Expert: Brian Benosky - 7/4/2008

Question
QUESTION: Hello Brian,
I am currently experiencing issues regarding internet explorerer, opera, and
firefox
i know I have a virus with many symptoms. One in particular is that firefox
will not start. When I run Internet Explorer, after a certain amount of time, a
blank page will open in a small box on the upper left of my screen. Then my
page will turn into a popup  that is usually something from advertyze .com or
more recently a fake registry tool. The virus has also deactivated my ability to
run opera and mozilla firefox. The only program I have been able to run to  
connect without error is Safari. I also get notices saying that certain rundll
programs have been closed. On top of everything else I have Vista so the
smartfraudfixes and combofix will not work on my OS. I am completely at a
loss and I was hoping that you could offer me some advice. Thank you

ANSWER: Hi Terrell

Yes, Smitfraudfix won't help you, but Combofix definitely works on Vista.  I suggest you follow the Vista Cleaning Procedure listed here:

http://forums.majorgeeks.com/showthread.php?t=139681

After that, if you are still having trouble, let me know.  Good luck.

Brian



---------- FOLLOW-UP ----------

QUESTION: Hello Brian,
I ran the procedures on the page you sent me and I had the following struggles
I was able to run Super antivirus but spybotsd and mbam would not work no matter how often I would attempt to run them. I skipped over them and followed the directions to combofix. After launching, my system did a system reboot. Once it rebooted I received repeated bad image reports. Combofix was not even able to complete a log after 2 hours. I figured that because it reported it to have a bad image it was malfunctioning. I restarted my computer in safe mode in attempts to run combofix again, but literally every single running application presents me with the same message ie: attrib.cfexe - Bad Image (text) C:Windowssystem32clbdll.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.
This message is repeated for every task that runs. I cant even tell if my original virus was fixed because I cannot get things to run properly on my computer anymore. PLEASE HELP :-(

Answer
Hi Terrell

Please download TrendMicro HijackThis! from the following link:
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
* Save HJTInstall.exe to your desktop.
* Doubleclick on the HJTInstall.exe icon on your desktop.
* By default it will install to C:\Program Files\Trend Micro\HijackThis.
* Click on Install.
* It will create a HijackThis icon on the desktop.
* Once installed, it will launch Hijackthis.
* Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
* Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into a follow-up here for me to look at.

Brian