# Newb With Antivirus 2009 Problems....



## ant_8u

Hi Guys

First off may I start by saying I have very little computer knowledge, so I may get things mixed up but please bear with me, your help is greatly appreciated

My sisters laptop has just got the Antivirus 2009 on it
I've read a bit about it and done a few searches but can't find anything quite the same as the problems she's having

In normal mode the desktop icons and start bar have disappeared
I can eventually get the task manager to open but it's really slow
The CPU is always at 100% even though it's not doing anything
The mouse/touchpad is disabled

I can restart the computer in safemode and everything appears to be there
But once again the mouse is disabled and the CPU is at 100%

I have used another computer to download and save Malwarebytes onto an external hard drive
I then connected the hard drive to the laptop and tried to run it but it does nothing as the CPU is already at 100%

From what I have read it looks like I can solve the problem my running Malwarebytes and ccleaner etc... but I am unable to do this as I cannot move the mouse or get the CPU down from 100%

I spoke to the guys at PC world today as I'd given up - But when they said they'd charge £150 to format/ system restore the thing I though I'd give it another go again myself

I hope i've done a good enough job to explain things - like i said i'm really new to this and don't have a great understanding

Can I enable the mouse and reduce the CPU usage in order to run malwarebytes, or is there more to it than that?

Thanks in advance


----------



## johnb35

Have you tried stopping the process that is using 100% of the cpu?  Ccleaner won't do anything for the infection, but it will clean up your old temp files and such.  However, you do need to run the Malwarebytes program somehow and then use hijackthis to scan the system and then post both logs so we can take a look at them.  Try finding out what process is taking up the cpu and try killing it using taskmanager and see if it comes back.  If that don't work, go into msconfig and uncheck everything you don't need running and reboot.  AV2009 will be one of the entries but even though you uncheck it, it will still start up.  Post back and let us know the results.  Get Malwarebytes and hijackthis from this thread, follow the instructions.


----------



## ant_8u

Thanks for the quick reply John
Give me a couple of minutes and I'll tell you what processes are taking up the CPU


----------



## ant_8u

Ok - I've restarted it in Safemode
The process taking up the CPU is services.exe

I have two services.exe showing - one is 3,998k at 0%
the other is 4,956k at 99%

Earlier hte CPU was 50% explorer.exe and 50% services.exe
Now it's just services.exe that's eating everything

I looked at msconfig and unchecked av2009


----------



## TFT

Right click the services.exe taking up your CPU resources and choose "end process". If it's the wrong one just reboot and try again. If you can then get the logs up as John says.


----------



## ant_8u

I can't click on anything as the touchpad/mouse doesn't work - I can however use the arrow, tab, del keys etc....

I tried "end process" on both services.exe - both tell me "this is a critical system process. Task Manager cannot end this process."


----------



## ant_8u

I have just restarted in normal mode
winlogon.exe takes up 98% CPU now


----------



## johnb35

Have you tried the msconfig utility to stop all processes from starting at bootup?


----------



## ant_8u

I'll give it a try now and see what happens


----------



## ant_8u

Does it make any difference if I log in as Administrator or General?


----------



## ant_8u

I went into msconfig and disabled everything from start-up
Restarted in safemode, everything remains disabled - but i now have....

services
svchost
services
svchost
userinit

should I disable these too and restart?


----------



## johnb35

Most likely not.

Thats weird, my reply was supposed to be for your reply of this...

Does it make any difference if I log in as Administrator or General?  Must have been a delay in posting.


----------



## ant_8u

Ok - So now I've disabled the other items what should I do?

I restarted in Normal mode and there was no difference
I restared in Safe mode and there was no difference
CPU still shows 100% usage

The laptop doesn't seem to recognise that an external hard drive is connected either
Is this normal? - I saved Malwarebytes to an external drive from another computer as I cannot access the internet from safe mode to download it  - I was hoping I could run it from the external drive but it doesn't seem to appear

When I try to restart in safe mode with networking I get as far as logging on as Administrator, but then the screen appears black (safe mode text appears - but the screen is blank)


----------



## johnb35

At this point, unless Ceewi1 can help you out, I would just recommend do a full format and reinstall windows. I'll PM him but he won't be on until late tonight.


