Malwarebytes won't fully scan-Google redirect! Help!

[cheftracy40]

Please help me! Malwarebytes will not fully scan, it stops within 5 minutes of the scan and freezes! Google and Yahoo are also redirecting me to crazy websites too! Here is my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:48:48 PM, on 3/8/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec...amp;gc=1&q=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec...amp;gc=1&q=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirec...p;gc=1&q=%s

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/

R3 - URLSearchHook: Yahoo!

[AdvancedSetup]

STEP 01

Download

DDS

and save it to your desktop

http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click

dds.scr

to run the tool.

When done, the

DDS.txt

will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

1. DDS.txt
2. Attach.txt
   
   

• Save both reports to your desktop
• Please include the following logs in your next reply:
  DDS.txt
  and
  Attach.txt
  
  

STEP 02

Please create a BOOTLOG
• Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  
• Select "Enable Boot Logging" option and press enter.
  
• Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  
• This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
  If you're already running inside Windows you can enable it the following way.
  
• Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
  
• Click on OK and you will be prompted to RESTART Windows. Please do restart now.
  
• After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
  
• From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.
  
• Note: Vista users can type in the Search and it will show on the menu, then Right click and choose Run as Adminsitrator
  
• The tab is called BOOT on Vista. Then choose Boot log
  

[cheftracy40]

Ok, this is the same problem I have been having for the longest in reference to DDS...I download what I have to download and then all I see is a black screen flash and then its gone! Nothing else happens! Also when I save the file on my desktop, it only says dds, not dds.scr.

[AdvancedSetup]

That's because files are hidden by default.

Reconfigure Windows XP to show hidden files:

To enable the viewing of Hidden files follow these steps:

* Close all programs so that you are at your desktop.

* Double-click on the My Computer icon.

* Select the Tools menu and click Folder Options.

* After the new window appears select the View tab.

* Put a checkmark in the checkbox labeled Display the contents of system folders.

* Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

* Remove the checkmark from the checkbox labeled Hide file extensions for known file types.

* Remove the checkmark from the checkbox labeled Hide protected operating system files.

* Press the Apply button and then the OK button and exit My Computer.

* Now your computer is configured to show all hidden files.

Do you have P2P file sharing software installed on this system? If so please remove it until we're done.

Disconnect from the Internet and Disable your Anti-Virus and try running MBAM with a Quick Scan again and let me know what happens.

[cheftracy40]

First, thank you for your help!!

Second, the Malwarebytes scan lasted only 5 minutes, 11 seconds and froze. I do see the DDS.scr file on my desktop now, thanks. Should I continue with your original instructions with the DDS?

Thanks!

[AdvancedSetup]

Yes please run the DDS, and you did not answer my question about the P2P software.

There are some new worms going around that are causing issues for some users with P2P software.

There are also some other Security Tools on some systems with specific configurations that can seem to conflict with MBAM so I need more information to see what might be going on.

[cheftracy40]

Please excuse my ignorance, but how do I check for p2p share software?

[AdvancedSetup]

go ahead and post the DDS files and it will tell me.

Thanks

[cheftracy40]

Ya know..I'm really trying not to give up here! When I go to the desktop to double click on the DDS file, that flash of a black screen pops up and disappears again! Even if I right click on the file, the only choices are install, test and configure. What am I doing wrong? I hate to be a pest!!

[AdvancedSetup]

You're not being a pest. The Malware is probably blocking it from running or maybe even your own Anti-Virus software.

Let's try this software and see if you can get it to run. If it does not, then try renaming it or starting in SAFE MODE and running it if you have to.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Click
  Yes
  to allow ComboFix to continue scanning for malware.
  
  
• When the tool is finished, it will produce a report for you.
  
  
• Please post the
  C:\ComboFix.txt
  along with a
  new HijackThis log
  so we may continue cleaning the system.
  
  

[cheftracy40]

I seriously believe there is no hope for my laptop! That dang combofix will not work. It was saved on my desktop, recovery console downloaded, everything done according to the instructions. Every step is done, but it stops right after that dialogue box saying "combofix is preparing to run"...nothing after that and I waited for almost 3 hours for something to pop up. Am I at the point to where I need to restore my pc?

I appreciate your help!

