Spyware, Viruses, & Security forum

General discussion

Computer Hijacked

by rubrami281 / January 24, 2009 7:57 AM PST

A friend of mine was the recent victim of computer hijackers. He has an IBM desktop pc running Windows XP Pro. He was infected with a virus that changed the language to every program on his PC with encryped symbols: o's, x's, lines, <>.'?00)0ooXxx........that sort of thing. He can surf the web because the IE icon is on his desktop, he can click and open programs from the desktop icons, but the encrypted language won't allow him to go any further. Any ideas on how he can rid himself of this nightmare? Please help. Any and all consideration will be appreciated. Thanking you in advance for your time and concern.

Discussion is locked
You are posting a reply to: Computer Hijacked
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Computer Hijacked
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Just a thought......
by Marianna Schmudlach / January 24, 2009 11:33 AM PST
In reply to: Computer Hijacked
Collapse -
Computer Hijac ked!
by rubrami281 / January 24, 2009 9:18 PM PST
In reply to: Just a thought......

No, he doesn't know the exact name of the virus, but here's the BIG problem. He can download STINGER, and he can run Malwarebytes already on his PC, but he won't be able to follow any of the instructions because they're in crypted symbols. In other words, he can double click on the icon to run the software, but the promts are all symbols. Example: When he clicks Start,in the view window everything listed is in symbols and/or letters(limited to x's and o's and ///<<.}+>>). I can download housecall and stinger for him and transfer it to his pc via flash drive..........What next? Thank you in advance for your time!!!!

Collapse -
Housecall is an on-line scan.....
by Marianna Schmudlach / January 25, 2009 12:54 AM PST
In reply to: Computer Hijac ked!

is he able to run it?

Collapse -
Could it be.......
by Marianna Schmudlach / January 25, 2009 1:54 AM PST
In reply to: Computer Hijac ked!
Collapse -
Computer Hijacked
by rubrami281 / January 25, 2009 12:30 PM PST
In reply to: Could it be.......

I've downloaded the Testdisk. I'll be installing it on my friends PC tomorrow. I'll let you know how far I've gotten. Thanks again!!!!!!!!!

Collapse -
(NT) O.k. :)
by Marianna Schmudlach / January 25, 2009 2:11 PM PST
In reply to: Computer Hijacked
Collapse -
Computer Hijacked
by rubrami281 / January 26, 2009 12:12 AM PST
In reply to: O.k. :)

I've tried to run Photorec, but I've run into a wall. Following the instructions on Viruslist.com, I'm stuck on #9. PhotoRec tells me it "has been unable to create new File. This problem may be due to antivirus blocking write access while scanning files. If possible, temporary disable your antivirus live protection." However, I did disable antivirus, but to no avail. PhotoRec keeps repeating the same thing...........What next???????

Collapse -
Are you able to scan in SAFEMODE ?
by Marianna Schmudlach / January 26, 2009 12:27 AM PST
In reply to: Computer Hijacked

If Windows XP is the only operating system installed on your computer, booting into Safe Mode with these instructions.

* If the computer is running, shut down Windows, and then turn off the power
* Wait 30 seconds, and then turn the computer on.
* Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
* Ensure that the Safe mode option is selected.
* Press Enter. The computer then begins to start in Safe mode.
* When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

To use the System Configuration Utility method

* Close all open programs.
* Click Start, Run and type MSCONFIG in the box and click OK
* The System Configuration Utility appears, On the BOOT.INI tab, Check the "/SAFEBOOT" option, and then click OK and Restart your computer when prompted.
* The computer restarts in Safe mode.
* Perform the troubleshooting steps for which you are using Safe Mode.
When you are finished with troubleshooting in Safe mode, open MSCONFIG again, on the BOOT.INI tab, uncheck "/SAFEBOOT" and click OK to restart your computer

http://www.pchell.com/support/safemode.shtml

Collapse -
computer hijacked
by rubrami281 / January 26, 2009 3:16 AM PST

Iran a scan with Malwarebytes, nothing malicious detected. I also ran a scan with TrendMicro........nothing. All files came up clean. What next!

Collapse -
Well........ I am almost running out of ideas......
by Marianna Schmudlach / January 26, 2009 3:23 AM PST
In reply to: computer hijacked

Maybe it's time to download HJT:

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

It is important that you run HijackThis.exe in its own folder so the backup files that HijackThis creates will not be accidentally deleted.

Here's a list of reputable HJT forums:

Pls. post your log on ONE of the HJT forums:

http://www.bleepingcomputer.com/forums/forum22.html

http://www.geekstogo.com/forum/index.php?s=e39ad7e237ae123f43517316e44bf4bf&showforum=37

http://www.spywareinfoforum.com/index.php?s=5028cc67f4e5562d636b9a77c9017749&showforum=18

http://forum.gladiator-antivirus.com/


Maybe they can SEE in the HJT log IF there is "something wrong".

Good Luck !

Collapse -
Computer Hijacked
by rubrami281 / January 26, 2009 3:37 AM PST

Thank U so much, Marianna, 4 your time and support. It was greatly appreciated. U R A tru SuperWoman!!!!!!!

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

CNET FORUMS TOP DISCUSSION

Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?