XP Security 2011 - Something weird happened

[lunarcoyote]

Hi,

A few weeks ago, XP Security 2011 infected my computer, preventing me from accessing the Internet and .exe files, and opening one pop-up per minute telling me to send money to some scammers. I did all I could to erase this virus (using advice from this forum), but it just wouldn't go away.

At first, I tried rkill, disguised under different names, but it didn't work. Then I used exeHelper to actually be able to run rkill or install FileZilla. It failed, and XP Security 2011 kept popping up with each reboot (even on safe mode).

So I closed my computer. When I tried to boot it up a few hours later to try and save some files on an USB key, the computer just wouldn't boot at all, no matter how many times I tried; the screen froze into nothingness. Anyway, my PC is an old piece of trash, so I thought its lifespan ended or XP Security 2011, rkill, or something else crashed it for good.

And here I am, three weeks later, bored, with nothing to do, and with some files that still need to be saved. I boot up the computer, and it freezes like it used to. I re-boot it twice, and finally get it to start up.

To my amazement, XP Security 2011 is gone and I can run .exe files again. Could you please explain to me how is that possible and what measures I should take to make sure it's gone for good? Why did the virus just disappear after I let my computer alone for a few days?

I would appreciate your help very much. Thank you.

[LDTate]

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.

Click the Tools menu, and then click Folder Options.

Click the View tab.

Uncheck "Hide file extensions for known file types."

Under the "Hidden files" folder, select "Show hidden files and folders."

Uncheck "Hide protected operating system files."

Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.

When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:

Double-click on the Folder Options icon.

Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.

Click on Show Hidden Files or Folders.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

I've been seeing some Java infections lately.

Go here and follow the instructions to clear your Java Cache

http://www.java.com/en/download/help/plugin_cache.xml

Next:

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

[LDTate]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!