[cesarcarlos]

Hello,

I am having so much trouble with my computer, I hope you can help me.

I am running Windows 2000 Professional and McAfee VirusScan Online.

About two weeks ago strange things began happening. Whenever I would switch my computer on everything would start fine until the point where I was asked for my user and psw. I would write them, click OK, then I would see my wallpaper image and then nothing. No Taskbar, no Icons on the desktop, no start menu, nothing. I could use the computer in restore mode where the antivirus would repeatedly detect files in C:/WINNT infected wit W32/Sdbot.worm.gen or W32/Gaobot or variations of these viruses.

I had my disk formatted and Windows reinstalled. I got the computer back yesterday. I started installing my software and suddenly McAfee VirusScan Online started detecting files infected in WINNT, like every 5 mins. Examples are:

C:\msword.dat
W32/Sdbot.worm.gen

C:\WINNT\system32\msword.exe (this one like 3 times)
W32/Sdbot.worm.gen

C:\msconfig.dat
W32/Sdbot.worm.gen

More weird, I left for a while and when I came back I found a couple of pop ups with some porn advertising. Not web ads, but system alerts. (gray boxes with text)

I tried running Stinger but that found nothing.

I went online to Trend Micro and used their online virus Scan. It found out that my Mouse Driver had within it's files this:

BKDR_SDBOT.GEN

I deleted the infected virus Trend Micro found. Looks like the pop up thing got fixed.

Apparently when I installed the mouse software the computer got infected.

I also found NewsUpd running in my computer. I used Spybot S&D to get rid of it and other spyware.

LAst night my Antivirus (McAfee VirusScan) stopped working. I tried reinstalling it but the download would stop all of a sudden. Up to this moment I haven't been able to install it again.

I went online today and talked with McAfee tech support. They told me to do a DOS Scan and gave me a zip file to download so I could do it. I did, it found a couple of viruses and deleted them. Still I couldn't reinstall McAfee.

I then noticed that whenever I run REGEDIT it closes whenever I try to open a folder or use an option from the menus.

The latest is that I can't go to McAfee's web page anymore. I can't go to computercops.biz either. I asked friends if they could and they said they could go to the site with no problem. I get the typical error window (like when you mistype an address; server may be down something like that)

I'm also noticing that I can't cut and paste text or that I can't open links in messenger windows or in Outlook Express. I click on the links and nothing happens. I have to write the address myself.

I've ran Spybot, AdAware, Stinger and HijackThis.

I don't know what else to do

Can anyone please help me? Obviously the virus is still in my system and won't leave.

More examples of infected files I've been getting are:

C/WINNT\system32\wuamgrd.exe
W32/Gaobot.worm.gen.e

C:\WINNT\system32\msconfig.dat
W32/Sdbot.worm.gen

C:\WINNT\system32\regedlt.exe
W32/Randbot.worm

C:\WINNT\system32\lsass.exe
W32/Gaobot.worm.gen.f

I hope you can help me. If you need more info just let me know.

Thank you very much

CPG

 

[mobo]

First off is Macafee fully updated ? If it is then get another cause it isn't doing the job.. Then run a full system scan at trend micro and set it to auto clean..
When complete
Please get Spybot S&D to clear out any spyware.
http://www.safer-networking.org/index.php?page=mirrors

Install the program and open it.

Before doing any scanning click Online and Search for Updates .
Put a check mark at and install all updates .
Click Check for Problems nd when the scan is finished have Spybot fix all it finds marked in red .

Then after reboot :
Download 'Hijack This! http://www.spychecker.com/program/hijackthis.html
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the " scan " button will change into a " save log " button.
Press that, save the log , load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.