[SarahDoughnut6]

Hi, my brother's computer has the AV Protection virus. I've joined several forums to try and get help, they have all stopped responding. I'm been using my computer (what I'm on now) to look up support. The problem was so bad, I couldn't even boot to desktop, even in safe mode. I could get as far as the welcome screen, type in the password, the computer would wait awhile, then say 'User log on failed to execute' or something along those lines. Because I can't get on the desktop, I can't run any malware removal program.s Before, when I COULD get to the desktop, I would try to and the programs would stop running, or the computer would restart continuously. I followed the steps from one forum to boot from CD to reatogo desktop. I used OTL to make custom scans, using my USB drive to copy the instructions the forum gave me for the scan from my computer to his. Their last instructions had me do a scan and then if it worked I was supposed to use combo fix, but I don't think the scan worked. Can someone help me? I have attached the latest OTL

Attached File(s)

•  Latest OTL.txt (77.74K)
  Number of downloads: 7

[Rommel]

SarahDoughnut6, on 28 November 2011 - 07:37 AM, said:

Hi, my brother's computer has the AV Protection virus. I've joined several forums to try and get help, they have all stopped responding. I'm been using my computer (what I'm on now) to look up support. The problem was so bad, I couldn't even boot to desktop, even in safe mode. I could get as far as the welcome screen, type in the password, the computer would wait awhile, then say 'User log on failed to execute' or something along those lines. Because I can't get on the desktop, I can't run any malware removal program.s Before, when I COULD get to the desktop, I would try to and the programs would stop running, or the computer would restart continuously. I followed the steps from one forum to boot from CD to reatogo desktop. I used OTL to make custom scans, using my USB drive to copy the instructions the forum gave me for the scan from my computer to his. Their last instructions had me do a scan and then if it worked I was supposed to use combo fix, but I don't think the scan worked. Can someone help me? I have attached the latest OTL

Someone will come along and give you complete instructions on how to get and use a linux operating system disc. ( free )
When downloaded and and burned to a disc, you'll need to boot from it, not your current infected HDD.

This link, http://www.google.co...q=0&aqi=g10=

has some linux OSs you could look at if your unfamiliar.
Sorry for not much help but you've come to the right place.
A detailed reply will come.

[Dellinsp531]

There are three things to use. (Chose one that you feel would be easier for you)

1)You can get http://www.ultimatebootcd.com/ and used that to remove the viruses.

2) Another Option would be to use http://live.sunbeltsoftware.com/

3) Get a linux boot CD, http://www.f-secure....moval/rescue-cd


If you got questions, post them.

[SpiritWind]

Hi "Sarah" :

I think your brother got what the malware fighting
"community" calls "AV Protection 2011" !? There is
an excellent "Uninstall Guide" by the highly regarded
BleepingComputer website specifically located at
www.bleepingcomputer.com/virus-removal/remove-av-protection-2011
but at this point it seems you will be unable to use it .
It might be helpful IF I knew which specific forums you
sought help and what Username you used to see specifically
what you were told !? I can tell part of the "process"
was posting a "log" from the "OTL" program, but there is
no one on these PC World forums skilled at using the
OTL program .

[coastie65]

Hi Sarah and welcome to the forums. I am going to try and go live with that link that Spiritwind provided: www.bleepingcomputer.com/virus-removal/remove-av-protection-2011 . I was looking at the log you provided. Your brother is apparantly running both McAfee AND Norton actively. Not good as both are system hogs and use a lot of resorces. I would remove both ( using Programs & Features and then follow up with the respective removal tools to complete the process ) and then install MSE ( Microsoft Security Essentials ). Avast! us a good free program and you could use the paid version of SUPERantispyware : www.Avast!.com & www.SUPERantispyware.com .

[SarahDoughnut6]

http://www.bleepingc...38#entry2490138

This is the forum that was giving me instructions. The computer is now running the latest scan the guy asked me to do, so that's currently where I'm at.

[Dellinsp531]

The best option would be to run f-secure.This will load into RAM and be able to find the virus on the hard drive.

If it does not, than use ultimatebootcd. This way you can get to your hard drive and clean it out.

[SpiritWind]

Hi "Sarah" :

I have read through your thread on the BleepingComputer
website .It certainly appears you have a highly skilled
Volunteer trying to help . I would not go anywhere else.
Best I can tell, it appears your brother is NOT following
the following Instructions from the Expert :
"# Return to OTLPE, right click in the "Custom Scans/Fixes" window and choose Paste.
# Click the red Run Fix button."

You MAY have to go where your brother is and use the
"Run Fix" button that the Expert is asking to be done !?

This post has been edited by SpiritWind: 29 November 2011 - 10:06 AM

[coastie65]

Moved this to the appropriate discussion group.

This post has been edited by coastie65: 29 November 2011 - 03:29 PM

[Victorkid]

coastie65, on 28 November 2011 - 11:36 AM, said:

Hi Sarah and welcome to the forums. I am going to try and go live with that link that Spiritwind provided: www.bleepingcomputer.com/virus-removal/remove-av-protection-2011 . I was looking at the log you provided. Your brother is apparantly running both McAfee AND Norton actively. Not good as both are system hogs and use a lot of resorces. I would remove both ( using Programs & Features and then follow up with the respective removal tools to complete the process ) and then install MSE ( Microsoft Security Essentials ). Avast! us a good free program and you could use the paid version of SUPERantispyware : www.Avast!.com & www.SUPERantispyware.com .

Good comments.
Thanks for sharing.