Virus in Comp!! part 1

priyanka26

I'm running Windows 7. Though the computer runs just fine, without issuing any errors, i am sure i have a virus on it, for the following reasons

1. I am unable to open cmd - when i run it, it opens for 2 seconds and then just closes.
2. I am unable to open msconfig - same as above
3. i cannot install any antivirus - my 60 day trial of mcafee expired a few days ago, and i tried reinstalling avg. again when i open the setup, it runs for a min or so, and then just shuts down!!
4. I have been unsuccessful in opening windows in safe mode too. windows start up just hangs when i try.

need i say more?

I am getting a 25% CPU usage when nothing is running on my computer, and i think thts a bit too much.

Even though i can't see any visible changes in the performance of the system, i really want to get rid of the virus!!

Help me pls...

Tews

With what you describe, I would strongly recommend reinstalling the OS... you have too many issues going on here to ever trust your data with the current installation...

DirtRider

I have got around a similar problem by locating a virus using this ClamWin Portable | PortableApps.com - Portable software for USB drives

priyanka26

ok, thanks...i think thts exactly what i'll do. was just hoping there was another way. thanks a ton.

Petey7

Lets see what we can do. What happens when you try to open task manager (ctrl+shift+esc)? Have you tried MalwareBytes? Have you tried to do a system restore to a time before the symptoms became apparent? Do you have a restore disc or partition?

priyanka26

I dont have an antivirus at the moment

DirtRider

�� Quote: Originally Posted by priyanka26

I dont have an antivirus at the moment

Well you have nothing to lose by trying this then do you

�� Quote: Originally Posted by DirtRider

I have got around a similar problem by locating a virus using this ClamWin Portable | PortableApps.com - Portable software for USB drives

richc46

You can get a great free one From MS

Microsoft Secuirity Essentials.

Using that and Malwarebytes with the Windows Firewall you will have full protection.
Dont make the same mistake twice.

priyanka26

�� Quote: Originally Posted by Petey7

Lets see what we can do. What happens when you try to open task manager (ctrl+shift+esc)? Have you tried MalwareBytes? Have you tried to do a system restore to a time before the symptoms became apparent? Do you have a restore disc or partition?

I do not see anything unusual in the task manager... However, i am new to 7 and don't exactly what tasks should be running and what not.

I do have a restore disc.

pparks1

Just out of curiosity, where did the installation media come from that you loaded Windows 7 with? Is this a legit copy of the OS or some hacked version? Those hacked versions can sometimes come with some added "features" that cause all sorts of fun problems.

Petey7

Its unusual for someone to be able to open the task manager with a virus on there computer. I would try a system restore and MalwareBytes. The idea here is that the system restore will temporarily disable the virus, and then MalwareBytes will remove it. You can then copy all your important files and folders to some external media. I wouldn't try backing anything up with a virus on the computer, because the external drive or CD can become infected with the virus as well.

DirtRider

This will take about ten minutes to run and may just kill the virus. You don't need to install it just run it from your disk as is. Did I mention that I got around a similar problem using it ClamWin Portable | PortableApps.com - Portable software for USB drives

priyanka26

�� Quote: Originally Posted by pparks1

Just out of curiosity, where did the installation media come from that you loaded Windows 7 with? Is this a legit copy of the OS or some hacked version? Those hacked versions can sometimes come with some added "features" that cause all sorts of fun problems.

No, totally legit copy of the OS. recently bought this laptop from Dell, Preinstalled with Home Basic version

priyanka26

�� Quote: Originally Posted by DirtRider

This will take about ten minutes to run and may just kill the virus. You don't need to install it just run it from your disk as is. Did I mention that I got around a similar problem using it ClamWin Portable | PortableApps.com - Portable software for USB drives

yes, thank you. I am going to try that

Borg 386

Download and run MSE and Malwarebytes, do a FULL scan with both (this could take some time) and make sure you are not connected to the net while doing it.

One way to check is to see if you can go to the Microsoft site, Malwarebytes, or to Norton or McAfee. Some viruses will block your access to these sites or any other site that has software that can get rid of the virus. If you can go to other sites, but not any of those, there's a good possibility you have been infected.