----------



## ant_8u

Thank you for your help so far John - very much appreciated


----------



## ant_8u

Should the laptop be able to recognise the external harddrive even in safe mode?
And how can I get the touchpad activated again?


----------



## johnb35

You should be able to activate it either in bios or a setting within windows.  As far as usb devices in safe mode, sometimes they get disabled in safe mode.  I've PM'd Ceewi1 and you should have a response from him between 2-3AM in the morning.


----------



## lawson_jl

DO NOT FORMAT AND REINSTALL unless you want your sister to loose everything on the computer.  What you need to do is to take the laptop to a trusted local computer tech.  This issue can be solved pretty easily by a computer tech, but is often beyond what a new user can do.


----------



## ant_8u

Cool, thanks John
2-3am is crazy! - What do you guys do for a living?

In the meantime, I just enabled everything in msconfig to see if there was something there for the touchpad but that didn't make any difference


----------



## ant_8u

Hi Lawson - If I lose everything she won't be too happy!! - She's got lots of pics of her 8 month old baby on there

If I copied everything to the external drive would this solve the problem?
Just copy the files that are to be kept then format and reinstall?


----------



## TFT

Ceewi1 is in a different time zone


----------



## ant_8u

If i copy stuff to he external drive am I not at risk of copying the virus/worms to it too?
Once i transfer the file back to the formatted drive could i be at risk of transfering the virus too?

Sorry for the simple questions - like I said i'm new to this, i'm here to learn


----------



## johnb35

If you copy the files she needs saved to an external drive then you should be fine.  But give Ceewi1 a chance to clean it up for you.  It might take a couple days as he lives in Australia and he is online while most of us are sleeping.


----------



## ant_8u

Yeah, I don't plan on doing anything unless instructed by others

I don't know anywhere near enough to start doing things myself


----------



## voyagerfan99

Usually a full scan with Malware Bytes, followed by removing all infections with MB usually gets rid of it.

You scanned and removed and are still having a problem?


----------



## johnb35

No, it won't let him scan.  There is a process that is running that has his cpu at 100 percent usage so he can't do anything until that process gets killed.  Start from the beginning and read so you can understand whats going on.


----------



## lawson_jl

You could slave the drive and copy the data off it another drive and do a reinstall then.  Most people have some data they want to keep so I never recommend a full reformt except as last resort.


----------



## voyagerfan99

Okay - I quickly perused it earlier. I get it now 

It may or may not be worth it, but you could get an HDD to USB adapter and scan the drive with another computer.


----------



## ceewi1

OK, a few possibilities.  Even if you are able to download Malwarebytes' onto the PC, it's quite possible that you won't be able to install it while the infection is present.  I'd like you to visit this webpage for to familiarise yourself with ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

*NOTE: When you download ComboFix.exe, rename it like so:*










In order to get it onto your system, is it possible for you to download it on another computer and burn it onto a CD?  Alternatively, see if you can download it on the infected PC.  Even without the mouse, it should be possible to download it using just the keyboard.  Try pressing the *Windows key + R *, typing in *iexplore* and press Enter.  This should bring up Internet Explorer.  Use the tab key to go into the address bar and type in the address of one of the download locations:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Alternatively, try going into Safe Mode with Networking.  When you are stuck at the black screen after logging in, press Ctrl + Alt + Del.  Then press *Alt -> F -> N* to bring up the Run dialog.  Type *explorer.exe* and press Enter.  This should bring up the normal Desktop.

It may be extremely slow with 100% CPU usage, but hopefully it should eventually load.  If you are able to run ComboFix, run it and post the log it generates.  If not, please let me know what stage you were able to get up to.



> If I copied everything to the external drive would this solve the problem?
> Just copy the files that are to be kept then format and reinstall?


Yes, but I was under the impression you were unable to see the external drive at all when it was plugged in?  Please clarify this point.  If you are able to see it, try using the external drive to copy across ComboFix.


