"Windows internet booster" virus?

[todddr]

My daughter's laptop had no AV on it, expired some time ago and I had no idea. Now she has this annoying issue with a popup saying that her computer is full of viruses, malware, etc.; it keeps cutting off internet connection, making it virtually impossible to even try and get online from her computer.
I'm guessing that this program which keeps popping up saying there's a virus, actually IS the virus. Says "Windows internet booster," and tries to force me to a page to enter my credit card number.
I did manage to get on the net long enough to download Norton on to the computer, but it seems unable to detect or remove the annoying program.
Any suggestions on how I can fix this, especially since at this point her computer seems incapable of connecting to the net...the pop-up keeps coming up and stopping the connection.

 

[johnb35]

Yes, thats the actual infection making you think you are infected big time. Please follow this guide carefully making sure you run one of the rkill files I mention first before running anything else. Just make sure you don't reboot the system between running rkill and running malwarebytes. Booting to safe mode will also help in running everything. You may have to download these files to a usb flash drive on a computer that isn't infected and then transfer them to the infected computer and run them.

Please download Malwarebytes' Anti-Malware from here or here and save it to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version. Please keep updating until it says you have the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• A log will be saved automatically which you can access by clicking on the Logs tab within Malwarebytes' Anti-Malware

If for some reason Malwarebytes will not install or run please download and run Rkill.scr, Rkill.exe, or Rkill.com. If you are still having issues running rkill then try downloading these renamed versions of the same program.

EXPLORER.EXE
IEXPLORE.EXE
USERINIT.EXE
WINLOGON.EXE

But DO NOT reboot the system and then try installing or running Malwarebytes. If Rkill (which is a black box) appears and then disappears right away or you get a message saying rkill is infected, keep trying to run rkill until it over powers the infection and temporarily kills it. Once a log appears on the screen, you can try running malwarebytes or downloading other programs.



Download the HijackThis installer from here.
Run the installer and choose Install, indicating that you accept the licence agreement. The installer will place a shortcut on your desktop and launch HijackThis.

Click Do a system scan and save a logfile

Most of what HijackThis lists will be harmless or even essential, don't fix anything yet.

When the hijackthis log appears in a notepad file, click on the edit menu, click select all, then click on the edit menu again and click on copy. Come back to your reply and right click on your mouse and click on paste.

Post the logfile that HijackThis produces along with the Malwarebytes Anti-Malware log

 

[todddr]

Thanks John...this evening I will give this a try and then post the results!

 

[todddr]

So after a little fight I managed to download Malwarebytes in safe mode; did have to also load Rkill as Malwarebytes would not run. Malwarebytes found like 1000 problems. Once removed, we can now get on the internet anyway without the "booster virus" popping up.
One odd thing...I do not seem to be able to copy the malwarebytes log to paste and post. Also, I had no luck getting the HijackThis results to copy.
If you have any suggestions on how to copy those to post, then I will try again.
However...one way or another...Thank You! My daughter is able to use her computer anyway, and I'm thrilled that I didn't have to haul the think to geek squad or something.

 

[johnb35]

To copy and paste the log from malwarebytes do this.

Open malwarebytes, click on the logs tab, highlight the log that has all the infections in it and click on open log. Then copy and paste everything into your next reply.

Are you running Vista or windows 7? If so, you must right click on the hijackthis icon and click on run as administrator. If the run as option doesn't appear then press and hold the shift key while right clicking on the hijackthis icon.

Please post the malwarebytes log and the hijackthis log in your next reply. Probably have some minor cleanup yet to do.