OT: Computer virus question

A friend dropped off a Dell laptop with a virus issue. It was that nasty one that wants to do a "virus scan" and charge you a bunch of money. I seemed to eliminate it but I got the laptop back and it won't run a browser. It connects to wireless at full speed and other programs like AVG and adaware will update. IE won't connect, I installed Chrome and that won't connect. I don't mind wiping the drive and starting over but everything else works fine and it's going to take a couple of hours to reinstall XP and drivers. I did restore to a couple of months ago with no difference. I'm stumped, If I can't get a clue, I'll wipe it tomorrow.

Reply to
Buerste
Loading thread data ...

Bummer!

Before you wipe the drive and start over, get a copy of Ubuntu linux. You can run this off a cd/dvd and see if you can connect using ubuntu/fireofx. You may have a hardware problem.

formatting link
If you want a dual boot system see their windows install
formatting link

Reply to
F. George McDuffee

Have you run System File Checker? It's at: windows/system32/sfc.exe

Also check the network configuration for missing or damaged files.

How did you remove the virus?

Reply to
Michael A. Terrell

"Michael A. Terrell" fired this volley in news:2NednQ8WpLyhwJXRnZ2dnUVZ snipped-for-privacy@earthlink.com:

Oh... just by deleting a couple of .dlls .

This is one of those times when a registry check (and fix) might be in order, too.

LLoyd

Reply to
Lloyd E. Sponenburgh

Don't wipe the drive, I had a similar problem and fixed it myself. Is it called antispyware-soft? Here is a website that tells how to remove it and programs of the same ilk.

formatting link
I followed the process given here and found that I got the best results with SUPERAntispyware.
formatting link
If the program comes back again after scanning it's because remnants of it are still on your computer. Download and install hijackthis which like SUPERAntispyware is a free program.
formatting link
Run a scan with this and it will create a log of programs that you have which may contain the virus. You will have to email the log to one of several panels of experts who will analyze the log and advise you what to delete. Thesev are listed in the website. Good luck, Engineman

=BDand that won't

nce. =EF=BF=BDI'm

Reply to
engineman

Have you ever used Revo Uninstaller to remove a stubborn program?

Reply to
Michael A. Terrell

AVG found 5 severe threats while running AdAware. AVG didn't find them on it's own scan, just from AdAware accessing the files. I always pull the drive and connect it to the desktop in the Bat Cave and try to disinfect it that way. I boot the desktop from a drive that is set-up just for this with just an OS and tools. This one's a bit different from the last batch of Russian baddies I've run into. Usually, the virus disables regedit, restore and the entire network connections. This one seemed too easy but after reinstalling the drive, I never tried IE. Oops!

Reply to
Buerste

Control Panel Internet options connection tab Lan Settings button

Make sure the proxy isn't checked. Virus will redirect all port 80 traffic, cleaners will remove the IP, but leave the box checked, shutting down connects.

Also, search for the utils winsockxpfix and dial a fix

they will restore base files and fix the registry

** mike **
Reply to
mike

Did you try a scan with malwarebytes? I used the free version to remove

1,090 infections from a computer a few months ago! Not my computer! :)

Steve R.

Reply to
Steve R.

Spybot-Search and Destroy is my personal malware filter. Works well and has regular updates And it will "immunize" your computer from most malware.

Gunner

Reply to
Gunner Asch

My usual mix of AVG or Avast, Adaware and Spybot S&D will get most of the baddies but lately a batch of Russian nasties gets by all of these and does so much damage it's usually faster to save critical documents, e-mails and favorites then just wipe the disk. After I build or wipe a drive, I make an image with Acronis and keep a DVD of the image on file. When the computer comes back to me, I just restore the image and copy over the docs and such.

Reply to
Buerste

Perhaps this is related. I just installed XP and Java updates after an AVG scan and then couldn't get IE7 to open the dialer. The two ISPs dialed properly from Network Connections, and having done that they now work in IE. I fiddled with other things as well but think those may be the cause and cure.

