Infection! (Doesn't spread, AFAIK ;D)

[Firefox11]

So yesterday I was searching for some stuff and downloaded a .exe that now fucked up my PC. No, I wasn't looking for pr0n but for a no-CD illegality stuff.

The issue is the PC. I've run Panda 2007, but it seems that the virus (or whatever it is) disabled or at least hid the Hard Drive, so I guess that's where it's installed. I can't neither go back to a previous config since my Start Menu doesn't show any programs nor folders. Also, Control Panel, Run, Search and any other application linked to the Start Menu is also gone, except the last used programs.

Any ideas? Should I go with a direct reformat?

[Hammock]

Have you tried starting up in safemode with networking? If you can get booted up in safe mode you could try running your antivirus there.

[Pixel]

Windows Key + R? Try that.

msconfig, check your start up programs.

[Innoc]

Probably a trojan that doesn't quite match the signature of a virus.

Spybot Search and Destroy (this will probably be the one that finds it)

Windows Defender (Doesn't do much that's useful beyond outbound port filtering and watchdog work...I doubt it would ID and corral your infection)

Ad Aware Free Edition (also somewhat worthless...but not a bad idea to scan your system with it

General protocol with all 3...install and then update them...reboot into safe mode and let it go to town. Once you reboot into normal mode let SBSD immunize your system.

I didn't mention anything that you had to pay to use as the fact that you were searching for things of questionable legality suggests to me that you might be reluctant to pay for that which you need...In which case...these 3 packages aren't a bad way to go.

edit: wow...for posting while sleepy first thing in the morning...If you cannot boot into safe mode and do anything useful and the Windows Recovery mode when booting from the CD doesn't help then a reformat and reinstall is the only way to recover this...

[Firefox11]

Thanks for all the replies!

No, I didn't try starting in safe mode because I'm a bit newb about computer issues, and didn't exactly know what to do (and my Comp Nerd Friend is out, holiday trip). I'll try those things and let you know.

[Firefox11]

Alright, tried booting in safe mode, both normal and with networking. However, I still can't see the hard drive. Because of my newbiness, I don't know which are the normal start up programs - I can recognize Panda, Steam, etc. but ones like RHT and a few more letters, I don't. Also, since the hard drive doesn't show up, scanning with Panda would be futile - tried already, but since it can't scan the HD, it doesn't find a problem.

Other symptoms include:
- The time at the lower right corner displays a "VIRUS ALERT!" message.
- Three additional icons appeared when the problem started, all three being relative to virus/spyware busting, all of them shortcuts (didn't try them though).
- I can't access Internet with that computer, and I am a bit scared to download AV programs in this computer, then to a pen drive and then to the other PC - I don't want to lose a portable hard drive, to be honest D=
- The first boot after installing that program, the screen got flooded (literally) with tons of popups, virus alerts from websites asking to download stuff and even a weird wallpaper, red with a infection symbol, also reading somewhat along the "Virus Alert" message. All these don't show up anymore, though.

[פֿяαιп βαмαgεפ]

Oh god you got screwed good, hang on, I had to tame one of those bastards too, I have a solution here somewhere, just gimme a sec.

*edit*

Step 1:
Delete your CacAfee/Borton scanner you probably are using.

Step 2:
Download Avast Anti-Virus.
Download AVG Anti-Virus.
Download SpyBot S&D.
Download Ad-Aware.

Step 3:
Update all the scanners.

Step 4:
Restart computer and put into safe mode.

Step 5:
Set all of them onto thorough scan or however the heck you spell that word.

Step 6:
Scan overnight/any time 2 times using all of them. Repeat as your paranoia desires.

Step 7:
Delete AVG so Steam won't bitch and crash because you have it on the comp.

Step 8:
Continue using Avast as your main scanner.
Continue using Spybot as your secondary spyware scanner.
Continue using Ad-Aware as your secondary spyware scanner.

[Firefox11]

Ok.

So is it safe to actually download them into the infected comp with a portable HD/pen drive? Won't it get infected too?

(Mainly because the only "portable HD" I have is my MP4 player, which I just got recently after getting it replaced for the 2nd time, so you can guess I don't want to lose it again =S)

[פֿяαιп βαмαgεפ]

You can't be 100% sure but I think when you download all programs and smack 'em on the hard drive it shoudn't be a problem.

[Firefox11]

Alright, did all what פֿяαιп βαмαgεפ suggested, here's the report:
- Started in safe mode, couldn't correctly fire AVG because it needs to run in normal mode. However, it did a MS-DOS screen scan, notifying all the Virus/Trojans/Spyware. Wrote some of them down.
- Installed Spybot: S&D and made a scan, fixed all the errors.
- Couldn't install Ad-Aware, because the System Admin was blocking that action (wtf? There's only one account in this PC... well, w/e)
- Restarted - normal mode.
- Ran AVG. Updated to the max, ran a scan. Fixed all I could. However! The hard drive still doesn't show, and the "VIRUS ALERT!" message still appears to the right of the time. Some progress was made, though: now the Programs tab in the Start menu shows up. However, Run, Search and other functions still aren't available. I can now use the Proccess Admin (CTRL + ALT + DEL, in case I didn't get the name right). Also, I could install Ad-Aware.
- I'm running AVG again, and it seems that there are some errors that it didn't fix before, so I guess it is not fixing the problem that cause the C: drive to not show up, as well as the Start Menu problem too.
- Now that I can use the Proccess Admin, I can see how one of the programs detected as Trojans when I ran AVG in Safe Mode is still running. However, since it is a System proccess, I'm told that the program is critical and can't be stopped.

So, what now? AVG is still scanning, but just in case it can't fix the problem, what should I do next?

[GeoKill----->]

I had the same problem and what i did I installed hijackthis
http://www.download.com/Trend-Micro-...-10227353.html
and removed the virus the manual way but if you don't know which one to remove then do a google search for each process running. Once you know which one is a virus, disable it then delete it. Once you did that run AVG again.

[Dospac]

The Combofix package was the only thing finding and removing this, last I cleaned a system w/something similar.(about 4 months ago)

Just google it.

[v3rtigo]

I agree with the googling, fixing these bastards usually involves a proces that isn't handled by automatic scanners. Identify and fix them one by one.

[darksoul]

ty for the link dos, been banging my head against my keyboard for the last ten hours trying to find a fix.

[Firefox11]

I've been trying to get the last parts of the Infection, but it looks I'm not successful. AVG doesn't find anymore viruses that I can identify and kill with HijackThis, and I tried finding them with TuneUP Utilites and the Task Manager it has, to locate a Windows look-a-like file out of place. I've noticed that sometimes the file directory is a bit different (as in c:/windows/system32 instead of C:/WINDOWS/system32), but I don't think this can be relevant.

Will try the combofix package now. I hope I'm more lucky than a friend, who had the same problem and had to reformat (though he didn't get past Step #1, disabling at least a part of it)

*EDIT*High five, mate. ComboFix killed everything that still was in the Computer (or at least this is what it looks like). I can access the Hard Drive, everything is back in the Start Menu and no more "Current Time VIRUS ALERT!"

Thanks everyone for the help!

[פֿяαιп βαмαgεפ]

Glad it worked!

[Dospac]

Yeah. I never tracked down the guys who put Combofix together. Those are some badass dudes though. Talented folks who can really pull apart windows to fix it hahah.

Also, a good utility disk is Winborg. Can google/torrent that too. Awesome combo dvd w/tons of cool repair shit on it+custom windows installs, and it gets updated still afaik.

[פֿяαιп βαмαgεפ]

YEah, one thing I use too is Hiren's boot cd, that solves some heavy shit too sometimes!