is there a guide i can follow for virus removal? or do you have any advice?

Is Format C: an option

 

With the pc you are using right now to post here

 

i'm not formatting the drive

yes, with this computer it won't go to that site, it gives the same error as AV sites, either the site went down, or there's another network problem here or it's somewhere in that hosts file.

 

i can't do much because i get an error saying i'm not allowed to do it

and there are loads of popups and the browser keeps opening to here
://s3.truth-is-out-there.org/?name=6167656E746D6F6E2E657865

i haven't checked the ports i'm probably part of a bot network. i just finished downloading stuff so i'll run some stuff now.

i'll find a fix for whatever's blocking everything then install some scanners.

 

I can only hope for your Mum's friends sake as you attempt to wade thru the muck that they do not have anything important(personal finances and whatnot) on that drive considering as you say it might be "part of a bot network". If there is they do need to consider having it looked at by a qualified malware expert whether it be online or some off line shop.

Or format c:

 

no they just use it for the internet. anyway i fixed it already while watching the football :|

i'd go somewhere online to get it fixed, but i've seen the people who work in shops and they're useless.

i'm going to install some programs now and see if they find anything else.

 

Ultimate Cleaner 2007 is a rogue. Scan with Rogue Remover Free.

Better yet, post a hijackthis log here (if you can convince your Mom's friend to leave the laptop with you for a few days).

thanatos

 

i cleaned everything now. i joined that forum but it won't let me post in the hjt forum when i'm logged in. half the forum disappears when i login, then i can see it again when i log out. i can't see the point in that loool maybe it has a virus

maybe i'll post it here instead

 

Good for you .

Maybe it is because of your browser or NOD32. I am not sure .

Have you tried posting an hjt log in one of the forums listed here other than Gladiator Security just to be sure the PC is clean?

That is not a good idea .

thanatos

 

'ice60'... download a cpy of SUPERA (free edition) from your other PC. Then do a coldBoot while switching to "SafeMode" (at POST, flick F8 button fast for several times). From SafeMode, install & deploy that SUPERA** (superantispyware) for complete scan at dir:C.

SUPERA should catch or indicate what's wrong with your browser (it even got a 'repair' functions' tab within its main page!

That infected rig's browser settings may have been compromised... hence its weird behavior on 'forum logon'.


**Note:
SUPERA - Free has limited 'repair' functions thou. Hence i had suggested before in using SUPERA-Pro (trial cpy) to download & use for initial cleanup.

 

i gave it back now, i installed some scanners and it has SAS and antivir running all the time. and i took IE off the desktop and install firefox.

 

You should keep IE for Windows Update (And other things that might require IE.)