Major infection?

[zoomom22]

My sisters laptop has Avast and she got message saying it was unsecured we didn't realize we just had to re-register so were waiting for payday to purchase more protection. Immediately afterwards, within a matter of hours, she was unable to get online at all and seems to be severely infected. How can we fix this. Can't get online to re--register it or update. This is her only computer and she needs it badly. I'm trying to help her repair this over the phone as we live states apart and she now has no internet access. Can anyone help us? Thank you.

[mikaelrask]

hey and welcome to the forum. i would suggest a clean installation of avast. download the latest version of avast from avast.com

uninstall the avast shes using at her computer by running the uninstall tool.

reboot the computer

install the latest version you have downloaded.

links:

avast program

http://www.avast.com/en-se/index

unistall tool

http://www.avast.com/en-se/uninstall-utility


if you think your infected please follow this guide and attach your logs. a malware expert will help you from there.

http://forum.avast.com/index.php?topic=53253.0


hope this will help you out.

[zoomom22]

How can she download and install a new avast when she cant get online tho? She says its totally locked out of the internet and unable to get online at all.  Is there a way to make the version of Avast she has work to fix this even tho it says its unsecured? At least until she can put a new version of after its fixed?
Thanks

[Pondus]

how does she know she are infected....any warning pop up from avast?

if avast does not work, try repair

controlpanel > ad remove programs > avast > uninstall > repair option.....wait two minutes and reboot

[essexboy]

What error does she get that stops here getting online ?

[zoomom22]

"Windows cannot find c:windows/system32/igfxperf.exe" on boot up screen. "Virus Protection Important - windows cleaner says virus protection off."  "Win7 security cleaner Pro firewall alert" register or remind me later buttons. Then gets pop up saying "dnk.win32.keylogger.gen" These are some of the messages shes saying shes getting. Going through her list of installed programs its not even showing Avast there at all anymore. When opening Chrome gets message saying "Win7 security cleaner pro has blocked has blocked a program from accessing the internet. Win security has detected trojan-dnk.win32keylogger.gen. Sorry this is such spotty info. Hard to get it all over the phone. Thanks so much for your help. This being her only computer its a disaster not being able to be online. Thank you!

[essexboy]

OK that is a Rogue AV blocking

Is there any way that she can download a programme to a USB drive ?

[essexboy]

Also is she able to access either task manager or safe mode ?

[zoomom22]

Yes, she says she can download a program to a flashdrive from a different computer and she can open task manager on the infected laptop. She doesn't know if she can access safe mode for the time being.

[essexboy]

OK this programme can be run from the flashdrive, it may need to be run a few times.  If the malware tries to stop it then do not close any popup it generates

• Download RogueKiller  and save it on your desktop.
   
  NOTE: If using IE8 or better Smartscreen Filter will need to be disabled
  
  
• Quit all programs
• Start RogueKiller.exe.
  
• Wait until Prescan has finished ... 
•     Click on Scan

   
 

• Wait for the end of the scan. 
• The report has been created on the desktop. 
• Click on the Delete button.

     

• The report has been created on the desktop.

• Next click on the ShortcutsFix   
  
  
• The report has been created on the desktop.

Please post:    All RKreport.txt text files located on your desktop.