[cheftracy40]

One thing I just realized: When DDS is downloaded, it says its saving to Screensaver...wth? I eventually was able to run the full scan from Malwarebytes.com and here is that log:

Malwarebytes' Anti-Malware 1.34

Database version: 1828

Windows 5.1.2600 Service Pack 2

3/9/2009 11:43:30 AM

mbam-log-2009-03-09 (11-43-30).txt

Scan type: Full Scan (C:\|)

Objects scanned: 525691

Time elapsed: 4 hour(s), 36 minute(s), 50 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Still not able to perform the DDS and the Combofix.

[AdvancedSetup]

Please download to your Desktop: Dr.Web CureIt

• After the file has downloaded, disable your current Anti-Virus and disconnect from the Internet
  
• Doubleclick the drweb-cureit.exe file, then click the Start button, then the OK button to perform an Express Scan.
  
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
  
• Once the short scan has finished, Click on the Complete scan radio button.
  
• Then click on the Settings menu on top, the select Change Settings or press the F9 key. You can also change the Language
  
• Choose the Scanning tab and I recomend leaving the Heuristic analysis enabled (this can lead to False Positives though)
  
• On the File types tab ensure you select All files
  
• Click on the Actions tab and set the following:
  
  • Objects Infected objects = Cure, Incurable objects = Move, Suspicious objects = Report
    
  • Infected packages Archive = Move, E-mails = Report, Containers = Move
    
  • Malware Adware = Move, Dialers = Move, Jokes = Move, Riskware = Move, Hacktools = Move
    
  • Do not change the Rename extension - default is: #??
    
  • Leave the default save path for Moved files here: %USERPROFILE%\DoctorWeb\Quarantine\
    
  • Leave prompt on Action checked
    

  [*]On the Log file tab leave the Log to file checked.

  [*]Leave the log file path alone: %USERPROFILE%\DoctorWeb\CureIt.log

  [*]Log mode = Append

  [*]Encoding = ANSI

  [*]Details Leave Names of file packers and Statistics checked.

  [*]Limit log file size = 2048 KB and leave the check mark on the Maximum log file size.

  [*]On the General tab leave the Scan Priority on High

  [*]Click the Apply button at the bottom, and then the OK button.

  [*]On the right side under the Dr Web Anti-Virus Logo you will see 3 little buttons. Click the left VCR style Start button.

  [*]In this mode it will scan Boot sectors of all disks, All removable media, and all local drives

  [*]The more files and folders you have the longer the scan will take. On large drives it can take hours to complete.

  [*]When the Cure option is selected, an additional context menu will open. Select the necessary action of the program, if the curing fails.

  [*]Click 'Yes to all' if it asks if you want to cure/move the files.

  [*]This will move it to the %USERPROFILE%\DoctorWeb\Quarantine\ folder if it can't be cured. (in this case we need samples)

  [*]After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list

  [*]Save the report to your Desktop. The report will be called DrWeb.csv

  [*]Close Dr.Web Cureit.

  [*]Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.

  [*]After reboot, post the contents of the log from Dr.Web you saved previously to your Desktop in your next reply with a new hijackthis log.

  

[cheftracy40]

Here are the results after 14 hours!

c.bat;C:\ComboFix;Probably BATCH.Virus;;

CANNK471.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAO5YD41.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAPC9FFN.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAPZ728K.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAQ30TUB.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CATLV28J.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAUTWL4I.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAVJ9DB8.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAWQ2M8A.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAX1SG6M.txt;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAXADUZ0.gif;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAXMX8SL.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAY5U7Y1.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAYBG9UJ.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAYDOBKJ.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

CAYMFCAA.htm;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

GlobalJSFunctionsDetail[1].js;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

GlobalJSFunctionsDetail[2].js;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

vp.ui[2].js;C:\Documents and Settings\Aarons\Local Settings\Temporary Internet Files\Content.IE5\YCPQF0EF;Probably SCRIPT.Virus;;

A0013019.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP175;Probably BATCH.Virus;;

A0013107.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP175;Probably BATCH.Virus;;

A0013171.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP175;Probably BATCH.Virus;;

A0013589.bat;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP179;Probably BATCH.Virus;;

Process.exe;C:\WINDOWS\system32;Tool.Prockill;Moved.;

NEW HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:41:08 AM, on 3/10/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Microsoft Office\Office\WINWORD.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec...amp;gc=1&q=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec...amp;gc=1&q=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirec...p;gc=1&q=%s

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/

R3 - URLSearchHook: Yahoo!

