Help!

I keep getting this pop up about XP Home Security 2012 trying to scan my computer saying I have a virus. I have tried everything to get rid of it and nothing seems to work. Can somebody help me please if you’ve ever had this. >:( ???

Read this guide to get you started>>http://forum.avast.com/index.php?topic=53253.0, then post the resulting logs back here.

Also see this tutorial, http://www.bleepingcomputer.com/virus-removal/remove-xp-home-security-2012.

Thanks guys… Seems like everything is back to normal again… For now anyway… Hopefully I won’t have anymore issues. ;D

You’re welcome.

What did you do to get it back to normal ?

If nothing, then I wouldn’t take the ‘seems like everything is back to normal again’ as an indication it has gone completely.

Well apparently nope… It was gone for a few days but just popped back up again! :frowning:

Have you tried running Rkill then Malwarebytes?

I suggest that you follow through with the instructions in the link to bleepingcomputer.com that I gave.

Some of these now come bundled with the new TDL bootkit, so if it disappeared and then came back again this may be the cause

If you wish assistance then just let me know

Mega and David yes I have tried that and it fixed for a day or two and now its back… I ran a boot scan and moved the virus to chest but now I cant turn on my web shield… Im on my phone typing this because I cant do anything on my computer… I pay money for this stuff not to happen and im getting extremely aggrivated at this point.

Hi there Lets try and fix this

Two programmes to run - the first an initial killer and the second an analysis one. After the first one your system should be sluggish but usable

Download RogueKiller to your desktop

[*]Quit all running programs
[*]For Vista/Seven, right click → run as administrator, for XP simply run RogueKiller.exe
[*]When prompted, type 2 and validate
[]The RKreport.txt shall be generated next to the executable.
[
]If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next Reply.

THEN

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U*.* /s
%Temp%\smtmp\1*.*
%Temp%\smtmp\2*.*
%Temp%\smtmp\3*.*
%Temp%\smtmp\4*.*
CREATERESTOREPOINT

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs

Essex I cant get on the internet to download anything because its saying my web shield service stopped. When I click fix now or turn on nothing happens.

OK can you get to safe mode with networking

Reboot the computer and press then hold F8
A menu will appear
Select safe mode with networking