XP Internet Security 2012 Trojan virus

[jackelec]

My home PC has recently contracted the XP Internet Security 2012 Trojan virus. I have run an Avast full system scan and a start up scan. Neither have detected this virus. Short of taking my computer in for repairs, does anyone have any ideas? 

The virus has rendered my home PC unable to connect to the internet. 

Help please!

[Pondus]

Try this guide, and read it all before you start
http://deletemalware.blogspot.com/2011/06/remove-xp-antispyware-2012-xp-internet.html

if no success report back and Essexboy will remove it for you...

[jackelec]

Who is Essexboy? I am concerned that since I can't copy and paste to my home PC (no internet access due to the virus and not networked with this laptop) I am going to screw something up and make things worse. I am only partially computer literate.

[Pondus]

Essexboy is the malware remover expert..

I send him a PM...

[jackelec]

Thank you! This is so frustrating. I've used Avast for 8 years without fail... and now... 

[essexboy]

Hi there lets get to work - is your start menu blank ?
The first programme will disable the malware, not kill it (yet) if you should need to reboot then just run it again.
All programmes are small enough to be transfered to the sick computer by flash drive

Download

RogueKiller to your desktop
 

• Quit all running programs
• For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
• When prompted, type 1 and validate
  
• The RKreport.txt shall be generated next to the executable.
• If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe 

Please post the contents of the RKreport.txt in your next Reply.

THEN

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTS  to your Desktop

• Close ALL OTHER PROGRAMS.
  
• Double-click on OTS.exe to start the program.
  
• Check the box that says Scan All Users
  
• Under Additional Scans check the following:

Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check

• Now click the Run Scan button on the toolbar.
  
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
  
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
  

Please attach the log in your next post.

[jackelec]

I am going to make you crazy before this is all done, but... I only speak/read english and some spanish. I am not sure where I need to click on the Roguekiller website to download, and what is the cost?

[jackelec]

never mind, I figured out the download ( I think) but even after changing the name and trying near 30 times to run or open it... it is blocked by XP Security

[essexboy]

No problem, the programme is free and this will apply to any programme I ask you to run.  Click on the link as shown on the screen capture 

[essexboy]

OK we will not be beaten

Note: If using Firefox right-click on any download links and choose Save As
 
Please download OTH to your desktop
Please download OTS  to your desktop

 
Double click the OTH file to run it and click Kill All Processes, your desktop will go blank.
 

 

Then run OTS as requested previously

[jackelec]

We need a chat option  

I got it open, when I started it the notepad came up and says "Cannot find the \RKreport[1].txt file. Do you want to create a new file?"

Do I?

[essexboy]

So RK has now run with option 1 - If so then start and run OTS please

[jackelec]

It is scanning.(OTS)


Do I want to do anything on the notepad where it asks if I want to create a new file?

[essexboy]

No OTS will give me the data I need

[jackelec]

Well... the scan finished, but everything is gone from my desktop - I recopied the Roguekiller file from my flash drive but it won't open it. Saying "The application failed to initialize properly".