Re: A teetering system!

From: Rock (rock_at_comcast.nospam.net)
Date: 09/26/04


Date: Sun, 26 Sep 2004 13:36:59 -0700

Gillyches wrote:

> Greetings everyone!
>
> Sometime in July I seemed to pick up a virus/trojan/nasty and because my
> Norton Antivirus program didn't seem to be able to deal with it (the computer
> closed down whenever the scan was about half way through) and neither could
> Spybot (same thing happened!) - I became desperate and after trawling around
> on the internet found Xoftspy and downloaded and bought it. The problem
> seemed to have cleared up!
>
> The other day I wanted to change my favourite 'home page' and when I tried
> to access the 'Internet Options' I got a message telling me of 'restrictions'
> and to contact my system operator! Well I AM the system operator so that had
> me flummoxed!
>
> I was given some advice to remove the Xoftspy program as it was probably too
> aggressive - and to use Adaware. I downloaded Adaware - but it came with a
> message about some corrupted files so that it could be installed. I removed
> the Xoftspy anyway and tried to scan - but again it all closed down and I had
> to 're-boot'.
>
> I then read in a magazine (in answer to a question about this guy's claim
> that he'd still got two unaccountable 'bad/virus' files after scanning) that
> maybe there was something locked up in System Restore so it would be a good
> idea to unlock the restore function and see if the viruses could be removed.
> So, against my better judgement, I removed the 'restore' function (thereby
> removing any chance of rolling the system back to a previous date! Duh!!!!!)
> and tried scanning with Spybot - again the whole lot turned off.
>
> Added to which, I now find that I have automatic updates that show the icon
> - but which continuously shows 0% downloaded even after 20 minutes!
>
> Is there any hope of:
> a) being able to sort out this awful situation myself - re some sort of
> 'alien' resident on my computer?
> b) getting back to a stable system that I CAN scan for viruses, use Spybot
> and generally feel confident that I'm not going to see the computer version
> of the sinking of the Titanic?

The icon in the notification area has nothing to do with the malware
issues. That's probably SP2 in the queue for downloading to your
system. It can take many days for it to arrive because it comes in bits
and pieces, or it can come all at once. However, do _NOT_ install SP2
until your system is clean and running perfectly. Otherwise it's a
recipe for disaster.

To clean your system boot into safe mode and run the spyware and virus
cleaners. First start with Trend Micro's Sysclean. Download the
program and signature files, turn off system restore, boot into safe
mode (when the computer reboots repeatedly tap the F8 key after the BIOS
screen is displayed in the very beginning), and when the menu comes up
choose safe mode. Run the scan. Also run Spybot S&D.

Note: All virus and spyware cleaning should be done from safe mode.
It's most effective that way.

After that reboot to normal mode, turn system restore back on, and run a
full virus scan. At that point try installing Adaware, and the other
cleaners I list below.

Trend Micro Sysclean
http://www.trendmicro.com/download/dcs.asp

Trend Micro Signature File
http://www.trendmicro.com/download/pattern.asp

Run these programs to check for spyware/malware. After installing
update them, then boot into safe mode and run them. You should update
and run them weekly.

Cwshredder
http://aumha.org/freeware/freeware.php#cwshred

Ad-aware SE
http://www.lavasoftusa.com

Spybot Search and Destroy
http://www.safer-networking.org

Bazooka Adware and Spyware Scanner
http://download.com.com/3000-2144-10247783.html

Pest Patrol Free Pest Scanner
http://www.pestscan.com/ScanOrTrial.asp

If you’re still having problems after running these then run HijackThis
and post the log to one of the specialty forums, _NOT_ this one.

HijackThis
http://www.majorgeeks.com/download.php?det=3155

Forums to Interpret HijackThis Logs:

http://www.spywareinfo.com/forums/
http://forum.aumha.org/viewforum.php?f=30
http://forums.tomcoyote.org/
http://www.wilderssecurity.com/

After your system is clean use these programs to help keep it clean:

Spywareblaster
www.javacoolsoftware.com/sbdownload.html

Spywareguard
http://www.javacoolsoftware.com/sgdownload.html

IE-SPYAD
http://www.staff.uiuc.edu/~ehowes/resource.htm

For viruses, run at least two of these online scans in addition to your
regular up to date AV program:

Online and Downloadable Virus Scanning:

Panda ActiveScan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Bit Defender Online Virus Scan:
http://www.bitdefender.com/scan/license.php

Symantec Online Virus and Security Scan:
http://security.symantec.com/ssc/home.asp

TrendMicro:
http://housecall.trendmicro.com/housecall/start_corp.asp

McAfee Online Virus Scan:
http://www.mcafee.com/myapps/mfs/default.asp

RAV AntiVirus - Scan Online
http://www.ravantivirus.com/scan/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml



Relevant Pages

  • Re: Windows XP using 100% CPU without any applications running
    ... > programs or applications with the task manager, ... Bazooka Adware and Spyware Scanner ... Online and Downloadable Virus Scanning: ... Symantec Online Virus and Security Scan: ...
    (microsoft.public.windowsxp.general)
  • Re: RUNDLL
    ... To boot into safe ... until you get a menu and one choice will be safe mode. ... Bazooka Adware and Spyware Scanner ... Symantec Online Virus and Security Scan: ...
    (microsoft.public.windowsxp.general)
  • Re: My computer just keeps crashing... all the time! Im going craz
    ... > internet files, turn off system restore, boot into safe mode and run ... Then turn system restore back on. ... > Symantec Online Virus and Security Scan: ... > PC Hell Spyware and Adware Removal Help ...
    (microsoft.public.windowsxp.general)
  • Re: Cant get onto computer - please help!
    ... Now I'm back to square one - how to get rid of the virus. ... > moderately good at repairing the damage that's been done. ... >> using Norton to search for the spyware. ... To summarise, how can I get my computer from working fine in safe mode, ...
    (microsoft.public.win2000.general)
  • Re: Unknown download
    ... Spybot found a bunch of stuff Ad-Aware ... All my virus scans still came up clean. ... >3) Do the following spyware removal: ... >Safe Mode, repeatedly tap the F8 key as your computer is ...
    (microsoft.public.security.virus)