Ugh. Virus. Help?

katiemac · Jun 24, 2010

Last time I had a virus I used System Restore, and it worked (or at least I thought it did -- these viruses don't stay dormant somehow, do they?). Whatever's into my system now is blocking me from opening up System Restore, so that's not an option. Someone told me that if the virus was in the Applications folder of my Documents and Settings I could move the file, reboot the computer and then run the malware and Systems Restore stuff since the virus wouldn't load when the computer rebooted.

Sadly, I'm not seeing the virus folder when I open up Applications (assuming I'm in the right folder -- I did it via Windows Explorer.)

So, yeah--any other helpful suggestions? I realize "last time" is a good indication that I need better software, but this computer is on its last legs. I really need it to hold out for a few more months.

I have yet to reboot my computer since this hit me, about 20 minutes ago.

backslashbaby · Jun 24, 2010

My new favorite for being quick and effective:

http://www.greatis.com/security/download.htm

You don't even have to run it in Safe Mode in most cases; it has parts that run on boot-up.

Don't get too crazy in letting it delete things. Quarantine them at most if you are unsure.

Good luck!

I love troubleshooting viruses, so please give a holler if you need anything.

Deleted member 42 · Jun 24, 2010

It would help if we knew the specific virus/Trojan/malware at issue.

katiemac · Jun 24, 2010

Medievalist said:
It would help if we knew the specific virus/Trojan/malware at issue.

I'd love to be able to give you that information. How do I figure it out? I'm currently unable to run any kind of security software.

ETA: Possibly Win32/Nuqel.E?

ETA: Also getting something that says BankerFox.A

backslashbaby · Jun 24, 2010

Rename the application.

If it'll let you download the Greatis one, you should be fine without a rename. It's not a big known one.

Deleted member 42 · Jun 24, 2010

Katie can you tell us what makes you think you have a virus/malware problem?

Both of the things you named are real--but both are also used in false claims from fake software as well, the sort of thing that pops up and tell you that you've been infected and either sells you a fake removal program, or installs a Trojan.

katiemac · Jun 24, 2010

backslashbaby said:
Rename the application.

If it'll let you download the Greatis one, you should be fine without a rename. It's not a big known one.

Whatever the virus is, it recognizes the application. Can't run it. I also seem to be unable to rename it.

ETA: Never mind, it's renamed, but it still won't run.

backslashbaby · Jun 24, 2010

That sucks. Try it in Safe Mode, then. It might have blocked a bunch of your privaleges, but if it didn't Safe Mode should work.

If it did, there are other things to do...

katiemac · Jun 24, 2010

Medievalist said:
Katie can you tell us what makes you think you have a virus/malware problem?

Both of the things you named are real--but both are also used in false claims from fake software as well, the sort of thing that pops up and tell you that you've been infected and either sells you a fake removal program, or installs a Trojan.

Right, I got the names from the pop-ups that are telling me I have a Windows Security Alert or a virus--but they're fake. They want to redirect me to websites to purchase anti-virus.

So other than the persistent fake pop-ups, I can't open any security programs or systems restore, or Task Manager. I am getting rerouted every now and then to sites like adult.com or viagra. I've been afraid to click around too much more.

And although my wireless was up when this happened, I wasn't surfing. I was watching a DVD.

Deleted member 42 · Jun 24, 2010

Can you purge your Web browse cache?

katiemac · Jun 24, 2010

Medievalist said:
Can you purge your Web browse cache?

Yes.

Synovia · Jun 24, 2010

Sounds kind of like the Google Redirect

backslashbaby · Jun 24, 2010

Oftentimes, you'll have to use a fresh download of your anti-virus-anti-rootkit from a good PC on a USB stick. Usually, if you can run that in Safe Mode, you are fine (if it's a good program, btw).

I had a doozie a few weeks ago that took forever to clean up, though (I do Tech Support). There are some crazy-hard ones out there, unfortunately

katiemac · Jun 24, 2010

backslashbaby said:
Oftentimes, you'll have to use a fresh download of your anti-virus-anti-rootkit from a good PC on a USB stick. Usually, if you can run that in Safe Mode, you are fine (if it's a good program, btw).