[cheftracy40]

Ok!! Just checked Google and no redirect! YEAH! But...now yahoo is doing it and a box pops up with DrWatson Debugger message!! UGGHH!

[AdvancedSetup]

STEP 01

Please disable Spybot TeaTimer - DO NOT proceed until you've disabled Tea Timer

Disable Teatimer

First step:

• Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  
• If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  
• If you have Version 1.4, Click on Exit Spybot S&D Resident
  

Second step, For Either Version :

• Open Spybot S&D
  
• Click Mode, choose Advanced Mode
  
• Go To the bottom of the Vertical Panel on the Left, Click Tools
  
• then, also in left panel, click Resident shows a red/white shield.
  
• If your firewall raises a question, say OK
  
• In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  
• OK any prompts.
  
• Use File, Exit to terminate Spybot
  
• Reboot your machine for the changes to take effect.
  

STEP 02

Download and install CCleaner
• CCleaner
  
• Double-click on the downloaded file "ccsetup217.exe" and install the application.
  
• Keep the default installation folder "C:\Program Files\CCleaner"
  
• Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
  
• Click finish when done and close ALL PROGRAMS
  
• Start the CCleaner program.
  
• Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  
• Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  
• Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  
• Click on Run Cleaner button on the bottom right side of the program.
  
• Click OK to any prompts
  

STEP 03

You may have corrupted files on your disk. Please try running the following.

First close ALL Applications as this routine will automatically restart your computer.

Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /F | SHUTDOWN /R /T 30

STEP 04

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

STEP 05

Delete your current copy of Combofix.exe and download a new fresh copy to your desktop and run that.

Make sure you disable any screen savers and Anti-Virus first. Post back the C:\Combofix.txt log file when done.

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

ComboFix.exe

[cheftracy40]

Hello...

I have posted the Java log below as requested. Combofix would still NOT download...maybe I have tried too many times.

JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Mar 11 13:58:52 2009

Found and removed: Software\JavaSoft\Java2D\1.5.0_12

Found and removed: SOFTWARE\Classes\JavaPlugin.142_03

------------------------------------

Finished reporting.

[cheftracy40]

I think the reason why combofix is not working on my computer is because I didn't realize how long it takes! I see the light flickering on and off which means its "doing" something. So, right now I'm just waiting, then if it goes thru, I'll post the log.

[cheftracy40]

Ok, didn't work. This is really crazy, I'm losing work. I really don't want to restore the pc and lose all my documents.

[AdvancedSetup]

Are you sure you disabled your Anti-Virus?

Please try this. Download and burn to CD from a friend or work computer if you need to.

Also you should make sure you have your documents and data backed up at all times, this is a best practice even if you didn't have these Malware issues. Hardware can fail out of the blue and then you'd really lose all your data.

Avira AntiVir Rescue System

Requires access to a working computer with a CD/DVD burner to create a bootable CD.

• Download the
  Avira AntiVir Rescue System
  from
  here
• Place a blank CD in your burner and double-click on the downloaded file.
  
  
• The program will automatically burn the CD for you.
  
  
• Place the burned CD into the affected computer and start the computer from this CD.
  
  
• On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
  
  
• Click on the
  Configuration
  button.
  
  
  • Select
    Scan all files
  • Select
    Try to repair infected files
    and
    Rename files, if they cannot be removed
    
    
  • Select
    Scan for dialers
    
    
  • Select
    Scan for joke programs (Jokes)
    
    
  • Select
    Scan for games
    
    
  • Select
    Scan for spyware (SPR)
    
    
  [*]
  Click on
  Virus scanner
  [*]
  Click on
  Start scanner
  at the bottom of the screen
  [*]
  Currently the program does not support saving a log. Write down the amount of items for Records, Suspect files, and Warnings

The Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore and is updated several times a day so that the most recent security updates are always available.

Screen resolution problems

Please see the post

here

if you're unable to view the entire screen of Avira.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.