Not being able to boot to windows or safe mode/w networking is a problem.

You could download malwarebytes from a good pc onto a flashdrive, insert that flash drive into the broken pc and run it maybe it will help.

I didn't try safe mode/w networking....just safe mode.
It booted up then, but, I couldn't do much.
Don't know how I could get a flash drive to work.
I just wonder if this is a virus or if my pc crashed.

Try it boot to Safe mode w/ networking

If it works do this,

Please download Malwarebytes' Anti-Malware to your desktop. Click here
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
 If an update is found, it will download and install the latest version.
 Once the program has loaded, select "Perform Full Scan", then click Scan.
 The scan may take some time to finish,so please be patient.
 When the scan is complete, click OK, then Show Results to view the results.
 Make sure that everything is checked, and click Remove Selected.
 When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
 The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
 Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Thanks Zep. It might be a few days before I do this, as the bad puter is disconnected right now. Just so I get this straight, when I am in safemode/networking, I will be able to get on the internet and download? I'm afraid I don't know what the difference is between just safe mode and safe mode w/ networking.

Yes download the "CLICK HERE" in my above post that's all, don't go anywhere else on Internet, as your Anti Virus will not scan in safe mode w/networking. Hopefully Malwarebytes may clear out enough junk to connect normally we will see..

zep

Thanks alot zep...appreciate your time :)

You're welcome,

I'll be checking for any progress you make.

You're welcome,

I'll be checking for any progress you make.

Zep, just finished the scan. It detected many things wrong. I let it do it's thing, then it needed to restart. I let it, but it back to the Blue page with Admin and user on it. I'm afraid it didn't fix it...sigh
Here's the report:

Malwarebytes' Anti-Malware 1.34
Database version: 1829
Windows 5.1.2600 Service Pack 3

3/9/2009 4:30:24 PM
mbam-log-2009-03-09 (16-30-24).txt

Scan type: Full Scan (C:\:D:\:)
Objects scanned: 184559
Time elapsed: 36 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 10
Registry Values Infected: 3
Registry Data Items Infected: 9
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\"3c2d2a1e-031f-4397-9614-87c932a848e0> (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\"04a38f6b-006f-4247-ba4c-02a139d5531c> (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\"2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c> (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"9522b3fb-7a2b-4646-8af6-36e7f593073c> (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"1a26f07f-0d60-4835-91cf-1e1766a0ec56> (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"deceaaa2-370a-49bb-9362-68c3a58ddc62> (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\ld02.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ntdll64.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temp\ntdll64.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\ntdll64.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\Temp\mousehook.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Temp\mousehook.dll (Trojan.FakeAlert) -> Delete on reboot.

Of course, I don't know what any of this means. I will check back later for any input.
Thanks so much for trying to help me!
Jo

Do this next please, and we will probably refer you to a malware forum.

Click Here to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.
DO NOT use the AnalyzeThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what HJT lists will be harmless or even required by your Operating System, a spyware fighter will guide you.

wow yes indeed you have some pretty serious infections there, a backdoor bot is not something you want to see for sure.
I agree she needs to head to one of the forums.
Hollar if you want me to help.

Raven I just want to see the log, could you do the referral after the hijackthis log is posted, that way every thing is ready for C...

omg...now I'm scared...lol
ok...going to do the next thing.....
bbl I hope!
And I thank you again!

Ok...I know this is REALLY stupid, but I can't get the program to work because the window that opens up is so big, I can't get to the bottom to "accept terms" etc.
I tried to change my screen resolutions setting, but it wont change...maybe because I am in safe mode???
sigh....now what?

Try this:

Please go to link below, where it says here is a link that may be useful, on that page you will see to the left:

HJTINSTALL.EXE

Click on any one of them, a window will pop up-----Choose "Save File" and save it to the desk top, once you have on desktop double click it and follow directions for hijackthis in my other post.

All you are doing is a system scan an safe a log file post if you can

ok I will start a thread for you over on the support help forum Iowajo, it will have your name in the title, you will need to register on that forum, then go to the area I am linking to which is the hijackthis area of the forum, you will see your thread there. Please wait for assistance, Corrine or one of the team will be there to help you.
don't get scared the team is very nice and very helpful but you do have some nasty stuff there that needs some extra help.
Do not use that pc for anything like purchases or banking at all at this time.
This is the link to the other forum.
HijackThis Logs
just go there and register and look for your thread.

Zep...I d/l'ed it again, but again, the window is too big to do anything with. Can't get to the buttons on the bottom. Sorry I can't get you that info. So frustrated I'm crying!
Thanks tho.
Going over to that other forum now.....

Zep, I just wanted to say Thank you again for all your help.
I sooo appreciate it! People like you are why I come to this site whenever I have pc problems. The most helpful people are here! I will let you know how it turns out.
Jo

Thank you,

I'll be watching as they work through you issues.

joe

Joe.....I'm fixed!!!! Thank you so much for your help.
Raven...Thank you so much for sending me to your wonderful site. What great people you all are!!!!
I am sooooo jazzed, I can't stand it!
Thanks!!!
Jo

Your not fixed yet, there will be more to do I have seen the logs, run those programs the she gave you and remove the old Java you know the stuff you could not do in safe mode.