I had a doozie a few weeks ago that took forever to clean up, though (I do Tech Support). There are some crazy-hard ones out there, unfortunately

Rebooting the computer is what really gutted my computer once post-virus. So the Safe Mode just kind of makes me nervous. Can I switch over somehow without shutting off the computer first?

backslashbaby · Jun 24, 2010

Ah, I got ya.

Hmmm... you probably want to run a really good app before you shut down, then. What OS are you using? We'll look at some of your privaleges and change them....

Actually, you might try a Kaspersky online scan first if it will let you. Let me know if it does. That's a good one.

And don't reboot until you get Regrun installed, so post back before that if there is any problem there (we'll do the privaleges).

backslashbaby · Jun 24, 2010

What's your email addy (PM me)? I'll rename an app for you and send it via email.

Deleted member 42 · Jun 24, 2010

Also:

How comfortable would you be with editing your Hosts file? Or deleting it and re-creating your ISP information?

DeleyanLee · Jun 24, 2010

katiemac said:
Right, I got the names from the pop-ups that are telling me I have a Windows Security Alert or a virus--but they're fake. They want to redirect me to websites to purchase anti-virus.

So other than the persistent fake pop-ups, I can't open any security programs or systems restore, or Task Manager. I am getting rerouted every now and then to sites like adult.com or viagra. I've been afraid to click around too much more.

Oh! This is the one I got on my work computer--twice.

The IT guys ran every malware and anti-virus in their arsenal on this machine. The ONLY thing that worked was completely reimagining the computer, both times.

What it is, I haven't a clue, but it was NASTY.

katiemac · Jun 24, 2010

Medievalist said:
Also:

How comfortable would you be with editing your Hosts file? Or deleting it and re-creating your ISP information?

Well, sadly, I don't know what a Hosts file is. Re-creating ISP information sounds not too scary, although I tend to like really step-by-step instructions.

katiemac · Jun 24, 2010

backslashbaby said:
What's your email addy (PM me)? I'll rename an app for you and send it via email.

Sent via rep. I'm on Windows XP.

backslashbaby · Jun 24, 2010

Cool. I'll check. Kaspersky looks offline, so try this one instead:

http://www.f-secure.com/en_US/security/security-lab/tools-and-services/online-scanner/index.html

katiemac · Jun 24, 2010

backslashbaby said:
Cool. I'll check. Kaspersky looks offline, so try this one instead:

http://www.f-secure.com/en_US/security/security-lab/tools-and-services/online-scanner/index.html

Can't do it. I don't have the right Java, and I can't run Java to install it.

backslashbaby · Jun 24, 2010

No problem. I'm sending you some via email that are probably better, anyway.

I agree with Medi on the hosts file, btw. Anything that could stop it from doing anything before reboot will help.

katiemac · Jun 24, 2010

Thanks for all the help, everyone. I realize I haven't said that yet. I've actually been out of work all day today because of a dental thing, was all ready veg out with DVDs and my painkillers and then ... computer meltdown.

So, thank you. Otherwise I'd be trying to muddle through this on my own, and that's not so fun.

Deleted member 42 · Jun 24, 2010

Here's a guide to the Hosts file. It's acts as a sort of list of domains on your computer, and sometime malware will alter it so that instead of going to site X it sends you to site Y.

http://www.bleepingcomputer.com/tutorials/tutorial51.html

It's also a way that some malware will keep re-infecting you after you remove the bad stuff.

Ugh. Virus. Help?

Five by Five

~~~~*~~~~

Deleted member 42

Five by Five

~~~~*~~~~

Deleted member 42

Five by Five

~~~~*~~~~

Five by Five

Deleted member 42

Five by Five

practical experience, FTW

~~~~*~~~~

Five by Five

~~~~*~~~~

~~~~*~~~~

Deleted member 42

Writing Anarchist

Five by Five

Five by Five

~~~~*~~~~

Five by Five

~~~~*~~~~

Five by Five

Deleted member 42

*

*

*

*

*

*

*

*