If you can go to these sites, I would still run a full scan. I've encountered Viruses that lock you out of Process explorer, MSConfig and command. Getting access back involves editing your registry

You can also try the AVG Rescue disk. This disk is a boot disk that scans your PC at startup and runs a scan for viruses.

Quote:

The AVG Rescue CD is a standalone set of tools that can be started from CD or USB flash disk. It can be used to recover computers that are not able to boot or are infected in a way that will not allow normal operation. The whole CD or USB flash drive is a live CD with Linux operating system and AVG preinstalled on it.

Instructions on how to d/l and use it are at this site

AVG - AVG Rescue CD Guide

DirtRider

I think the big problem here is it will not allow him to install any AV apps

Petey7

Any did not say any. He said AVG. He has not reported on other software. Sometimes certain software can get through, when others won't and I still say doing a system restore will make things a lot easier. I've done it before in order to remove viruses such as these.

priyanka26

hey, i just saw realised another thing..

This virus won't let me see hidden folders/files!! aargh!

DirtRider

Ah yes true, well I will be interested to see if it is a virus and if what one

CarlTR6

�� Quote: Originally Posted by DirtRider

Ah yes true, well I will be interested to see if it is a virus and if what one

I wonder if he could do an online scan?

priyanka26

�� Quote: Originally Posted by Borg 386

Download and run MSE and Malwarebytes, do a FULL scan with both (this could take some time) and make sure you are not connected to the net while doing it.

One way to check is to see if you can go to the Microsoft site, Malwarebytes, or to Norton or McAfee. Some viruses will block your access to these sites or any other site that has software that can get rid of the virus. If you can go to other sites, but not any of those, there's a good possibility you have been infected.

If you can go to these sites, I would still run a full scan. I've encountered Viruses that lock you out of Process explorer, MSConfig and command. Getting access back involves editing your registry

You can also try the AVG Rescue disk. This disk is a boot disk that scans your PC at startup and runs a scan for viruses.

Quote:

The AVG Rescue CD is a standalone set of tools that can be started from CD or USB flash disk. It can be used to recover computers that are not able to boot or are infected in a way that will not allow normal operation. The whole CD or USB flash drive is a live CD with Linux operating system and AVG preinstalled on it.

Instructions on how to d/l and use it are at this site

AVG - AVG Rescue CD Guide

I can access these sites.. i am not being blocked or anything

priyanka26

�� Quote: Originally Posted by DirtRider

I think the big problem here is it will not allow him to install any AV apps

correction: her

Petey7

Sorry for the confusion miss.

Now can you tell me, yes or no, do you have system restore turned on?

DirtRider

�� Quote: Originally Posted by priyanka26

�� Quote: Originally Posted by DirtRider

I think the big problem here is it will not allow him to install any AV apps

correction: her

Oooops sorry

Borg 386

If you can access these sites, go to the Symantec site & run the free online scan

http://security.symantec.com/sscv6/h...&auth_status=0

All the instructions how to run it are there. The only caveat is you must be using IE

It will run independent of the system and hopefully will help

priyanka26

thanks @ all

I will try ur suggestions and report back

Borg 386

Once you run the Symantec scan (hopefully you can), it would be wise to d/l Microsoft Security Essentials and Malwarebytes, and then still do a full scan on the system.

Then get the AVG disk and run that at startup.

You can't be too paranoid when it comes to PC safety

http://www.microsoft.com/security_essentials/

Malwarebytes

"Just because you're not paranoid doesn't mean they're NOT out to get you"

1Bowtie

I think the problem is the McAfee free trial is still there even though the trial ran out. Sometimes those free trials are hard to remove, espesically McAfee. Try unistalling through add/remove prog's in control panel prog's / featurers, then go to Windows Explorer and make sure the folders are gone from prog files, disk cleanup, then see what happens and let us know

Borg 386

�� Quote: Originally Posted by 1Bowtie

I think the problem is the McAfee free trial is still there even though the trial ran out. Sometimes those free trials are hard to remove, espesically McAfee. Try unistalling through add/remove prog's in control panel prog's / featurers, then go to Windows Explorer and make sure the folders are gone from prog files, disk cleanup, then see what happens and let us know

Interesting thought - I just had a huge debacle with my McAfee which is out of the system now. The last "upgrade" (and I use the term loosely) they issued a few days ago hosed some of my system and the AV itself. Even sys restore couldn't bring it back and every time I signed onto the web, it froze the entire PC - repeatedly.

