Spyware, viruses, & security forum: Recommend Virus removal companies?

Thank you. I'll check those options out.

I don't have any bootable Anti Virus CD.s but I think I have the OS disks that came with the computer. He has too much crap on there anyway.

I was afraid that was the response I was going to get and that's why I don't trust the locals or Geek squad because I usually know more then they do simply by experience but my time is more valuable and if I can pay some one who REALLY KNOWS what they are doing then I'm happy. Otherwise it usually costs me more time and money in the end hence the question here.

We know exactly were the virus came from. Mediafire! Wicked polluted with garbage. My son plays minecraft and was downloading texture pack and boom! He was running free Avast and the actual program need an update as the virus defs are constantly updated so being 12 he ignored the notice. Learned his lesson early, I hope!

But the link I gave was for FREE ANTIVIRUS CDs that you download and then create the CD. I use IMGBURN for this work (making the CD.)

My kid had the same lesson.
Bob

I read further at that link and found that out. They also have an option for a USB drive so I'm doing that now. I'm going to have him run the fixes. More life lessons.

So I ran all the scans and anti virus and we found more than one trojan and plenty of other little bugs. Unfortunately, the files are still corrupted for the keyboard, track pad and disc drive and I still can't access the internet. I've run ccleaner and deleted all the traces from removed files.

The keyboard will work in safemode but I it tells me not to do a system restore in safemode. When I try to go in normal it loads windows and then it crashes and I get the blue screen of death but it disappears before I can read it.

This is what was found and is quarantined:
Malwarebytes found:
Trojan.spyeyes - B6232F3A8B2.exe
Trojan.spyeyes - HKCU\software\microsoft\windowscurrentversionRun\4Y3Y0C3AUF7XDXWWCUKKS
Trojan.spyeyes - 8B83BC32D7E2578
Trojan dropper - TMP0000000641EE85D00EEF4FE

SuperAntiSpyware found:
Trojan.Agent/Gen-Multi - c:\windows\temp\.VKRIKC\setup.exe
c:\windows\Pretec\setup.exe - 1E4D46E2.pf
Trojan.Agent/Gen-Kryptik
c:\windows\WinSXS\X86. Microsoft-Windows-NetBt31BF3856AD364E35_6.0.6002.18005_NONE_6250416DF465F2B1\NETBT.SYS

Avast found:
afd.sys
cdrom.sys
cdrom.sys
i8042prt.sys
netbt.sys
smb.sys
tdx.sys

Is is safe to delete/remove these now? I have never had to deal with viruses especially ones like this. Now what do I do to repair the damaged files and get control of the internet connection? Firefox is his preffered browser.

Thanks for any help.

Unless I know more, those are system files that will result in a dead OS.

The rest must go.
Bob

That's exactly what I wondered. The Trojans were trying to get rid of them. I was a bit afraid to trust avast yet.

Also, I can't re-enable the windows firewall or any other security processes.

Please help! Anyone?

For example, many of the Windows repair methods are not applicable to machines from HP, Asus, Acer and more. Why? The repair methods use the original full Windows DVD for the repairs.

Makers like HP and others rarely provide such media or versions because they do not want to support repair of the OS. Their repair method is to restore the machine to the factory load.

Sorry but until I know more about the restore media or the Windows DVD I can't go any deeper.
Bob

The computer is a Compac (HP) about 4 years old. I think I have disks for it but I didn't want to go digging if I didn't need them. Should I try to find them?

Thanks,
Marlie

Let's say we try the common SFC /SCANNOW command. It's one of the oft used commands to repair corrupt OS files without reinstalling or restoring the OS.

That command may ask for the OS CD. And if we do this and you stop the machine, control+C or cycle we may have a dead PC. This is why I asked. I do not want to give advice the kills the OS.
Bob

Marlie..

I don't know what actions you've taken at this point in time. But........

Based on Malwarebytes' Anti-Malware's (MBAM) findings alone, I would recommend changing your passwords and carefully monitoring any financial transactions while online. According to the results of the log, the files are in quarantine. Having said that, you can't be sure your system wasn't compromised, prior to that point.

Trojan.SpyEyes opens a back door. Methods may vary, but all attempt to steal information from the compromised computer. I'm not saying this is what happened. Only that it could have. Until such time the laptop is completely free of all infections, it wouldn't hurt to err on the side of caution.

My ¢ ¢ ..
Carol