HELP! - One of the trickiest viruses ever...?

Dick · 10-05-2006, 04:10 PM

Here's the scoop: I re-formated my hard drive recently because things were becoming very sluggish. Since then, I have run into a very interesting situation. I got a call from my server saying they'd received complaints that I was uploading a virus into their computers... yet, I have only emailed a few persons and those were not the ones who complained, so my computer seems to be automatically doing this to people I don't even contact(!). Further, when I try to download (or even access) an anti-spyware or anti-virus program, upon Googling any name containing "Norton" or "Spybot" or "Anti-Virus" the Google screen immediately disappears. This virus WILL NOT LET ME DOWNLOAD A PROGRAM TO KILL IT... very insidious and clever. I do not know if purchasing Norton and trying to install it will even work. Any suggestions?

HELP!!!

Rommel_L · 10-05-2006, 04:56 PM

Have you tried using firefox instead of IE?
Do you have any antivirus/spyware programs installed right now?

- Try if you can download the following programs first: Firefox HiJackThis
- Install Firefox and try to download the following (using firefox): AVG Free antivirus, Spybot S&D, Ad-Aware, MS Defender, SpywareBlaster and Cool Web Shredder.
- Run HiJackThis and post the logfile here...

Jason Harbaugh · 10-05-2006, 04:56 PM

Have you looked it up on a different computer to find the way to kill it? It sounds like it is one of those that purposely tries to prevent you from getting rid of it, so that makes research on that pc kinda useless and I doubt it will even let you install the applications if you got them from another computer.

Have you figured out the name of it? You can do a ctrl/alt/del and look at your processes. If it is running, it should show up there. It might be masking as another process as well, so check for duplicates like two iexplorer.exe running.

Al.Anderson · 10-06-2006, 01:41 PM

My guess is the virus is in the Master Boot Record (MBR). If memory serves, you have to take an additional step when reformating a disk to also reformat the MBR. If you aren't in a hurry give that a try. Otherwise, go here: http://forums.spywareinfo.com/.

You should also download HijackThis on another computer and load it from a write protected CD/Floppy.

Rommel_L · 10-06-2006, 03:22 PM

Still waiting on the HiJackThis logfile...

**HTF Ads**

Kimmo Jaskari · 10-06-2006, 06:59 PM

Better yet, download the Ultimate Boot CD, fire it up, get the latest virus scanner upgrades to the scanner(s) it has and clean your PC from that CD.

Not the Ultimate Boot CD for Windows, since you have to add Windows files to it when you create it, you'd possibly wind up with an infected CD - but the Linux based ultimate boot cd in iso form should be burnable and not become infected.

You should probably have a software firewall downloaded onto a CD (get one from a friends computer that isn't infected) and then reinstall your OS again, while disconnected from the Internet! Then put in that firewall cd (zonealarm for instance) and install that BEFORE connecting to the Internet. That way direct attacks will be harder even though XP is vulnerable out of the box to all kinds of directed assaults.

Then go directly to Windows Update and download every security patch in sight before installing an anti-virus scanner...

Gregg Loewen · 10-08-2006, 07:36 AM

wow.
I guess Ive been lucky.
Good luck on finding a fix.
Gregg



Skin Chooser:	Contact Us - Advertising Information - Home Theater Forum - Archive - Top