Help lease, bad spyware problem

[Colisu]

Hello, I recently got hit by a massive spyware package like Ive never seen before. It took full control of my browser windows, hijacking my address bar redirecting links. I tried to go to this website and it redirected me to this fake program. Ended up costing me 59 dollars when I was tricked into paying for malwareRemovalbot. It disabled all virus protection, installation of those protections, as well as all antispyware programs. I was able to get around its blocking by changing the EXE file name for antimalware. I ran it and I took out a few trojans. I was able to restore my other antispyware programs to functioning.

However, I still cannot enable my windows security settings, I have no fire wall or anything right now, same with my virus scanner. All are overriden and disabled.

I have scanned again and agan and removed but I jsut cannot get rid of this thing.

I was hoping , praying even that I could get some help here. if not I fear that formatting is the only way.

I have a Hijack this log that Im gonna post here. I have run spybot S+D, Malware Antimalware, and windows defender. They have all find several bad files and registery entries.

I have never seen spyware behave like this. Thanks for your time and I hope and pray ya can help me. Hope this works.

hijackthis.txt

hijackthis.txt

[yardbird]

Hi and welcome to the forum, to get you fixed up, follow the instructions below

Scan and post logs - read note at bottom in green

If you're having Malware related issues with your computer that you're unable to resolve.

1. Please read and follow the instructions provided here: I'm infected - What do I do now?
2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
   
3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.
   

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review
  

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.
  

[mountaintree16]

Edit: Yardbird beat me to it Take a look at his instructions and read them completely. Basically you need to post your log in the hijack this forum, which he has also given you a link to.

To anyone else reading this, sorry to post back, didn't know that yardbird had already posted, probably did so while I was posting.

Hello there.

Sounds like you got hit with something particularly nasty.

Please go here: http://www.malwarebytes.org/forums/index.php?showforum=7

And post exactly what you posted here. Someone will be along to help you as soon as they can.

Thankfully you were at least able to run hijack this!

I am not sure if it will help or not, but please don't visit any websites other than this one on your machine and any websites that your helper directs you to are okay also, of course.

I cannot help you any further than this, but I just wanted to point you in the right direction.

Good luck!

[yardbird]

@ Colisu

both post are the same, we just posted at the same time.... follow the instructions on either post, instructions are the same

[mountaintree16]

@ Colisu

One more thing I meant to say to you that I forgot before:

Please, if you have not already, contact your bank or credit card company, whomever issued you the card that you used to purchase this fraudulent software. Contact them and tell them that you were the victim of some fraud and that you would like your card canceled (and issued a new one if you want/need it with a new number of course!). There's no telling where your information might have been transferred to.

Please, do this as soon as possible!

Did you use a credit card by the way?

And thank you for posting your log so quickly in the HJT forum.