Where in the world did you get the Avenger program?

I did run all the programs except that original "highjack" one that I couldn't get from safe mode.
The 2 eariler Java programs must of been removed by one of the programs she had me do...I went to uninstall them since I wasn't in safe mode anymore, and they are gone. Just the last Java is still there, and I might need it, as the Java she told me to d/l wouldn't...said something like "administrator settings do not allow for this type of d/l" or something like that.
Anyway....if they tell me to do more...I sure will!!!
I'm so jazzed I can hardly stand it. I have NO money to take this puppy in to get repaired.
Off to bed before I break it again....
Thanks again Joe...nice to have someone to talk to about this!
Jo

"Where in the world did you get the Avenger program?"

The only thing I can think of is that it came with the Malware program. I d/l'ed that, then ran it. By the time stamps, it looks like it came onto my pc while malware was scanning. I have no other idea on how it got there.
Odd....

Ok make sure you finish up there.

Glad things are better, but important to follow up..

you did great Jo, and yes the team there is excellent, and zep did a great job in getting you started.
Just keep watching for any more info over there and get it all finished up.
you are very welcome.

Jo I want to mention that when you get your games, and man you have a ton of them I don't remember ever seeing so many before, and especially those screensavers you really run a big risk of getting malware with them, especially some of those screensavers. I suggest first not getting them but if you have to before you ever open it on your pc when you first download them right click on each and every one and select from that menu to run your antivirus scan on it and also now that you have malwarebytes run that also.
From now on it is important that you keep malwarebytes updated and run it very regularly. In fact I would run it every night for about a week after you get all cleaned up just to make sure something does not try to get back in.

It is unfortunate but the reason some sites are set up and give away games and screensavers is to get people to download them and install them with out checking them and then when the payload gets installed voila they have a backdoor into your pc. which in some cases means they have full control over your computer.

Did you have Norton on your pc at one time? and now use AVG7? I am seeing some Norton stuff still on the pc. And what firewall are you using now? Those are things you will need to discuss at LzD. We want to make sure you are well protected.

Not done yet but getting closer.

Hi Raven, Those games are from Pogo.com, They aren't full games on my pc, they are something Pogo d/l's to make the games come up faster on their site. Every time you try a game there, it d/l's something. I have been going there for years, so I trust them.
The screensavers I already deleted, but I also got them from a trusted site, not just any 'ol site, but I will just avoid them altogether in the future.
I was wondering about the Malware program. You do mean the one I got from the link here, right? I will run it every night for awhile.
I did originally have Norton, but didn't like them, so did not renew. I use AVG now. I do not know what firewall I am using. I am guessing just what comes with Windows, unless AVG has one.

Thanks for the help!

Jo this link might help you with your firewall issue it tells exactly how the pop ups happen and how to handle them, it shows it for zonealarm free but it is similar for all.
zonealarm free is an option for you but if you do get that one be sure you do not accept the checked toolbar or any other extras they try to push on you.
Firewalls and ZoneAlarm Guide and Tips

I do not agree with the part of the article that says the xp sp2 firewall is sufficient, but it is better than none so if you find you simply can not handle one at the very least go to control panel and security and turn on that one.

I will try that one, ty Zep.
I don't know why I am so intimidated by firewalls, but I am.
Everything is moving along so smooth and nice right now...just don't want to mess it up :)

I will not give any instruction until your finished there.

I will give an opinion:

A firewall is only as good as the users ability to interpret the data being presented so you will need to read about it.

Ok...I read that guide, started off easy enough but about halfway thru my eyes got blurry and all I could see was blah, blah, blah....
I just don't understand that stuff. I'm just a self-taught pc user, and I guess I was just lucky for 10 years.
I will just have to stick to trusted sites and
hope I can stay lucky for awile more, because I am too afraid of all the firewall jargon.
I dunno....I'm just frustrated now.
Thanks for your help Zep

Jo, just take your time and don't get intimidated by what you read. The firewall will simply ask you to allow or deny certain actions. You can always deny, and if a program doesn't work, then you can change it to allow. You always want to allow your anti-virus and antimalware programs as well as the browser(s) you use. Zone Alarm is really not difficult to use. I leave all the settings at the default. After it has been in use for some time, it "learns" what to allow and seldom bothers with popups asking you to allow or deny.

Most of us here are self-taught and many of us are senior citizens. I'll bet I'm one of the oldest posters here. Good luck to you.