----------



## DeskAssist

ant_8u said:


> Hi Guys
> 
> First off may I start by saying I have very little computer knowledge, so I may get things mixed up but please bear with me, your help is greatly appreciated
> 
> My sisters laptop has just got the Antivirus 2009 on it
> I've read a bit about it and done a few searches but can't find anything quite the same as the problems she's having
> 
> In normal mode the desktop icons and start bar have disappeared
> I can eventually get the task manager to open but it's really slow
> The CPU is always at 100% even though it's not doing anything
> The mouse/touchpad is disabled
> 
> I can restart the computer in safemode and everything appears to be there
> But once again the mouse is disabled and the CPU is at 100%
> 
> I have used another computer to download and save Malwarebytes onto an external hard drive
> I then connected the hard drive to the laptop and tried to run it but it does nothing as the CPU is already at 100%
> 
> From what I have read it looks like I can solve the problem my running Malwarebytes and ccleaner etc... but I am unable to do this as I cannot move the mouse or get the CPU down from 100%
> 
> I spoke to the guys at PC world today as I'd given up - But when they said they'd charge £150 to format/ system restore the thing I though I'd give it another go again myself
> 
> I hope i've done a good enough job to explain things - like i said i'm really new to this and don't have a great understanding
> 
> Can I enable the mouse and reduce the CPU usage in order to run malwarebytes, or is there more to it than that?
> 
> Thanks in advance



Did you manage to get this resolved at all? I may be able to help!


----------



## ant_8u

Thanks Ceewi1
I will try this when I get home tonight and see if I can get Combofix going

In answer to your question - I cannot see the external drive at present
I thought I should just ask though incase it suddenly appears

BTW
is ALT -> F -> N ...
ALT then F then N
or ALT + F + N ?

Thanks


----------



## ceewi1

It's Alt then F then N, I should have made that clearer.


----------



## laznz1

Antivirus 2009 is that your Virus protection? i think you will find it is a virus in itself

it sounds real bad id personally reinstall windows


----------



## ant_8u

Ok - I got into safe mode with networking and loaded the desktop
I managed to open the task manager
I even opened internet explorer (eventually!) - but the page would not open (damn it)

I think it might have been because it was taking too long to load?
Guessing this is because of the 100% CPU usage?

If I can get Combo Fix onto a CD would I be able to run it from there once I opened the desktop? - That way I wouldn't have to worry about IE not loading?


----------



## Hugh9191

Personally I wouldn't trust a computer that had been that infected in the past. I'd boot into an Ubuntu live CD and copy all the files you need on to an external HDD (which Ubuntu'll recognise) and reinstall Windows.


----------



## Respital

ant_8u said:


> Ok - I got into safe mode with networking and loaded the desktop
> I managed to open the task manager
> I even opened internet explorer (eventually!) - but the page would not open (damn it)
> 
> I think it might have been because it was taking too long to load?
> Guessing this is because of the 100% CPU usage?
> 
> If I can get Combo Fix onto a CD would I be able to run it from there once I opened the desktop? - That way I wouldn't have to worry about IE not loading?



Yes, i believe ComboFix can run from a CD. 

Please update us on your situation and post the logs once you finish runnning ComboFix.


----------



## johnb35

Hugh9191 said:


> Personally I wouldn't trust a computer that had been that infected in the past. I'd boot into an Ubuntu live CD and copy all the files you need on to an external HDD (which Ubuntu'll recognise) and reinstall Windows.



There are certain infections that the best way to clean them is by doing a format and reinstallation of windows, however this infection is not one of them.


----------



## ant_8u

Right then - I have Combo-Fix on a CD
I'm running it on the laptop as i type this

So far I think it has done a quick scan, deleted some stuff, and rebooted windows

I currently have a blue window on the screen saying "preparing Log Report" etc...

I'll let you know when things start to happen


----------



## ant_8u

Ok, so it's been 23 hours since my last post and there's been no progress

The screen still shows "Preparing Log Report" etc...

What are your thoughts?


----------



## johnb35

i was wondering how it was going.  Do you see hard drive activity?  HDD activity light blinking?  See if you see a file called combofix.txt under your C drive or search for it. That file is the combofix log itself.


