Help with computer virus

[CATCH17]

I have a computer virus and I have no idea how to get it off.

I run malware bytes and spybot. It detects and deletes what it finds but the virus is still there. I just can't get rid of it.


When I try to go to a website this pops up before it goes to some other random link


http://ninjaa.info


I would appreciate any help I could get because I can't figure this one out on my own.

 

[Jenky]

Boot into safe mode. Turn off system restore, scan it, remove threats, reboot, turn system restore back on. Boot into Windows and see if anything is wrong.

 

[CATCH17]

Boot into safe mode. Turn off system restore, scan it, remove threats, reboot, turn system restore back on. Boot into Windows and see if anything is wrong.

Alright. Thanks for responding. I know you know what you're talking about because you've helped silverbear before.

Going to try this...

 

[cowboys#1]

combofix

 

[CATCH17]

Alright I tried turning off System restore in safe mode and it didn't have an option to do that (Vista) that I could find.


Then I tried to turn it off in regular windows and it keeps searching for the disk.

 

[CATCH17]

I got it turned off in normal windows, ran the scan in safe mode, found something with spybot, and it still has the problem.


Im guessing it's a must to turn it off in safe mode....?

 

[YosemiteSam]

Open IE. Go into Tools->Internet Options->Connections->Local Area Network (LAN) Settings and make sure everything is unchecked. Especially the Proxy Server. (even if you don't use IE, it's a windows system wide setting)

Also note if the proxy server is selected. If it says localhosts or 127.0.0.1 it means their is a proxy installed on your PC. If it has a remote address, then they just set it up to forward to their proxy.

Either way, change any passwords you've used since this started.

 

[CATCH17]

Open IE. Go into Tools->Internet Options->Connections->Local Area Network (LAN) Settings and make sure everything is unchecked. Especially the Proxy Server. (even if you don't use IE, it's a windows system wide setting)

Also note if the proxy server is selected. If it says localhosts or 127.0.0.1 it means their is a proxy installed on your PC. If it has a remote address, then they just set it up to forward to their proxy.

Either way, change any passwords you've used since this started.

Just looked and everything was already unchecked. Thank you.

 

[Jenky]

In spybot, do you have the following checked?

http://img109.*************/img109/7767/sbot.jpg

 

[CATCH17]

It's some kind of redirect virus.

 

[CATCH17]

In spybot, do you have the following checked?

http://img109.*************/img109/7767/sbot.jpg

Let me lookl.

 

[CATCH17]

Ok those were unchecked. Scanning again.. Do I need to turn off system restore again? Guess I do.

 

[Jenky]

Ok those were unchecked. Scanning again.. Do I need to turn off system restore again? Guess I do.

I would, yes. When that's done go to this website (if you don't get redirected LOL) and download their rootkit scanner.

http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx

 

[Yeagermeister]

Ok those were unchecked. Scanning again.. Do I need to turn off system restore again? Guess I do.

If you have turned it off it stays off until you turn it back on.

Go here to download and run combofix

You may have to boot in to safe mode with networking to get it to download.

http://www.bleepingcomputer.com/download/anti-virus/combofix

 

[CATCH17]

If you have turned it off it stays off until you turn it back on.

Go here to download and run combofix

You may have to boot in to safe mode with networking to get it to download.

http://www.bleepingcomputer.com/download/anti-virus/combofix

It runs the exe file then does NOTHING lol. Wow im gonna restart and try again.

 

[CATCH17]

I would, yes. When that's done go to this website (if you don't get redirected LOL) and download their rootkit scanner.

http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx

Scan in safe mode?


It scans and then stops at hkey_local_machine.



The combofix wont even download for me

 

[Jenky]

Scan in safe mode?


It scans and then stops at hkey_local_machine.



The combofix wont even download for me

How long does its it scan for? Also is there a registry entry/key? Like is there a name attached to it?

Example: hkey_local_machine/location/location/location (depends how far in the hive you are)

 

[CATCH17]

Yeah Combofix just shows up nowhwere after download.


After I try to download combofix it asks me if I want reduced functionality Yes/No. I've clicked on both and a blue screen that says administartor pops up and it's nowhere to be found again.

 

[Jenky]

Combo fix won't download for you? Something is blocking it then. I am to download it. Can you put it on a USB stick from another computer?

 

[CATCH17]

How long does its it scan for? Also is there a registry entry/key? Like is there a name attached to it?

Example: hkey_local_machine/location/location/location (depends how far in the hive you are)

Ah I gave up on it but maybe its just really slow. Let me start it again.