Thanks grams
I think on Monday (at work) I will print out that guide so I have it, then give Zonealarm a try.

just be sure if you decide to use zonealarm you get the free version not the trial version and do not get any of that added stuff.
ZoneAlarm ® Firewall
that should be the direct download for the free za

as was stated as you go along with a firewall and it asks you to allow it to access the internet the ones you know for sure like your antivirus and your browsers you can put a check mark in the remember this box and it will no longer ask you for that one unless you do an update to the program then it will ask again and you tell it to remember again. You do not want to give server rights to anything so if the box pops up asking for server rights say no then it will pop up asking for just permission to access that one you can allow if it is something you are familiar with. If you do not recogonize the name of what is asking for permission you say no, then if you see that something you were trying to use would not open you know that was the thing that was asking for permission, so you can know to allow it next time. That generic 32 one that had you worried you MUST allow that or you can not do anything, that is a process you need to set to always allow.
First time you use any program the firewall will have to ask you for permission, say your music player for example, tell it yes to permission and check the box for remember and you are done with that it will not ask you again.
At first it seems daunting but once you get thorugh that initial flood of setting up what can and can not access then you rarely ever get bothered by it.
What you are trying to prevent is allowing something that you are not familiar with which may be malware that got on your computer and is trying to phone home to whoever wrote the malware and it will then be sending info from your pc to that person. that is why it is very important not to just always click to allow, know what you are allowing. If you do not recognize a name copy and paste it in google and see what you find out usually you can tell right away what program it is. also with most firewalls you can click for details and it will give you info that can help tell what is asking for access.

I am totally self taught and also one of the older crowd, we were all newbies at one time!

but please if you do not put in a firewall DO go turn on the one you have with xp it is better than nothing, however if you put one in you must turn that xp one off you can not have 2 firewalls.

Thanks to all of you I decided I should look and see how many programs are running on my computer. I am thinking I did follow the great advice from you all here. There were a lot of programs with my name on them, also some with 'system", network Service' and 'local service'. I think I understood that I was not to delete those three but it was okay to delete anything with my name if you are sure you want to get rid of it. What I don't know is, how can you tell for sure if you DO want to delete it. One with my name is 'iexplore.exe' with 65,992!! I have no idea what that would be.
Also, I'm not sure how to do the Google search on this one or any of the others. Just type it into the Google search box? Boy, I get dumber all the time. Thanks in advance for your help. You are the best. BT

no no I definitely would not go deleting anything. We do not say to delete we say you can make it not start when you boot up your pc, that is all. I don't know what you mean by with your name on them???
Where exactly are you looking and finding this? in msconfig start up menu? or in your add remove programs list? or were you looking in the task manager at what was currently running?

"iexplore.exe" is the Internet Browser from Microsoft. It is a part of the Windows Operating system
That is your Internet explorer!!! what ever you do don't try to delete that.

Lets be very very clear on where we are and what we are doing ok.

good morning, ravencajun. thanks for your reply. Whew, glad you answered because I did a Google search and a lot of the Q&A responses said it was something that should be deleted. To be honest, I was not going to do anything until I heard from you or zep. Here's what I did: clicked Ctrl+Alt+Delete to the Task Master. Looked at the applications tab,then to Processes tab. And it warned not to touch 'system', 'network service' or 'local service'. then I thought you could delete the things with my computer/registered name after doing a Google search to see if I want to delete them. OMG, I'm so glad I didn't do anything. Thanks Raven, you are a gem. I think you should come to Iowa to give computer lessons. how about that? lol I would be your first student, for sure.

ok now that I know you were in the task manager I can breathe again LOL whew is right. In task manager if you end task on something like for example your iexplore.exe what will happen is that your Internet explorer will shut down. It will not delete it or change it, just shut it down. So you can use task manager if you happen to have a stubborn program that will not shut down properly, you can go in there and select it then choose end task. In task manager you can view how much of your resources are being used, how much cpu % usage and what is using it up, so if you see one program hogging all your cpu resources then you know you have a problem with that program, some things will use occasional spikes of cpu which is ok but you do not want something staying stuck at 100% for example.

I would be happy to give you lessons but the commute from Dallas would be dreadful LOL

since you were talking about the zone alarm on here... my zone alarm is kind of pointless for me.. i have to shut it off in order to get on the internet because otherwise it blocks me out... how do i fix this?

now, Raven, the trip to Iowa would only be difficult coming here. Going home would be downhill all the way. lol. again thanks so much for all your help

Polarprincess, you should not have to stop the firewall. Start a new thread of your own and explain which operating system and what you do or do not have to do to get online.

polarprincss please read the posts above where I was giving directions on how to allow and disallow programs, you are likely not allowing the generic 32 process which is what allows you to get online, certain things must be allowed in order to get to the internet, the one thing you do not want to do is turn off your firewall that is indeed causing it to be useless, if you view that link I provided on how to use zone alarm it will guide you through much of those issues, once you have it set properly it is pretty much able to take care on it's on. As Owbist said if you want to start your own thread so it does not get lost here I will be glad to help. But please do read the parts of this tread dealing with that issue since I have already typed it here.

Iowa that is a state I have never been too, see I could add that to my bucket list LOL