Major computer problems

Hi there,

I am new to this so I really don't know what I am doing. Let me explain. I have windows 2000 and have been infected with the system security version 4.51 and cannot do anything. I have tried downloading and it always pops up that file is infected. I have tried to start computer in safe mode but it freezes and won't do anything. I took my computer to a shop and they said it would cost $100.00 just to look at it. I need to know if there is anything you can do. I work at home and need my computer. I have spent countless hours on this and really need some help. Can you help me?

Please download Ice Sword from HERE

1. Download the zip to your desktop and extract it.
   
2. Open the Ice Sword folder and then launch IceSword.exe.
   
3. Then look in the left hand bottom of the program and press "Registry"
   
4. When the registry list opens, drag the line between the two windows so you can see which registry hive you need.
   
5. Next, open the HKEY_LOCAL_MACHINE, and navigate to the following key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
   
6. Now look in the right side pane for two run values that are just random numbers.
   
7. Once you have found the value(s), right click it and press "Delete"
   
8. Okay the prompt and close IceSword.
   

I downloaded the icesword on zip and it was located on my desktop but when i clicked on this it would not let me open it. What else can I do?

Download Icesword from here, I unzipped it so you should only get the .exe file:

http://rapidshare.com/files/246323341/IceSword.exe

I still cannot open it. It still pops up that file is infected. I downloaded it and tried opening it from the desktop and it won't do anything. Is this hopeless? Do I need to take my computer somewhere? I am so discouraged and wonder if I will ever get this virus off of my computer.

See if you can run HijackThis:


Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.
  

I did this and you can see it for a second and then the security virus pops up. It says it is downloaded and it is showing on my desktop. I have tried to get my computer into safe mode and when I hit the f8 key it will go there and say it is in safe mode but it won't move anywhere else. It stays on the black screen. I did not give my credit card info to this security version 4.51. I don't know why I can't open anything but the internet. I cannot open mozilla firefox or mozilla thunderbird. I am only able to open up internet explorer. What do I do?

We need to do some things in safe mode:


Can you do the following in Safe Mode with Networking, (as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press your Enter key.

Note: With some computers if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the "F8 key", tap the "F8 key" continuously until you get the startup menu.) Once in the start up menu, select "Safe Mode with Networking", then do the following instructions:

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV. (Mcafee)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

I have tried to get the computer into safe mode networking. It won't let me. I have tried this several times. Is there another way to do this?

Hello.
Right click IceSword on your Desktop, select Rename.
Rename it to winlogon.exe, see if it will run now.

Ok I tried this and renamed it but when I tried to open it, it will click up briefly and then vanish. You said you wouldn't answer anymore so does that mean it is hopeless? I would love to make a donation if you all could help me.

Rename Hijackthis to flowers.exe and see if it runs.

I did rename it and it still blinks in front of me and I can see it for a second but it will not let me do ANYTHING. I am ready to throw this stupid thing away! It tells me all files are infected.

Rename the file again, but this time, rename it to winlogon.exe and see what happens.