Hello,
To try and fix your computer:
You used Safe Mode correctly. Try Last Known Good Configuration, just to see if it will work, though I doubt it will. If it does not:
- Insert your Windows Vista DVD.
- Boot into it (you may have to go into the one time boot menu or change your BIOS settings.
- Enter your language and keyboard layout and click Next.
- Then click Repair your Computer, followed by Command Prompt.
- Then type regedit.exe. This usually works. Hopefully you will have no problems.
- Choose File > Load Hive.
- Navigate to: C:\Windows\System32\Config then single click on Software and click Load or double click on Saftware.
- Follow Option 1 in the tutorial I referenced by Brink.
- Click File > Unload Hive or similar. This is vital, as unlike in Windows, if you don't unload the hive, your changes will not be saved.
In terms of cleaning your computer afterwards:
This virus, although nasty, is not too difficult to remove. Some varients are completely removed by Malwarebytes Anti-Malware. I will then have a look at your OTL log, (a HiJackThis log + much more). If anything nasty remains, I will give you a script. All you have to do is paste it into OTL and click Run Fix. Not too hard.
Just so you know what some viruses are like, some block all .exe, .com, .scr, .reg etc., they break Safe Mode. They break the internet and all anti-virus software etc. etc. You do not have one of these, so be thankful!
Unfortunately, that manual Malware Removal guide you printed is not of much help.
Please use all the programs in the Malware Removal link I gave you. In particular, the program that is going to help you best is Malwarebytes Anti-Malware. Here is what they all do:
TFC: Many Malware have files crutial for their operation in the Temp folders. When you manually clean the Temp folders, the Malware files will be locked or in use, and will not be deleted. TFC closes as many processes as possible, gets the handles on files in use, closes these handles, and removes the file. Sometimes, a delete on reboot is required, and this is done.
ERUNT: Will back up the registry so we have a registry that works if something goes wrong.
Malwarebytes Anti-Malware: Will clean most of the infection.
GMER: Will "root out" any rootkits. (Sorry for the bad pun!) NOTE: Rootkits have a lot of false positives, so DO NOT clean any infections GMER finds.
OTL: Will show me where the rest of the infection lies if there is still a problem. I will then write you a OTL script to remove this, and we will then re-run Malwarebytes Anti-Malware and get a new OTL log to see what has been achieved.
As I have said earlier, this is not too bad an infection, and the hardest bit will be getting into your User Accounts. Please run the scans in the same order as on the link I gave you, as that way I will see what needs to be removed, rather than what may/may not have been removed. Thanks!
Why your printed guide is not too helpful:
Malware is constantly changing. New varients appear. Therfore, that file list will be out of date. Also, files will not be listed. Malwarebytes Anti-Malware will do a far better job of removing these. Malware files are locked or in use, and so you need a good tool to remove them, Windows Explorer is not enough. When you get infected, malware often downloads other malware. It is very likely that you have Trojan.Banker, but that you also have several other pieces of malware. The guide will not cover these. So in conclusion, this guide will only serve as a starting step, and not a method of removal.
The reason why not to run ComboFix:
ComboFix is a very, very powerful and destructive tool. It is only for use when Malware blocks all other attempts to remove it. ComboFix assumes that if you are running it, then your computer is infected. Due to this, on almost every run, it will break something, be it the Internet, the clock, or something far more major. Therefore, I don't want to have to clean up this mess! Also, it is not really much better than OTL for small infections. I do not believe that we will need to use ComboFix, a last resort, on your computer. Sometimes ComboFix even stops your computer booting at all, even into Safe Mode, which is why it urges you to install the Recovery Console.
Good luck, and if you have any questions, just ask!
Richard
