I have old laptop Copaq NX9000, Windows XP and lincenced version of Avast AV (7.0.1426).
There is a lot of viruses and rootkits which Avast can’t remove (or even recognize), so I decided to ask You for help.
I think that some viruses, control the keyboard, and every 5 seconds runing StickyKeys (an accessibility feature to help computer users who have physical disabilities).
I am not skilled with computers, but my friend scaned the infected computer with GMER and there is a log file in attachment.
I think it is time to reload that system. However, here is our process called “Scrape” and is only a rough outline. We usually see what infections show up, and research these to see what they are, and how they work, and modify our procedure based on those findings. Good luck!
SCRAPE (use at your own risk, depending upon infection, some systems never work again!)
Disable system restore and page file (independently verify pagefile.sys is gone)
Disable system hibernation (independently verify hyberfil.sys is gone)
Run avast! Boot time Scan (Thorough) or avast! Rescue / Bart CD
Possible false positives can occur in Page file and Hibernation file, and is OK just to delete these. These false positives are normally due to remnants of virus / spyware definitions (DAT files) from programs such as Windows Defender, etc.
Run rkill.exe
If executable file type is disabled then
Download one of the available executable types from source
-Rkill.exe
-Rkill.com
-Rkill.scr
-eXplorer.exe
-iExplore.exe #all are the same program renamed to bypass executable file restrictions
End If
Run ComboFix.exe (XP and Vista and Seven 32-bit only) (look at files created on infection day! Many times this is the only way to find those pieces)
Run ATF Cleaner (Empty All)
Run CCleaner (Cleaner Only)
Run Malwarebytes (Full Scan)
Run SuperAntiSpyware (portable version)
Run HiJackThis (see’s things nothing else here does)
Run CCleaner if needed for booting with registry errors (Registry Only, repeat until clean)
Re-enable system restore and page file
May need to run a System File Checker
For XP open cmd (sfc /purgecache, sfc /scannow)
…may need to provide install CD
For Vista and 7 open cmd as admin (sfc /scannow)
…does not use install DVD
Follow the directions of obtaining an MBAM (Malwareybytes) log (make sure you update MBAM first) and the OTL logs (save them as ANSI), and aswMBR log. Post the logs as an attachment (Additional Options > Attach > Post).
One of our malware removal experts should be along to assist you further after you attach your logs to your next post. Thank you.
@ advantage77
HiJackThis is a total waste of time and far from “(see’s things nothing else here does)” it is blind to modern malware, it just doesn’t look in the places they hide now. Not to mention it hasn’t been updated in over two years.
Some of the other tools suggested, namely combofix, should only be run under supervision (of a qualified malware removal specialist) as incorrect removal of some modern malware can brick a system.