[Resolved K] Full-sized windows are popping open by themselves....

[RichieAnything]

My scan is stalled at 94% after 4:15 .....    Also, my anti virus TREND MICRO started a scan on its own during the ESET scan...

[RichieAnything]

My ESET scan stalled...

[RichieAnything]

4:45 scan time...  still only 94% done....?

[kevinf80]

Taken from the frequently asked questions at the ESET site:

Why does ESET's Online Scanner run slowly on my computer?

If you have other antivirus, antispyware or antimalware programs running on your computer, they may interfere with the ESET Online Scanner and slow it down. You may prefer to disable any real-time protection components in your other security software before running ESET Online Scanner. Just remember to turn them back on when you're finished!

If your on board security kicked in and tried to do a scan it will definitely clash with ESET.

[RichieAnything]

HOW DO I DISABLE TREND MICRO SO THAT THE ESET CAN COMPLETE ITS SCAN.....?

[RichieAnything]

I finished the scan, but there was no way to click any options after the scan finished....  there was just a window that asked about a 30 day trial...

I was unable to do the following:

When the scan completes, push
Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the  button.
Push

there was no way to save any files to my desktop from the scan..

FWI--  no threats were found..

[RichieAnything]

I am referring to the ESET SCAN..    I was given no options after the scan finished...

[RichieAnything]

I just had a computer "freeze"    control-alt-delete did not even work..  escape didnt work..
.  I had to force a shut down by holding the on/off button....

[kevinf80]

OK, do the following:

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

Link 1
Link 2

• Ensure that Combofix is saved directly to the Desktop <--- Very important
  
  
• Disable all security programs as they will have a negative effect on Combofix, instructions available Here if required. Be aware the list may not have all programs listed, if you need more help please ask.
  
  
• Close any open browsers and any other programs you might have running
• Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
  
  
• Instructions for running Combofix available Here if required.
  
  
• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read Here why  disabling autoruns is recommended.

*EXTRA NOTES*

• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

How to turn off Trend Micro http://www.ehow.com/how_8196998_turn-off-trend-micro.html

Kevin

[RichieAnything]

I do not know how to exit or deactivate my TREND MICRO TITANIUM + ANTI VIRUS SOFTWARE...   I CALLED A NUMBER AND SOME INDIAN GUY GAVE ME THE RUN AROUND...

[kevinf80]

Right click on the TM icon next to the clock, what options are you given? is there an exit option? is there an option for settings?  or an option to access shields. If you cannot turn OFF the program then uninstall it....

[RichieAnything]

I figured out how to turn off TREND MICRO antivirus..  and I turned off firewalls.  But, when I attempted to run COMBOFIX 4 small windows kept popping up all night with no progress..   I had to go to safe mode just to get the COMBOFIX to stop running....


I am kind of nervous about messing up this computer more than I am concerned with this spyware..       What do I do next?      I suppose that something else may be preventing me from running COMBOFIX that I am unable to identify and turn off...

thanks for your help...

My main issue is that my mother is afraid to use online banking on this computer now...   Do I possibly have a keylogger?  or can I still use online banking website without worrying.?

[kevinf80]

I would advise against using your system for online banking until we have made progress. OK continue as follows:

Step 1

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

Link 1
Link 2

• Ensure that Combofix is saved directly to the Desktop <--- Very important
  
  Before saving Combofix to the Desktop re-name to Gotcha.exe as below:
  
  
  
  Do not run CF yet.
  
  Step 2
  
  Please download Rkill and save to your Desktop.
  
  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and Run As Administrator.
    
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    
  • If not, delete the file, then download and use Link 1 from the following list and so on in sequencial order until one runs successfully.
    
  Link 1
  
  Link 2
  
  Link 3
  
  Link 4
  
  Link 5
  
  Link 6
  
  • A log pops up at the end of the run. This log file is also located at C:\rkill.log. Please post this log in your reply.
  • If you get an alert from your own Security Program, accept it and allow Rkill to run, it is very safe and will not harm your system.
    
  • If the tool does not run from any of the links provided, please let me know.
  
  Step 3
  
  If you run RKill successfully continue with Combofix as follows:
  
  
• Disable all security programs as they will have a negative effect on Combofix, instructions available Here if required. Be aware the list may not have all programs listed, if you need more help please ask.
  
  
• Close any open browsers and any other programs you might have running
• Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
  
  
• Instructions for running Combofix available Here if required.
  
  
• If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
• When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read Here why  disabling autoruns is recommended.

*EXTRA NOTES*

• If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
• If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
• If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin

[RichieAnything]

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 10/03/2011 at 12:14:54.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:



Rkill completed on 10/03/2011 at 12:15:15.

[RichieAnything]

I am now running in safe mode with networking because the COMBOFIX was popping up 10 screens that flashed down the page- over and over...  It looks like it was being blocked from running..

Before the screens popped up, it rebooted on its own..   

Now, when I go to regular startup mode, the windows will not stop flashing over and over...