Subscribe to How-To Geek

Welcome to the How-To Geek Forums

We encourage you to register on our forums and post any questions you might have. The How-To Geeks monitor this forum and will respond to your question quickly.

How-To Geek Forums » Windows XP

(Solved) - Got a virus, need help

(18 posts)
  • Started 7 months ago by harpeter
  • Latest reply from BobJam
  • Topic Viewed 582 times

  • Remove Solved Status

harpeter
Posts: 34

A few days ago My wife and I downloaded some music from Limewire (new upgrade to Limewire a few days before that). I have used Ad-Aware and my Norton Anti-virus programs. The Norton pops up once in awhile and says it blocked a trojan and a worm and a backdoor problem. I'm getting pop ups which I never did before. I downloaded what I thought was another free spyware program and it said it found some problems but then to fix them I had to buy their program.

The question is, do any of you know of a good FREE program that will find and let me get rid of a virus?

Posted 7 months ago #
Top
 
junglekiller
Posts: 1

ESET NOD32 IT WORK OKEY

Posted 7 months ago #
Top
 
ScottW
ScottW
Posts: 6609

harpeter, Norton AV is a good anti-virus program, if it's up-to-date. What you probably have is malware, not a virus. So, I would suggest a free anti-malware scanner, such as SuperAntiSpyware or MalwareBytes Anti-Malware (MBAM). Ad-aware used to be a good anti-malware program but, in my opinion, it has fallen behind.

Another good measure is to run your scans in Safe Mode. Some of this new malware runs at Windows startup and works to prevent it from being removed. Running in Safe Mode will prevent most malware from protecting itself. BTW, there is also malware that will try to prevent the anti-malware programs from being installed, so write back if you see this.

Start by running scans in Safe Mode. You can also install the new scanners in Safe Mode and should you need to get updated definitions, you can choose "Safe Mode with Networking" for Internet access. Post back with the results and we can assist further, if needed.

Posted 7 months ago #
Top
 
Odeho19
Odeho19
Posts: 258

Just a quick thought to add to ScottW's notes before you cause any further (if you have any at all right now) damage to your computer. These pop-ups that you are getting, ALWAYS close them by clicking on the red "X" in the upper right hand corner of their perspective windows. Some viruses will include a "close window" button within the pop-up itself, ( or some such phrasing such as "ignore", or "try later") as an alternate to the "install now", or "purchase now" button. These will actually cause further damage to your machine.

Posted 7 months ago #
Top
 
ScottW
ScottW
Posts: 6609

Odeho, that's good advice. I actually use Alt+F4 to close pop-up windows so there is *no* chance that I accidentally click inside the window. Another trick they do, which you have probably seen, is where they draw a second close gadget inside the window in the hopes that you will click on the wrong one.

Posted 7 months ago #
Top
 
BobJam
BobJam
Posts: 878

Hey harpeter.

It is a pretty common scam nowadays for these pop-ups to show up and display that you have all manner of bad stuff and then tell you that the only way you can remove it is by buying their stuff . . . it's appropriately called "scrareware".

You likely got this from Limewire. I'm not suggesting necessarily that you don't download music from Limewire, but it's a hotbed for malware so if you're going to use it, make sure your virus protection is up to date and run an on demand scan after you download any music from there.

Now before Limewire fans jump all over me and protest that "I've been using Limewire ever since it came out and I've never gotten an infection", I agree. There's plenty of people who have never gotten bad stuff from Limewire. But there's plenty that have too . . . so just be extra safe if you choose to go there.

Whenever a pop up presents a link for a download, DO NOT click on it, no matter how badly some may say your computer is infected. If you're scared that it may be infected, run an on demand scan with the LEGITIMATE antivirus software that you have on your machine already.

One of the particularly popular scams lately is a pop up that will scare you by telling you that you have 100's of registry errors, and the only way to "clean" them is to click on their "Registry Cleaner" link. I recently saw one that claimed the user had over a thousand registry "errors". If you had that many registry errors and they were serious (which the scam implies, if not outright saying so), then your machine wouldn't even be running.

