Subscribe to How-To Geek

Welcome to the How-To Geek Forums

We encourage you to register on our forums and post any questions you might have. The How-To Geeks monitor this forum and will respond to your question quickly.

How-To Geek Forums » Windows XP

Antivirus XP 2008 may still be lingering on my system.

(8 posts)
  • Started 1 year ago by Bruce-
  • Latest reply from BobJam
  • Topic Viewed 560 times

Bruce-
Posts: 7

Recently I attempted to manually get rid of that Antivirus XP 2008 virus or what ever it is. If I knew more about computers it would have been easier. That prompted me to go into the Startup and Services tabs in the System Configuration Utility, Google everything I did not know what was running and uncheck a lot of stuff.
I still have some problems that appear to have been created by that Antivirus XP 2008.
Problem 1) when running Internet Explorer I Google something, and click on that link, Internet Explorer it does not go anywhere or it takes me to some web site that does not pertain to what I wanted.
Problem 2) I get this blue screen when the computer has been idle for about ten minutes. The blue screen starts out with: A problem has been detected and Windows has been shut down to prevent damage to your computer.

The information the computer gives during the blue screen is never the same.

Then I see “restarting” in the bottom left of the screen.
Then it appears as if Windows is restarting. I see the Windows screen with the logo as I see it when Windows first starts booting up.

Then it goes back to that blue screen and starts over again. It will keep doing this till I hit any key on my keyboard. I’m not sure what the message means when it says restarting. Because it does not matter where it is in this loop when I hit a key it instantly goes back to where it was before without losing anything.
More information:
Seems something is preventing me from downloading but not all the time.
When I run Spybot-Search & Destroy ver. 1.4 and try and update the detection file I get this error message: “Error retrieving update info file. Socket error # 10061 connection refused”.
When I run Lavasoft’s Ad-Aware SE I get the error message “Error retrieving update” when I try to update the definitions file.
This Antivirus XP 2008 has attempted to load in to my system at least three times before and I keep having to disable it.
My antivirus program is: eTrust Antivirus Ver. 7.1.192, Latest update was 10-4-08, by Computer Associates. Is this program as good as some of the others out there? Why does it keep letting this thing in my system? When I have it scan my system why does in not remove it?
It seems like there is something still in my system preventing it from doing certain tasks.

Yes I have researched, downloaded, installed, scanned only to find out you have to buy the program in order to attempt to get rid of whatever this is. I don’t want to pay for a program not knowing if it will get rid of this thing. This is the method that Antivirus XP 2008 in using on people.

I’m running Windows XP Pro Ver 2002 SP3
AMD Athlon 64 3 ghz.
With 512 MB Ram.

Sorry this is so stinking long.
Bruce.

Posted 1 year ago #
Top
 
whs
whs
Posts: 10359

As far as I know, this Antivirus xp2008 is a trojan and a scam. There are some removal tools on the web that I myself have no experience with. But you can try SuperAntiSpyware http://www.superantispyware.com/

Posted 1 year ago #
Top
 
whiplash55
Posts: 80

I agree Superantispyware is an excellent new program and works pretty well. http://www.superantispyware.com/ Some other tips, boot into safe mode run SMitfraud fix available here
http://www.afterdawn.com/softw.....audfix.cfm
Then run CCleaner http://www.ccleaner.com/
Then run Superantispyware. This usually does it, there are tons of rougue/scam antivirus programs out there now. They're not to easy to get rid of, if you do get them. I'd be very careful online, don't trade files/music movies on Limewire, don't run as administrator unless you need to. Keep Windows patched and run AVG or Avast free antivirus programs.

Posted 1 year ago #
Top
 
whiplash55
Posts: 80

Once the Antivirus XP 2008 is off, try Dial a Fix,http://www.softpedia.com/progDownload/Dial-a-fix-Download-27328.html
This should repair any components of the OS which have been damaged in the cleanup.

Posted 1 year ago #
Top
 
raphoenix
raphoenix
Posts: 5223

GOOD ADVICE BY ALL.

I might add a real solution is to do what (whs) and I do.

Have a complete (CLEAN) Ghost Backup partition image file for the system on another HD off line.

It can takes days trying to disinfect a system and then not all will be right.

Just insure you make daily backups of your E-mail and other important documents so when you re-install the Ghost partition image, then you can get your current information back up to date quickly.

This is the fastest and easiest way to recover from an infection.
Takes at most (15) minutes or so and one is ready to move on.
Edit: Should check MS Updates after the re-install to insure machine is current.
Kindest Regards,
Rick P. ♥ :)

Posted 1 year ago #
Top
 
0zSpitt
0zSpitt
Posts: 1037

when i infected my notebook with this and tried to remove it, it kept regenerating itself after a restart. i ended up wiping the hard drive and reinstalling windows, but that was just my test computer. norton ghost or any back up program is worth the money and time.

Posted 1 year ago #
Top
 
raphoenix
raphoenix
Posts: 5223

@0z,

Yep; Wiping the HD or re-installing a CLEAN Ghost Image is the only REAL solution I've found with Antivirus XP 2008 malware. That one is a real "Bear".
No smiles on this serious post.
Kindest Regards,
Rick P. ♥

Posted 1 year ago #
Top
 
BobJam
BobJam
Posts: 880

Sounds like you have a severe infection. You likely need to run a HiJackThis scan and post the results in the security forums I've listed below.

