certain web addresses seem to be blocked

to Bugbatter's question: 

I have everything that came with the PC - I am SO reluctant to restore the system, since it operates GREAT besides my internet surfing problem, and I have so many files I am currently working on backing up.  What do I need to do to do?  Since my PC is "outdated"  I have to pay for service calls, which would be a last resort since I am low on cash...

-Jessie

Hi Jessie, and welcome to the forum:

Please answer the following:

1) You say you uninstalled your anti-virus (Trend Micro). Have you been on the internet without an anti-virus? Do you now have a working AV program, or any other security programs (anti-spyware, firewall) installed? If you go into your Control Panel and click on the Security Center icon, what does it tell you?

2) Have you been able to get Windows Updates, either via Automatic Updates or the Microsoft or Windows Updates websites? Or does your system remain unpatched since you bought it?

3) Are you using your PC to post in this forum, or another computer?

Jessie, in addition to Joe's questions, do you have your XP CD's from Dell?

Please do not go out and buy protection software. Many times we can remove malware by using free specialized tools that the trained experts have access to. We can direct you to free security to use from then on if you prefer. Sometimes, yes, the only alternative is reinstalling the operating system. However, first, we will need to see exactly what is running around in there.  Posting diagnostic logs would be a big help. Without internet access in Normal Mode or Safe Mode, you will need a CD or USB stick so you can transfer logs to a computer with internet access.

There is a chance that you may need to attach some files once a helper gets into your fix. Currently that option is unavailable here and is being worked on. Just so you do not have to wait longer, I suggest posting a HijackThis log at SpywareHammer.There are instructions HERE for posting at SpywareHammer. The site has many Microsoft MVP's on staff and helpers there may be able to assist you sooner than we can here.

Additional forums that offer malware removal can be found at this link in the recommended sites section on the left side of this page: http://hjt-data.trendmicro.com/hjt/analyzethis/index.php

Please post at only ONE so you do not tie up two or more helpers working on the same issue.

Hi joe53 - Thanks for getting back to me! 

1.)  Trend was blocking ALL sites, so yes, I was finally able to uninstall it.  (Trend Micro support just told me to disable it, since I had no password recollection.)  I have NOTHING - I can't load any page that lets me protect my computer-ie:  Microsoft, AVG, Avast, etc.  My firewall is on, as well as updates, but I have NO virus protection.

2.)  Updates are "ON" - but my pc is blocked from any "healthy" sites, so I have not received any.  I moved around end of May 2007, so I haven't had any updates since then...

3.)  I am using the bum PC to post...  I know bad idea...

The problem started when I tried to reconnect to the internet this past year by tethering my cell phone.  My PC was wigging out requiring all these updates, and my cell service was too poor to update everything.  I was connected long enough to correct a few things - and, apparently, long enough to receive this malware, because I was stupid enough to go to Facebook on outdated antivirus.  :( 

-Jessie

I can understand your concerns. We try to avoid a Reformat/Reinstall of the OS, however, there is some very bad malware that actually breaks things beyond repair. If the malware is so bad that it cannot be thoroughly cleaned, the worst that can happen is that you Reformat/Reinstall Windows.

Yes, back up your documents, pictures, music. Some malware damages .exe files, so I do not suggest backing up those. Hopefully, you already have clean copies of your favorite and/or purchased programs.

SpywareHammer and those on Trend Micro's list provide help for free and will direct you to free tools.. No need to pay for service calls. The forums are manned by volunteers.

Bugbatter -

Tried to follow your links, and guess what?  They are blocked for me!  :emotion-7:  This is so frustrating all I can do is laugh - I will have to wait for my fiance to come home at who knows what time so he can hook his (ahem) older laptop to the 'net and I can continue my search for a solution from SpywareHammer or Trend's sources.  Any hints on how I can forward any programming or such from his PC to mine?  Thanks for attending my questions!

-Jessie

You will need the clean computer to access SpywareHammer and to transfer tools and logs. You can use a CD or USB flashdrive.

For example:

In order to run Malwarebytes Anti-Malware, using the clean computer, download and rename the program installer "mbam-setup.exe" file to something else like "lookinhere.exe".  Copy the installer file and the update file to your CD or flash drive.

Transfer the files to the infected computer.  (You would use the update link mentioned below to manually update.) Install the "lookinhere.exe" file, then run the update so that you will have the current definitions. After that, run a full system scan and select to have the program REMOVE whatever it finds.

  Please download Malwarebytes Anti-Malware and save it to the CD or USB flash drive.
alternate download link 2

• * NOTE: You must rename it before moving it to the infected computer.

After you have renamed it and transferred the program to the infected computer, double-click on lookinhere.exe to install the application.

• When the installation begins, follow the prompts and do not make any changes to default settings.
• Then click Finish.

• Manually download updates from here
  Update through MBAM's interface from a clean computer; copy the definitions (rules.ref) located in
  C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes'
  Anti-Malware from that system to your usb stick or CD and then copy it to the infected machine.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top.
• It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully.
• Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Transfer the log to the clean computer via CD or flashdrive so you can copy and paste the contents of that report into your reply at SpywareHammer and exit MBAM. You will also be asked to download and run HijackThis/other scanners (and most likely rename them using the same procedure).

Note:-- If MBAM encounters a file that is difficult to remove,
you may be asked to reboot your computer so it can proceed with the disinfection process.
Regardless if prompted to restart the computer or not, please do so immediately.
Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

-- MBAM may make changes to your registry as part of its disinfection routine.
If you're using other security programs that detect registry changes (like Spybot's Teatimer),
they may interfere with the fix or alert you after scanning with MBAM.
Please disable such programs until disinfection is complete or permit them to allow the changes.

**If you need to re-install MBAM but encounter issue in re-installing, try using the MBAM Cleanup Utility by downloading it from HERE

Bugbatter -

Thanks for your help - I was able to load Malwarebytes from my fiance's computer - but not the update link.  It found 15 issues, including a hijacker.  All were removed/quarantined successfully, but I am still blocked - I am being told I have a worm.  Any more suggestions - or do I have to purchase protection?

Thanks again! Jessie

No, you do not need to purchase anything.  If you want the infection cleaned properly, these things are never a one-shot deal.  One tool does not do everything. You did not mention the name of the "worm", but that isn't relevant right now because we would need to be able to see what MBAM removed, what is still remaining in there to cause you to be "blocked", and what vulnerabilities caused you to become infected to begin with.

I suggest that you post on a malware removal forum - either here or one of the others. We are short of help, so you will probably be helped sooner at one of the forums referred to below. Until you can get things working again so that you can post online with the infected machine, you will need to download the requested tools as you did with MBAM using the clean computer, renaming it, and transferring it, etc.

As mentioned in my earlier post, I suggest posting a HijackThis log at SpywareHammer.There are instructions HERE for posting at SpywareHammer. The site has many Microsoft MVP's on staff and helpers there may be able to assist you sooner than we can here.

Additional forums that offer malware removal can be found at this link in the recommended sites section on the left side of this page: http://hjt-data.trendmicro.com/hjt/analyzethis/index.php

You will need to be patient because all the forums are swamped with people waiting. Please post at only ONE so you do not tie up two or more helpers working on the same issue. Thank you for your patience and understanding.