Before Rick jumps in here and corrects me, I'm not saying that you can't have 1000 registry . . . trivial defects. But they are not serious errors that will cause your machine to malfunction. They are things like links pointing to non-existent help files or missing desktop icons, which is pretty trivial.

Finally, these scams will actually give you more infections if you download them, NOT remove infections. Plus, if you buy that crap then the scammers will likely have enough of your personal information to steal your identity or make fraudulent credit card charges.

In fact, whereas infections used to be something that bored malware writers used to do just for "kicks", infections nowadays are written with an eye toward getting enough of your personal information so that these scoundrels can steal your identity. It's big business now.

So don't ever click on a download link in a pop up . . . nor should you click on links in emails or IM's. More than one person has been infected by clicking on a link in an IM that says something like "Click on this link to see a cool pic."

Posted 7 months ago #
Top
 
harpeter
Posts: 34

Sorry for the delay in getting back to you guys. My computer has been dead since Sunday about noon.

I'm on my granddaughters computer. Let be bring you up to date what has happened.

I downloaded a free spyware prograqm that someone recommended on one of the blogs on this site but can't remember where right now. The program was AntiVir. I ran it and it come up about 30 problems, I took the choice to repair all and now the computer is dead in the water.

By dead in the water I mean it will power up to the desk top with the icons showing. But the bottom row where the Start key and clock shows doesn't show up. I can move the mouse but nothing happens if I double click on any icons. The only thing I can do is hit the power off key. What's strange is when I do that the Start row shows up and also the AntiVir program pops up and shows a virus with the name TR/Spy.Gen whick I cose to delete. But nothing happens and I have to hit power off I more time to shut the computer off.

Someone told me what probably happened is when the AntiVir program delete some bad stuff it took some system files with it. So,I got a restore disk and booted up from my CD Rom the Windows XP disk and tried to use the repair function to replace the removed files. When I chose the repair function it come up with a window that just sat their and did nothing.

So I went to the library and got on line to Dell and orderded the system operating disks that should have come with the computer but Dell don't send them anymore with the purchase of a computer.

I forgot how to start up in Safe mode so if someone could refresh my memory I would appreaciate it.

I know if I can't get up and running I will have to format the hard drive and reinstall the operating system but that is my last choice. I did do a backup of my important data on Feb 15th so would,'t be that bad except for email addresses and favorites.

Sorry for the long rant but wanted to give you as much info as I could.

Posted 7 months ago #
Top
 
ScottW
ScottW
Posts: 6609

harpeter, to get into Safe Mode, you tap the F8 key while the system is booting up. Start hitting F8 when you see the manufacturer's splash screen or BIOS output. If you see "Starting Windows", you have missed it. When done correctly, you will see a plain text screen with the Advanced Boot Options menu. From this you can choose "Safe Mode". This is a good step to try, since the system might work better in Safe Mode.

If you can get into Safe Mode, you could try a System Restore operation to roll back the system to before the problem. If that's not an option you could try running AntiVir and use it to restore all of the files that it has quarantined. Finally, if it comes down to using the Feb 15 backup, you could copy your bookmarks and e-mail addresses off before the restore.

Posted 7 months ago #
Top
 
harpeter
Posts: 34

I got to safe mode and tried severak restore points and it said it couldn't do it after several minutes. While in safe mode I did back up my favorites and email addresses to a flash drive. I put the window XP disk in and tried to do a repair and it said my version was newer than the one I was using.

I haven't tried to restore all quarantied things that AntiVir put there, will try that now.

Posted 7 months ago #
Top
 
GaardCeteru
GaardCeteru
Posts: 135

Hello, well every advice you've been getting is right, it's weird that safe mode doesnt work that well. Anyhow, should you need to format your machine you may be able to do it if your provider (I understand it's Dell in this case) made a "partition"*.