----------



## EGS

I hope you have McAfee Total Protection 2009, if you don't, then that's your problem. 

McAfee is the BEST


----------



## Respital

EGS said:


> I hope you have McAfee Total Protection 2009, if you don't, then that's your problem.
> 
> McAfee is the BEST



@ OP Please ignore the above post.

Continue with John's instructions of looking for ComboFix.txt which should be located it C:\ and posting the contents here.


----------



## ceewi1

ant_8u said:


> Ok, so it's been 23 hours since my last post and there's been no progress
> 
> The screen still shows "Preparing Log Report" etc...
> 
> What are your thoughts?


If it hasn't completed after 23 hours, it isn't going to.  Reboot the computer and post an update (and C:\ComboFix.txt if it exists)


----------



## ant_8u

No further progress since last post
No HDD activity or blinking lights

Just did Ctrl Alt Del though and it shows Find3M application is running
Performance shows CPU at 1%

Restarted in safe mode and CPU is now showing 99% at "System Idel Process SYSTEM"

In my hard drive is a folder named "1Combo-Fix"
(I downloaded all three links you gave me previously and remaned them as Combo-Fix with either a 1,2, 0r 3 onfront of them just incase any of them didn't work - I ran number 1 as you've already guessed)

If I open folder "1Combo-Fix" and there are loads of files in there
One of the files is named ComboFix and is in notepad form
I opened this and believe this to be the log you are looking for?

How do I go about posting this on the forum? asit's an awful lot of info if I end up having to type it all up!

I reconnected my external drive but it still doesn't acknowledge a connection
Can I save the file to the CD I saved Combo-Fix to?
That way I can open it on this computer and copy the log onto the forum

How do I save the file to my CD, as my mouse is still disconnected?


----------



## ant_8u

Damn - figured out how to save it to the CD
But it says I do not have permission to save here and says I should contact the administrator

Does this just mean I can't save it to that particular disk?
But I could always use a new CD?


----------



## johnb35

ant_8u said:


> No further progress since last post
> No HDD activity or blinking lights
> 
> Just did Ctrl Alt Del though and it shows Find3M application is running
> Performance shows CPU at 1%
> 
> Restarted in safe mode and CPU is now showing 99% at "System Idel Process SYSTEM"
> 
> In my hard drive is a folder named "1Combo-Fix"
> (I downloaded all three links you gave me previously and remaned them as Combo-Fix with either a 1,2, 0r 3 onfront of them just incase any of them didn't work - I ran number 1 as you've already guessed)
> 
> If I open folder "1Combo-Fix" and there are loads of files in there
> One of the files is named ComboFix and is in notepad form
> I opened this and believe this to be the log you are looking for?
> 
> How do I go about posting this on the forum? asit's an awful lot of info if I end up having to type it all up!
> 
> I reconnected my external drive but it still doesn't acknowledge a connection
> Can I save the file to the CD I saved Combo-Fix to?
> That way I can open it on this computer and copy the log onto the forum
> 
> How do I save the file to my CD, as my mouse is still disconnected?



The file that says combofix in notepad form is the log we need.  All you do is open it and copy and paste that into a reply here.  Highlight all the test and right click the mouse, click on copy, come back to this thread and click on reply, in the reply box right click the mouse and click on paste and the log will appear. Then submit your reply along with any other information.


----------



## ant_8u

That's the bit I'm struggling with
I cannot access the internet on the contaminated Laptop, so i'm using a desktop to get onto the forum

I somehow need to transfer the log from the laptop to the desktop to enable me to copy the log onto the forum

The laptop doesn't acknowledge the external hard drive is connected so I was thinking I could copy the file onto a CD and transfer the log that way?


----------



## M0LD0V4N

Have you installed Malwarebytes? If you have then do this, If you have Malwarebytes shortcut on the desktop, Right-click it, Go to Properties and Click on Compatibility Tab and  Select "Run this program in Compatibility Mode for: " And then Select it to Windows 95. Click OK, and then try to start Malwarebytes. Goodluck.