McAfee Update (8/9/10) causes win 7 Problems

When I went to post something in the help section on the McAfee site, there were numerous complaints about that and something that has been a problem since May.

I would suggest she use Revo Uninstaller to get out all the stuff. I know McAfee has their own uninstaller, but if they mess up their own software so bad, how can you trust their uninstaller?

CarlTR6

�� Quote: Originally Posted by 1Bowtie

I think the problem is the McAfee free trial is still there even though the trial ran out. Sometimes those free trials are hard to remove, espesically McAfee. Try unistalling through add/remove prog's in control panel prog's / featurers, then go to Windows Explorer and make sure the folders are gone from prog files, disk cleanup, then see what happens and let us know

To add to what 1Bowtie suggested, the best way to remove any anti-malware program is to use the manufacturer's removal tool > McAfee > Info > Tool

The uninstaller is pretty good. I have not seen any problems with it.

1Bowtie

�� Quote: Originally Posted by CarlTR6

�� Quote: Originally Posted by 1Bowtie

I think the problem is the McAfee free trial is still there even though the trial ran out. Sometimes those free trials are hard to remove, espesically McAfee. Try unistalling through add/remove prog's in control panel prog's / featurers, then go to Windows Explorer and make sure the folders are gone from prog files, disk cleanup, then see what happens and let us know

To add to what 1Bowtie suggested, the best way to remove any anti-malware program is to use the manufacturer's removal tool > McAfee > Info > Tool

The uninstaller is pretty good. I have not seen any problems with it.

Good point guys, i just wanted her to go at it the proper way, either add/remove prog's or the manufacturer's uninstall prior to useing any third party Revo uninstaller

Wishmaster

If there appears to something nasty & you have issues removing it or even getting something installed to attempt it, one other alternative:

Norton Power Eraser
Spyware Removal - Virus Removal | Norton Support

As A Last resort if all else fails.

Please note:

"Because the Norton Power Eraser uses aggressive methods to detect these threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully, and only after you have exhausted other options."

Borg 386

I just suggested Revo as it does a through job of cleaning out the leftover files.

Also, Revo launches the programs uninstaller 1st, allows that to run, then it goes looking for leftover parts.

But yeah, it might be better for her to use the tool if she doesn't feel comfy with Revo.

Hopefully she'll be able to run the Symantec online scan & fix whatever is wrong.

CarlTR6

I would have suggested Revo had I not known about and worked with the McAfee tool. Anti malware programs are extremely invasive and Windows removal does not get all of the pieces of these programs. The removal tools from the vendors are quite good.

DirtRider

I use Absolute Uninstaller - Uninstall your unwanted applications easily and completely but I have installed Revo and will give it a go

Borg 386

Revo is good at finding the leftover registry keys, as well as files left on the HD.

But you do have to read the directions carefully.

The nice thing about Revo also is that if it can't delete a certain leftover file, as you see sometimes ("The following files could not be removed"), it'll mark them for deletion at the next start up.

I've been amazed at what most programs will leave behind in your system.

(The excuse for that from most of companies is they want to leave the information there in case you decide to "reinstall the software")

Based on my past experience with McAfee CarlTR6, I don't really trust anything from them. It was freakin incredible what that one upgrade to the security center did to my PC. How bad do you have to mess up software that a sys restore of even 2 days back won't fix the problem & leaves the AV damaged to the point that only 2/3 of the screen was showing when I tried to launch it?

ALSO - Thanx much for the link Wishmaster, a nice scanner. Quick and efficient.

DirtRider

Funny when I used McAfee some time back I was very happy but then I found it started to fall behind so I changed

CarlTR6

I have never liked McAfee and I have used it.

@Borg: Anti-malware programs entangle so deeply into your system that only the manufacturer really knows how to get it all out. And if you don't get it out, sometimes the bits and pieces can still create problems.

