncheck the box. You will need to reboot and let the system make a restore point to complete the process.

If this doesn't do it, check out all the other helpful suggestions. You will need to remember to clear all system restore points every time you clean something more serious than a tracking cookie off of your system, though. Once the infection has been backed up in a restore point, it can just reinfect your system over and over.

Denise

...you've run those scans.. If the scans don't find any infected items in the system restore volumes, then they may come in handy if a bad infection causes corruption after cleaning.. I have had some instances where I needed System Restore to get the computer running again...even if there were infected items in it.

System Restore won't cause issues as long as you don't use it.. So, in my opinion, I run the scans first, delete everything that's infected, maybe even run repeated scans, then go from there.. If you have to, yes, disabling SR may be necessary, but there's no need to jump the gun.

Hope this helps.

Grif

and in the experience of a lot of other people, the restore points can cause you to be instantly reinfected. This was a major problem right from the start, and many people suggested permanently turning off system restore for that very reason. I still see it suggested from time to time.

I don't consider this to be a reason to dump system restore entirely (and many people had to agree later, when they started thinking about it instead of just reacting) since it can be such a valuable tool. But the high possibility of reinfection has to be considered when cleaning malware off of a computer.

The second time I ever got a virus, I was instantly reinfected three times before I figured out that my system restore points were causing the problem. Once I cleared out all restore points (before cleaning my system the fourth time) the problem was solved.

The checkbox that allows for turning off system restore was put into Windows XP specifically because of all the trouble people were having trying to clean infected systems running Windows Me, which was the first Windows OS to have system restore. They hadn't considered the need to delete restore points when they originally created the feature. Turning off system restore required that you know exactly how it was done, and this information wasn't readily available.

Denise

but this is a known problem. It isn't like restore points are important. All you need is one to do the job. That one is the one made automatically when you turn system restore back on.

Denise

it appears that you don't know that there is a MAJOR difference between an "infection" and a file containing the viral code.

An infection is ACTIVE and means that it got past all your defenses. If that is happening you need to change your defenses. An Anti Virus application catches the viral signature BEFORE the virus gets activated so you get the alert. The alert does NOT mean that you are "infected", only that if you execute the file containing the signasture you will be.

Contaminated files in the Restore points CANNOT "re-infect" a computer unless the computer is restored with that restore point (at which point in time they will again be capable of actually infecting the system if they are executed) BUT the files will indeed continue to show up in scans until they are removed.

Malware on the other hand is generally "discovered" after it has been activated but if removed except for copies in the restore points will not reactivate unless the system is restored to a restore point containing the file.

In either case though as long as it is found in the restore points only, you could continue computing forever without worrying about them UNTIL you need to restore.