Help! Can't download or run any anti-virus software.

[dfa987]

My hubby's computer has got some sort of virus or hijacker that won't allow me to go to any anti-virus sites, download any anti-virus software or even if I try it from CD as it won't finish the loading process.  Doesn't matter what kind of software or who the maker is.

I've used spybot, adaware, cwsshredder, hijack this and there's nothing showing up - so I'm assuming it's a virus.  Whatever it is, it's very smart.  If anybody's got any suggestions I would be very thankful.

[raman]

Try to start/install the AV-Software in save mode and post your log(if you want)

[dfa987]

First, thank you for replying.  Second... I was able to load avast in safe mode.  I did a scan in safe mode and it didn't come up with anything.  I've subsequently tried to run it normally and it boots down.  

The way this thing works is that whenever you try to use any anti-virus programs or go to any anti-virus sites, including anti-spyware sites or any forums that deal with spyware or viruses, the computer shuts down.  And when it shuts down, it often shuts down 3 times before a full load.

I did an ad-aware scan in safe mode and it gave me something about a media player, but it shut down before I could read it. :-(

[whocares]

Hi,
what win do you have ?
if Win9x/ME, try Boot-Disk from Win and F-Prot Boot-Disks..
also run Spybot in safemode and cwshredder
see Search for Links/Details
 

[dfa987]

   Aarggggh.  I did what you suggested and I've tried just about everything and his computer is still snagged by either a virus/hijacker/trojan/hacker.  I finally got Avast to work in safe mode and found 2 viruses: "Trojano-057" and "Istdnldr-B" and it appears to have been fixed as they no longer show up.  However, the machine still cannot go to any sites that have anything to do with anti-virus, anti-spyware, etc sites.  It's making me crazy trying to figure this out.  I don't even know how to google my question.  

[Max M.Wachtel III]

sounds like My Doom check out this site:
http://www.microsoft.com/security/antivirus/mydoom.asp
It has a check tool and a removal tool
if you can't get to that site try this one- it is the removal tool:
http://information.microsoft.com/downloads/details.aspx?FamilyID=c14bfbe4-3d50-464d-a26c-9c287f8a08c5&displaylang=en
post back-max

[dfa987]

Unfortunately, the MyDoom program didn't give any results.  I ran it from a floppy.  Is it possible there is some new form of MyDoom?

My tech guy (who's too busy to help me) says that he has 4 other clients who are having the same problem.  Could be unrelated, but might not be.

[raman]

Please post a Hijackthis log: http://tomcoyote.com/hjt/

[igor]

You can try the avast! Virus Cleaner, if it's MyDoom (though there are many other possibilities).

For example, some Yaha variants "filter" the executable files being started... and won't allow much to pass through.

[dfa987]

Thanks I posted at TomCoyote.  Crossing fingers...

[jonzsie]

I found a virus awhile ago on my start up program. It had stopped me going to any sites, updating my virus program and downloads like windows and virus program. When I unchecked the box it worked fine.

[dfa987]

What check box?  Now you've really got me curious.

[jonzsie]

Sorry I missed your post have been away. I had msblast.exe and it was on the start up menu in the registry. I thought I had got rid of it but it was still there.  I clicked on start then run and typed in msconfig/ok/start-up and that's where it was running on start-up so I unchecked the box then clicked ok and everything started downloading again. It was still there for awhile I couldn't get rid of but now it's gone.

[impozzo75]

goto C:\WINDOWS\system32\drivers\etc then open thenfile "hosts" with notepad.

delete all line except a line like:

127.0.0.0   localhost

THE DELETED ENTRIES WERE NOT ALLOWING YOU TO ACCESSS ANTIVIRUS WEBSITES

[whocares]

This could be it.. but why the rebooting ??

P.S.:
a) it's 127.0.0.1
b) depending on OS, this file could be located somewhere else, or called lmhost(s)