----------



## ant_8u

A little progress, we're getting there!!

I have just restarted the Laptop in normal mode and all my desktop icons are now visable, as is the taskbar

The mouse is still disconnected and the computer freezes

Task Manager shows CPU at 99% on "System Idle Process SYSTEM"


----------



## ant_8u

Just learned how to "Roll back" the driver on the mouse
I restarted in safe mode and that's working again now

I then restarted in normal mode, mouse is still working

I cannot connect to hte internet and the laptop still doesn't recongnise the external drive


----------



## ant_8u

Have just gone into ....
Control panel
System
Hardware
Device Manager

And have seen some of the icons have a yellow exclamation mark next to them
Could this be why I cannot connect to the external drive or the internet?


----------



## johnb35

YES, one must be ethernet adapter or network adapter. The other driver could be usb or chipset driver.  What are the exact items that have the yellow exclamation point on them.


----------



## ant_8u

There's a few of them...

Batteries
Microsoft AC Adaptor
Microsoft ACPI - Compliant Control Method Battery

IDE ATA/ATAPI Controllers
Winbond Memory Stick Storage (MS) Device Controller

Modems
Agere Systems AC '97 Modem

Network Adaptors
Broadcom 440x 10/100 Integrated Controller
Direct Parallel
Intel (R) PRO?Wireless 2200BG Network Connection

Sound, Video and Games Controllers
Audio Codecs
Crystal WDM AC'97 Driver For ICH4
Legacy Audio Drivers
Legacy Video Capture Drivers
Media Control Drivers
Video Codecs

System Devices
Microsoft Update Devices

Universal Serial Bus Controllers
Intel (r) 82801DB/DBM USB 2.0 Enhanced Host Controller - 24CD
Intel (r) 82801DB/DBM USB Universal Host Controller - 24C2
Intel (r) 82801DB/DBM USB Universal Host Controller - 24C4
Intel (r) 82801DB/DBM USB Universal Host Controller - 24C7


----------



## johnb35

You have some major issues right now.  Try uninstalling each and every device that has the yellow exclamation point and then reboot to see if windows will reinstall the driver correctly. Do this by right click on the device and click on uninstall.  If you can't get this figured out, your best bet would be too back up any data you need and just do a fresh install.


----------



## ant_8u

They're all showing as "Code 39"


----------



## johnb35

You need to uninstall the drivers and reinstall them..  The driver is corrupt or missing.  In your case you need to back up any data you need saved and reformat.  If you don't feel comfortable doing that, then you need to take it in have someone do it for you.  Do you have a compute savvy friend to help you?


----------



## ant_8u

I've seen some Code 39 Software that claims to fix my issues
Have you heard of it?
Is it worth a go?


----------



## johnb35

I've never heard of it.


----------



## ant_8u

If you type Code 39 into google there's a few things that come up

I was thinking about running one of those
What do you think?

Oh - and should I run the Malwarebytes, or is that not required anymore?


----------



## ant_8u

Quick update - 
I tried running one of the Code 39 software repairs, but they just scann the computer then ask you to register and pay for the full thing

I didn't want to do that as i was still unsure it would even work

I mamaged to get Ccleaner and Malwarebytes on the laptop and ran both of those which seemed to help alot - I am conected to the internet and (almost) everything is right again

Regarding the drivers - at the moment I have no sound coming from the laptop
It says "No Audio Device" in Sounds and Audio Devices in the Control Panel
When I go into the Device Manager it only shows two drivers in the Sounds part, but it used to show more than this

I managed to get rid of nearly all the yellow exclamation marks by uninstalling them and then running the Drivers CD

The only exclamation mark I now have is Direct Parallel in the Network Adaptors

Any ideas how I fix the Audio and the Direct Parallel?

Thanks for al your help so far


----------



## ant_8u

I think I might have sorted the sound out - just uninstalled one of the options in the device manager

just need halp with the Direct Parallel now guys


----------



## johnb35

Direct parallel is when you are connecting 2 computers together using a cable.  Either remove the cable, uninstall that particular software, or reinstall the software.


----------

