[lolli_pop]

My anti-virus automatically deleted Internet Explorer when it could not disinfect it, which is ok as I have sorted that out (I THINK!)

But when I looked at the virus log, it also says there is a virus: W32/IRCBot-based!Maximus, which is infecting numerous files, of which I had no idea existed, such as XRBOT[1].EXE, L.EXE and VR.EXE. These files appear multiple times as being infected by the same virus.

These files can not be disinfected apparently and I have no idea what they are or what their function is so I have no idea of what to do about it!

Help please

[lolli_pop]

I downloaded Internet Explorer again and it's loading but only loads to the home page then flicks and doesn't change when I try to visit a different page.

I tried to restore it, but it won't restore, no matter which date I select.

Help would be appreciated!

[evilfantasy]

Do you have any antispyware programs?
Spybot
AVG Antispyware (not antivirus)
Ad-Aware

What Antivirus do you use?

Start the computer in safe mode and run the spyware programs.

Starting your computer in safe mode.
The first method that should be used if at all possible is below! Make sure you really try the F8 method first because it is less problematic. Using MSconfig (discussed later) can sometimes result in you getting stuck in safe mode. This may happen due to malware, or do to other problems with your OS!

1. Restart the computer.
2. When you see the black-and-white Starting Windows bar at the bottom of the screen, start tapping the F8 key.
3. When you get to the boot menu, use the arrow keys to select Safe mode or Safe Mode with Networking depending on the procedure you are following an also what your OS and PC configuration allow.
4. Then Press Enter.
5. The computer restarts in Safe mode. This can take several minutes.

If you cannot use the above Preferred Method you can use the below MSconfig method with Windows 98, Me, and XP (Windows 2000 users must use the F8 method - keep trying until you get it.

Msconfig method: Only use this method if F8 does not work.

1. Exit all programs
2. Click start > Run
3. In the Run dialog box type msconfig
4. Click OK
5. In the System Configuration Utility, on the BOOT.INI tab, check /safeboot
6. Click OK
7. When you are asked to restart the computer click OK
The computer will restart in safe mode.

To get back to normal mode
1. Click start > Run
2. In the Run dialog box type msconfig
3. Click OK
4. In the system configuration Utility, on the General tab, check Normal Startup
5. Click OK
6. When you are asked to restart the computer click OK
The computer will restart in normal mode.


If you can download HijackThis or transfer it to the infected computer and post a log it will be a big help.


Download HijackThis Here
Save HJTsetup.exe to your desktop.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\HijackThis.
Some new versions save to C:\Program Files\Trend Micro\HijackThis
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
DO NOT PUT HijackThis.exe ON THE DESKTOP OR IN A TEMP FOLDER.
This is important because it will create backups and they are easily lost if not installed correctly.

*Important*
Rename the Hijackthis.exe file to Analyze.exe. This is important because some new forms of malware can hide from HijackThis.exe. Right click the HijackThis.exe file in C:\Program Files\HijackThis and choose rename. Type in Analyze.exe and press the enter key.
Right click the Analyze.exe file and send to desktop to create a shortcut.

Next click on the "Do a system scan and save a log file button". It will scan and then a log will open in notepad.
Right click the notepad and click "select all" Right click again and select "copy"
Paste the log in your next reply.

DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Let me know how things are and if we need to try something else.

[lolli_pop]

Ok, thank you very much for your help.

I will download that prog. you said, and will get back to you tomorrow.

Thank you :)

[evilfantasy]

No problem.

[lolli_pop]

Hey. I'm sorry I've not got back to you. I've been very busy lately.

I am just about to run HiJack This. Do you just want me to post the stuff- to use technical jargon hehe- it comes up with on here?

[evilfantasy]

Yes, bit please read This Thread on how to add logs as an attachment.

[lolli_pop]

Ok, thank you. I have attached it

[evilfantasy]

Apologies. I did not explain to turn safe mode off after the spyware scans.

Please run HijackThis in normal boot mode and attach a new log.