Hi WALBEK,

You're right. this could be nearly impossible because of your dad's skill level and the fact that you are communicating from a distance. He may not understand what he should do and his explaining to you what is happening is going to be difficult for him.  He may have trouble sending a log to you to post here, and he's going to have a problem downloading and running tools that provide diagnostic logs It sounds as if he has some rogue malware. Did he happen to mention any messages contained in the popups? Probably the best we'll be able to do is to see if he can run Malwarebytes' Anti-Malware. Can he get online using Safemode with networking in order to download Malwarebytes?  If not, would it be possible for you to download it to a CD and send it to him?

Here are the instructions including how to download to a CD. Perhaps you can translate them into terms he will understand. If MBAM does not help, he may have to take the computer to a shop.

In order to run Malwarebytes Anti-Malware, using the clean computer, download and, rename the program installer "mbam-setup.exe" file to something else like "walbek.exe".  Copy the installer file and the update file to your CD or flash drive.

Transfer the files to the infected computer.  (You would use the update link mentioned below to manually update.) Install the "walbek.exe" file, then run the update so that you will have the current definitions. After that, run a full system scan and select to have the program REMOVE whatever it finds.

  Please download Malwarebytes Anti-Malware and save it to the CD or USB flash drive.
alternate download link 2

• * NOTE: You must rename it before moving it to the infected computer.

After you have renamed it and transferred the program to the infected computer, double-click on lookinhere.exe to install the application.

• When the installation begins, follow the prompts and do not make any changes to default settings.
• Then click Finish.

Manually download updates from here
Update through MBAM's interface from a clean computer; copy the definitions (rules.ref) located in
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes'
Anti-Malware from that system to your usb stick or CD and then copy it to the infected machine.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top.

It may take some time to complete so please be patient.

• When the scan is finished, a message box will say "The scan completed successfully.

Click 'Show Results' to display all objects found".

• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Transfer the log to the clean computer via CD or flashdrive so you can copy and paste the contents of that report along into your reply at DspywareHammer and exit MBAM.

Note:-- If MBAM encounters a file that is difficult to remove,
you may be asked to reboot your computer so it can proceed with the disinfection process.
Regardless if prompted to restart the computer or not, please do so immediately.
Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

-- MBAM may make changes to your registry as part of its disinfection routine.
If you're using other security programs that detect registry changes (like Spybot's Teatimer),
they may interfere with the fix or alert you after scanning with MBAM.
Please disable such programs until disinfection is complete or permit them to allow the changes.

**If you need to re-install MBAM but encounter issue in re-installing, try using the MBAM Cleanup Utility by downloading it from HERE

Let me know how that goes.

 

 

hi, Bugbatter

sorry for taking so long to respond.

wow, that's a lot to take in... i wish i had this info when i was working on my sister's pc. i would have loved to beat that malware head on instead of system restore. i feel in that case the malware won...

but anyway,  that, definately, would have been impossible for me to relay to him.

i don't know what's going on over at my father's place... he 'somehow' got microsoft security essensuals on his pc (he didn't DL it, i don't know) and apparently it got rid of his problem (for now)... and now that it's working, in his eyes, doesn't care to do anything else. i thought microsoft security essensuals came with a price but i see it's free. i hope it works for him, without any interaction from him. and i at least got him to put on the OS firewall, for some reason it wasn't on...

thanx for your help

P.S.  if there is something you'd recommend for the security of his pc that would be extemely simple to use, that doesn't ask for too much input from the user, i'd greatly appreciate it... how is microsoft S.E.? i see it has spyware, malware, virus protection, but i couldn't tell if it had firewall included..?

MSE is very good and simple to use -- assuming that he removed all remnants of any previous anti-virus programs. It uses the Windows Firewall.

I'd also suggest that he use Malwarebytes' Anti-Malware. The free version needs to be updated and run manually. The paid version updates automatically and offers realtime protection that works nicely alongside most anti-virus programs.

When my father was 80 I set up Mailwasher for him. You might want to do that next time you have access to the computer. (I wouldn't want him to try the installation and mess up his mailserver access. You would need to show him what to do) I think there is still a free version: http://download.cnet.com/MailWasher-Free/3000-2382_4-10192298.html

WOT would be a good idea as well. Web Of Trust , uses colored alerts to warn about risky websites warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Red for Warning = STOP
• Yellow for Use Caution
• Green for Safe
• Grey for Unknown

There is a Web Of Trust version for Firefox as well.

You might consider installing SpywareBlaster as well: http://www.javacoolsoftware.com/spywareblaster.html
It will:
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox.
Restrict the actions of potentially unwanted sites in Internet Explorer.
Tutorial here:http://www.bleepingcomputer.com/forums/tutorial49.html
Periodically check for updates