To Download HijackThis go to the following link below:

http://www.trendsecure.com/por.....s/download

1. Click on the "Download" button at the top of the page, then click on the "Download HijackThis Installer" link that will appear . . . it's the very first one.

2. Save HJTInstall.exe to your desktop.

3. Doubleclick on the HJTInstall.exe icon on your desktop. You may get the "open file - security warning" window asking you if you want to run the file. If so, just click "Run".

4. Click "Install". By default it will install HJT to C:\Program Files\Trend Micro\HijackThis and create a HJT icon on your desktop and launch HJT.

5. Click on the "Do a system scan and save a log file" button. It will scan and then save the log to Notepad.

6. Close HJT by clicking on the "X".

7. At the top of the Notepad HJT log screen, hit Edit then Select All then click Edit and then click Copy (doing that copies the text to the clipboard, you won't see it yet....)

8. Go to any of the the Malware Removal forums listed below and Paste the log in a new thread. (To paste - if you use IE as your browser - just click on the "Edit" menu selection, and then "Paste" in the drop down menu)

DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required. WAIT until a security expert AT ONE OF THE SITES LISTED BELOW looks at your log and interprets it and posts a reply.

Aumha forum: http://forum.aumha.org/viewfor.....8c4c5ebcec

Bleeping Computer: http://www.bleepingcomputer.co.....rum22.html

Geeks to Go: http://www.geekstogo.com/forum.....e-f37.html

Major Geeks: http://forums.majorgeeks.com/forumdisplay.php?f=35

Malware removal: http://malwareremoval.com/foru.....b09dfbfc16

Spyware Info: http://www.spywareinfoforum.co.....owforum=18

Tech Support Guy: http://forums.techguy.org/54-m.....this-logs/

What the Tech (formerly Tom Coyote forum): http://forums.whatthetech.com/.....l_f27.html

Be sure to read all the sticky announcements/instructions at the top of each malware forum!

You will probably have to register to post.

Another option you can try is to run a SuperAntiSpyware scan. Sometimes this alone will find and remove malware. But even if it says it does, I'd still do the HJT scan AFTER SAS and post it on those security forums.

And if all this gets too tedious, the best thing to do may be to reformat and reinstall. And if you have a clean image, as whs and Rick have suggested, that is by far the easiest way to go. The only reason to go through the tedious removal steps on the security forums is if 1) You don't have backups of your data, and/or 2) You don't have a clean image ready to substitute.

If you're anxious to do a format and reinstall and don't want to wait for responses from the security folks on those forums where you pasted your HJT log, then go ahead. But FIRST, BEFORE you launch into this, save all your valuable data to removable media.

Follow these instructions here http://www.winsupersite.com/sh....._clean.asp exactly. Pay particular attention to Step 6 in the preinstallation checklist, because that stresses the importance of backing up your data files BEFORE you do this.

Scroll a little bit down the page and you'll see the step-by-step instructions for doing this in "Clean installing Windows XP", along with screen shots to guide you.

PRINT THE WHOLE THING OUT BEFORE YOU START because you won't be able to get on line (obviously) while you're formatting/installing!!

Oh, one more thing BEFORE you do this. Write down all your licenses/registrations to any free software you downloaded and installed. These can usually be found in the "Help>About" menu.

And if you already had XP on your machine, you can ignore a lot of the stuff about upgrading from 9X on the web page.

Oh . . . one more thing (I seem to keep remembering stuff here), did you have to download any special drivers for any of your hardware?? If so, then you may want to download those drivers again BEFORE you start and save them to removable media so that you can have something available if you need it.

Woops . . . remembered another tip . . . make sure you have all your ISP and email passwords available for when you can get back on line.

And I'm assuming you have your original Windows CD available for this. Make sure you have the Prodct Key available . . . you'll need it.

Now that I think of it, read through those instructions and post back here if you have any questions about it BEFORE you start.

So, here's a checklist of all the stuff you need to do BEFORE you start:

1. Get your Windows CD (without this, all bets are off)

2. Get the Windows CD Product Key (again, without this, all bets are off)

3. Back up all your valuable data to removable media.

4. Go to that web page I linked to above and print out the instructions.

5. Go to that web page I linked to above, read it ALL, and post back here if you have any questions.

6. Download and save any special drivers to removable media.

7. Write down your registrations/licenses to any software that you got off the Net.

8. Write down your ISP and email User ID's and Passwords.

That's it . . . good luck.

Posted 1 year ago #
Top
 

RSS feed for this topic

Reply

You must log in to post.

Our Friends
Getting Started


About How-To Geek
What Is That Process?
svchost.exe
jusched.exe
dwm.exe
ctfmon.exe
wmpnetwk.exe
mDNSResponder.exe
wmpnscfg.exe
rundll32.exe
wfcrun32.exe
Ipoint.exe
Itype.exe
Wfica32.exe
Mobsync.exe
conhost.exe
Dpupdchk.exe Adobe_Updater.exe

Copyright © 2006-2009 HowToGeek.com. All Rights Reserved.