DirtRider

�� Quote: Originally Posted by priyanka26

I'm running Windows 7. Though the computer runs just fine, without issuing any errors, i am sure i have a virus on it, for the following reasons

So have you managed to sort this out then

Borg 386

@ CarlTR6, Like I said, I wouldn't trust McAfee with anything. I've run a scan through my registry and files and found nothing related to McAfee...so far.

One interesting thing I have found since I started using Revo uninstaller - it's usually the open source software that does a complete removal of everything (files, reg keys, etc.), whereas anything corporate tends to leave reg keys and whatnot in the system. At least the open source programs I've seen

@ DirtRider, maybe it was good at one point, but it's sure a mess now.

I left a note on her page DirtRider asking if she fixed it or not

1Bowtie

�� Quote: Originally Posted by Borg 386

@ CarlTR6, Like I said, I wouldn't trust McAfee with anything. I've run a scan through my registry and files and found nothing related to McAfee...so far.

One interesting thing I have found since I started using Revo uninstaller - it's usually the open source software that does a complete removal of everything (files, reg keys, etc.), whereas anything corporate tends to leave reg keys and whatnot in the system. At least the open source programs I've seen

@ DirtRider, maybe it was good at one point, but it's sure a mess now.

Hi Borg 386

I'm not against Revo uninstaller, but i have found in the past if you will use the add/remove or the manufacturer uninstaller first it will just remove that specific prog, also especially McAfee and probably some others that offer trial prog's want to keep you as a paying customer so they don't make it easy to remove their prog, then you have to use any means possible.

Borg 386

Hey 1Bowtie,

Yeah, you're right on that, they don't want you to take it out and they try to get you to keep it. That's the norm for most programs ("Are you sure you want to uninstall this program", "Are you absotively posolutely double dog sure you want to remove this software?????" yadda yadda).

One thing that made me laugh, when I was trying to reinstall McAfee, it detected MSE and gave me 3 warnings about it, telling me it was "unstable", "untested" and said I was putting myself at high risk by leaving it in the system....riiiight.

I didn't think you were against it. In actuality for the average user it's probably best to use the uninstaller since with Revo, you can possibly hose the system if you delete the wrong thing. It's just kind of bugged me how much stuff uninstallers sometimes leave in. Why can't companies write their uninstaller to actually uninstall everything instead of leaving pieces of it everywhere?

It's like when Adobe had the updates to it's Flash player....the uninstaller did not remove the old version of the player, it just left it in the file and added the new version. I didn't know that until Securina told me there were 2 unsafe versions left in the files. What the hell?

A few years back when I had 98SE (in 2000 I believe), I was doing a registry edit and spotted a key from a game that I had deleted a year and 1/2 ago & I was thinking WTF? That's when I did a search and found 6 or 7 other keys from other things I had deleted.

And back then I had to walk 10 miles to the library to use a computer....through 3 feet of snow...uphill...both ways....we didn't have no Revo or the dang Flash Drives....we had floppies.....and we had 14.4 modems, and we liked it damn it....

Wishmaster

�� Quote: Originally Posted by Borg 386

ALSO - Thanx much for the link Wishmaster, a nice scanner. Quick and efficient.

NP. Just keep in mind the warning. It can be dangerous and is meant as a last resort if everything else failed.

Personally, if it comes to the point that tool is needed, I think probably best to restore a system Image.
But this sadly isn't always a option for everyone.

Borg 386

Quote:

Personally, if it comes to the point that tool is needed, I think probably best to restore a system Image.But this sadly isn't always a option for everyone.

Yepperz....sometimes you just have to start from scratch....unfortunately

1Bowtie

�� Quote: Originally Posted by Wishmaster

�� Quote: Originally Posted by Borg 386

ALSO - Thanx much for the link Wishmaster, a nice scanner. Quick and efficient.

NP. Just keep in mind the warning. It can be dangerous and is meant as a last resort if everything else failed.

Personally, if it comes to the point that tool is needed, I think probably best to restore a system Image.
But this sadly isn't always a option for everyone.

Wishmaster and Borg 100% correct when you play with computers sooner or later you might as well clean install, which makes all well with the world again

Borg 386

So...has anyone heard if she got it fixed or not?

Fahim mushtaq

Guyzzz!
This is due to trojan Virusss

.pif
autorun
etc