system security :(

hi
i went onto a website and it mesed up my whole comp and got the system security virus
it changed my wallpaper with a warning sign and wouldnt let me open anything
i restarted my computer
and as it loaded i quikly presd ctrl alt del and saw the file with a lot of numbers and presed end process so i can get on the internet.
i downloaded malwarebytes but it wont let me open it up.
it says open with and gives a list of things to open with but none of them work
it dose the same for system restore
i phoned the local computer shop and they said they can fix it for £50
so i just wana see if i can do it anyway myself with a bit of help b4 i take it
can someboday please help out

Last edited by stokesy674 on 3rd August 2009, 3:03 pm; edited 1 time in total

Hello.
Please download Hijack This from here:
http://www.sendspace.com/pro/dl/932rpd

See if it will run.

nope it wont open
comes up with "open with ...." again

Please download Ice Sword from HERE

1. Download the zip to your desktop and extract it.
   
2. Open the Ice Sword folder and then launch IceSword.exe.
   
3. Then look in the left hand bottom of the program and press "Registry"
   
4. When the registry list opens, drag the line between the two windows so you can see which registry hive you need.
   
5. Next, open the HKEY_LOCAL_MACHINE, and navigate to the following key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
   
6. Now look in the right side pane for two run values that are just random numbers.
   
7. Once you have found the value(s), right click it and press "Delete"
   
8. Okay the prompt and close IceSword.
   

when i download icesword i go to extract it and it says application not found.
i cant find anything that will work

Did you download the zip file to your Desktop?
Is your OS able to open zip files as folders?

yeah i downloaded it to desktop.
and nope used winrar to unzip it first

Oh, okay.
Right click THIS LINK and click "Save link as..." or "save target as..." to save the reg file to your Desktop.

Double click the reg file and select yes to the registrt merge prompt.
Can you run Hijack This now?

it saves as a notepad file to my desktop and when i double click it it opens up with a load of text and no prompts come up where i can press yes.
sory bowt this i dont really no too much about comps lol

Does it save as exefix.reg.txt? or is it the reg file opens in Notepad rather than regedit.

yeah it saves as exefix.reg.txt an its opening in notepad

Ah, okay then.
Right click the file > Rename.

Remove ".txt" so it should now be called exefix.reg, then try running it again.

ohh no no im sorry it didnt say .txt in first place...i was reading ur comment and got it stuck in my head and wrote it for sum reason.
its just saved as exefix.reg
this has seriously mesed up my comp.its starting to play random adverts thru the speakers :S
my bad sorry bowt that

We are going to have to work in safe mode:

Please do the following in Safe Mode with Networking: as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to "Safe Mode with Networking" and press your Enter key.

Note: With some computers if you press and hold a key as the computer is booting you will get a stuck key message. If this occurs, instead of pressing and holding the "F8 key", tap the "F8 key" continuously until you get the startup menu.) Once in the start up menu, select "Safe Mode with Networking", then do the following instructions:

Download the GMER rootkit scan from here: GMER

1. Unzip it and start GMER.
   
2. Click the >>> tab and then click the Scan button.
   
3. Once done, click the Copy button.
   
4. This will copy the results to your clipboard.
   
5. Paste the results in your next reply.
   

Note:
If you're having problems with running GMER.exe, try it in safe mode. This tools works in safe mode.
You can also try renaming it since some malware blocks GMER.

okay i done exactly the above..went on to "safe mode with networking"
and when i clicked the GMER it just came up with the open with list again...
also when i ctrl alt and del wen i first loged on and canceld the long number so i could use the internet and stuff the system security no longer pops up when i logg on. and my wallpaper is no longer a warning sign..yet my comp is still slow and it wont open the files.

Does every file still come up with the "open with"? Did you apply the reg fix file?