Help, I'm infected!!

Unknown

This computer will not let me run my TrendMicro virus software. I even tried uninstalling and reinstalling it with no luck. I cannot even access the TrendMicro home page or any other site offering virus scanning software. There does not seem to be a problem opening any other web pages, just those with virus software. I have run AdAware and Spybot. I cannot download HJT as by IE shuts down when I try to download it. I tried copying the HJT folder from another computer but winzip shuts down trying to unzip the file. I was finally access BitDefender's website and run a scan. (The results are posted below). PLEASE HELP!!

BitDefender Online Scanner



Scan report generated at: Thu, Dec 29, 2005 - 16:11:25





Scan path: C:\;D:\;E:\;







Statistics

Time
00:36:56

Files
299519

Folders
3218

Boot Sectors
4

Archives
3196

Packed Files
33469




Results

Identified Viruses
3

Infected Files
4

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
3




Engines Info

Virus Definitions
248852

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Documents and Settings\Jacquelyn Seaman\My Documents\My Shared Folder\kmd210_en.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 2)=>(ZIP Sfx s)=>cd_htm.dll
Detected with: Adware.CyDoor

C:\Documents and Settings\Jacquelyn Seaman\My Documents\My Shared Folder\kmd210_en.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 2)=>(ZIP Sfx s)=>cd_htm.dll
Disinfection failed

C:\Documents and Settings\Jacquelyn Seaman\My Documents\My Shared Folder\kmd210_en.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 2)=>(ZIP Sfx s)=>cd_htm.dll
Deleted

C:\Documents and Settings\Jacquelyn Seaman\My Documents\My Shared Folder\kmd210_en.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 2)=>(ZIP Sfx s)
Updated

C:\Documents and Settings\Jacquelyn Seaman\My Documents\My Shared Folder\kmd210_en.exe=>(CAB Sfx o)=>\Disk1\data2.cab=>(IShield Module 2)
Update failed

C:\WINDOWS\system32\drivers\etc\hosts.20051212-233141.backup
Infected with: Generic.Qhost

C:\WINDOWS\system32\drivers\etc\hosts.20051212-233141.backup
Disinfection failed

C:\WINDOWS\system32\drivers\etc\hosts.20051212-233141.backup
Deleted

C:\WINDOWS\system32\drivers\etc\hosts.20051229-151743.backup
Infected with: Generic.Qhost

C:\WINDOWS\system32\drivers\etc\hosts.20051229-151743.backup
Disinfection failed

C:\WINDOWS\system32\drivers\etc\hosts.20051229-151743.backup
Deleted

C:\WINDOWS\system32\knisdrnacl\smss.exe
Infected with: Backdoor.Landis.G

C:\WINDOWS\system32\knisdrnacl\smss.exe
Disinfection failed

C:\WINDOWS\system32\knisdrnacl\smss.exe
Delete failed

cman34

I have been trying to scan with virus scan programs suggested in other threads and still can only access the BitDefender website. Just so there is no confusion, this post is not related to another thread I started earlier today as the HJT log I posted there is from another computer.

cman34

Apparently my daughter got an MSN Messenger message entitled "Is this you" that she thought may have infected the computer. Can anyone help with this?

Crunchie

Download HijackThis self-extracting zip version from here. Once downloaded, double click on the file & it will install into it's own, permanent folder.
Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you the option of where to save it. Save it to desktop where it is easy to access. Open the log file and copy the entire contents of the file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is necessary for the running of your system.

cman34

I was able to download HJT and unzip it. However, I cannot run HJT. When attempting to run HJT it just shuts down my Windows Explorer screen and I am back to my desktop. Now I cannot even open the folder that contains the HJT executable file, again sent back to destop. Any suggestions?

Crunchie

Go to the hijackthis.exe file and attempt to rename it. If successful, try scanning again.
If that does not work, find another suitable location for the file and try running it from there .

cman34

No good. I could not rename or move the HJT file as I cannot even select it without getting kicked out of Windows Explorer. I downloaded HJT again to another location and renamed the executable and tried to run. Same thing happens, back to the desktop and I cannot even open the folder with the HJT executable to rename or try again.