Before someone screams, I've had more grief from IE8 and Firefox 3.5 than from IE7.

I use the free Seagate Disk Wizard version of Acronis to back up C: before and after installing programs and updates. The Iomega Prestige

320GB portable USB drive on sale for $60 at RadShak has a Seagate drive in it which lets SDW run.

I used to keep C: trimmed enough to fit a backup onto one DVD but SDW v11 seems to reliably detect external USB drives. Some of my computers won't boot from them, so I make SDW boot CDs that work on every PC and save backups to 8GB flash or the portable drive. This works from a low end of PII, Win2000, USB1 up to 3GHz and Windows 7.

jsw

Reply to
Jim Wilkins

+1 on Malwarebytes. I used it to get rid of the nasty 'virus' that was on my niece's laptop. Sounds like the one Tom had was similar. (a popup that keeps insisting you have a virus and need to download a virus checker.)

Pete

Reply to
Pete Snell

Yeah, those pop-up critters can be the pits. I ran across malwarebytes.org that has a freebie scanner and SuperAntiSpyware, ditto. HiJackThis and SilentRunners also pick up some junk, if you know what's normally running, that is. Just finished sluicing out the video box with all 4, runs much better. Some of the infected stuff KNOWS what you're trying to run, you can rename both the malwarebytes and SuperAntiSpyware scanners to get them to run, sometimes you have to rename the install files just to install them, then rename the .exes, too. A lot of this stuff resides in the registry, just attaching the infected drive to another machine for a scan only picks up the current resident executables. If the stuff is in the boot block or in the registry, just deleting those files won't do it, they'll be back. There's a forum on

formatting link
that I've found useful, others are out there, just google. From that, sometimes you have to make three or four passes to kill an infection.

Just found a bad drive cable, which also contributes to the sloooows. System log has a lot of stuff that can be helpful.

Stan

Reply to
stans4

This site has specific instructions for the tricky stuff:

formatting link
jsw

Reply to
Jim Wilkins

I would never trust a virus infected system again. Pull the data off, not the executables.

Wipe using a bootable CD OS that can scrub the boot sector and partition tables.

Reinstall OS.

Install all patches to bring it current.

Wes

Reply to
Wes

I don't disagree, but may not have a choice.

I inherited several test stations at a new job. These were PCs running XP with locally built hardware attached and programs written by someone who had long since quit, without leaving instructions, a schematic, or a backup of the code. One had been left with no password and had been used by the employees to browse stuff they didn't want traceable to their own accounts. Understandably IT wouldn't touch it, they knew nothing about custom software for testing lithium batteries. The only way to save it was to disinfect it.

About the same time I bought a used student's PC to turn into an HDTV recorder. Since I needed to learn disinfection and XP administration I asked the owner not to wipe it. It was clogged to a standstill with toolbars, bogus antispy, adware etc but no serious viral infections.

Process Explorer and Hijackthis were the most useful tools to ferret out funny stuff, by comparing them to a known-good PC. AVG + Spybot S&D fixed almost everything, the procedures at PC Hell.com cleaned out the difficult ones. Some of the malware was tricky, it had the right name but was in the wrong folder for instance.

Once I had cleaned it I wiped the disk and reinstalled XP from a CD that Dell sent me. Microsoft gave me a product key after asking more questions than you have to answer to get a clearance. No, I haven't acquired any new foreign ancestors since the last time you asked.

After all that the 2.2 GHz P4 isn't quite fast enough to capture motion at 1080i, or show 720p full screen on the HDTV while recording. I just found a 3 GHz with W7U for $100 to play with on rainy days. Tomorrow I'll see if an Asus 4350 video card ($30) lets it display HDTV.

Here are some useful system analysis and management utilities:

formatting link
jsw

Reply to
Jim Wilkins

PolyTech Forum website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.