Usually a (D:) will appear when you go into "My Computer" and possibly show as "FACTORY_IMAGE" or some similar (althought make sure you only have one hard drive since "D" could appear if you have two hard drives). If you happen to have this partition then:
1. Turn off your computer
2. Disconnect all peripherals (being printer, webcams, flash drives, etc),
3. After you've done this turn on your computer and inmmediatly as you turn it on you'll get to your provider's splash screen (where there is the logo of Dell in this case and instructions on the lower part such as " F12 Boot Preferences")
4.Press whatever [F] button your system calls for, it should say "Recovery Partition", "Recovery Image" "Windows Recovery" or similar, in my case it is the [F11] key and there you can follow the instructions to recover your computer and leave it the way it came from the factory the day you bought it.
Notice all your personal files will be lost (the program will warn you of this at some point) and past doing this you can't roll back to restore points since, as I said, it formats your computer and leaves it working the way it was when you first bought it. It may take from several minutes to several hours.
DON'T TURN OFF YOUR COMPUTER WHILE IN THE PROCESS (sorry for using full caps but this is really important since you can't tell what kind of damage you can make.)

If you notice your computer freezes wait a long time (a really long time, like 4 hours or so) before you hit the off button since some procedures really take a while. The good thing if you have this recovery partition is that you wont need to fetch drivers from all over internet and install them yourself but I highly recommend going for a windows update in order to do have your computer and thus drivers, updated.

First things to do after you've recovered:
1.Set up the internet.
2.Download Windows Updates.
3.Install antivirus
4.Turn off, reconect al peripherals and install them.
5.Install programs you use.

You can get more accurate information from your provider's troubleshooting and manteinance guide or similar documents that came with your computer.

I hope you can solve your problems so you don't have to go through this process.

__________________________________
*From Wikipedia: "Disk partitioning is the act or practice of dividing the storage space of a hard disk drive into separate data areas known as partitions. A partition editor program can be used to create, delete or modify these partitions. Once a disk is divided into several partitions, directories and files of different categories may be stored in different partitions. More partitions provide more control but too many may become cumbersome. The way space management, access permissions and directory searching are implemented depends upon the type of file system installed on a partition."

Posted 7 months ago #
Top
 
harpeter
Posts: 34

I have good news, I'm back up and running.

I went to Safe mode and reran the Virus program I downloaded. (AntiVir) It found 8 viruses mostly trogans. I chose to delete them. When I rebooted to normal startup I reran the virus program again, found 2 viruses and deleted them. I'm now clean as far as I know.

Posted 7 months ago #
Top
 
Odeho19
Odeho19
Posts: 258

@harpeter, if you're still checking in, I would as ScottW suggested much earlier still download, and install the SUPERAnti-Spyware, and the Malwarebytes-AntiMalware, just for good measure. These are both VERY useful tools in addition to your anti-virus protection that you're using. I use several others as well, (but some of my friends would put me a little on the side of paranoid, lol) but these two if ran seperately once a week or so, will help keep the nasties to a minimum, and can help stop something before it gets too big.

If you found 10 viruses and were able to save your machine as easily as it seems you did, I'd go out and buy myself a lottery ticket, lol. It seems you have certainly got some great luck on your side.

Posted 7 months ago #
Top
 
harpeter
Posts: 34

Odeho19, yes I do consider myself lucky. I thought for sure I was going to have to format and reinstall the OS. I hate to recommend a virus program without others checking it out but the one I used was located here.

http://www.free-av.com/

I did save those two programs that ScottW suggested but haven't installed them yet. Does anyone know if you can run any of these type of programs from a CD rom. My saving grace was I was able to start up in Safe Mode and run my program. Another question, is there a conflict if you have multiple spyware programs running at the same time. Some you run at your wish but some are active at all times.

Posted 7 months ago #
Top
 
ScottW
ScottW
Posts: 6609

harpeter, the AV software from free-av.com is Avira AntiVir Personal, which is quite popular these days and there are several members on this forum who use it.

You can run virus checkers from a CD. When a system is so infected that Windows won't start, or won't function, you can boot from a CD and run AV software to remove the infection. This is a good disaster recovery procedure, but not as good as restoring from a current, uninfected backup! You should make yourself a UBCD4win disc. It boots into a slimmed down XP environment where you can run most Windows programs.

You should only have one anti-virus or anti-spyware program running at all times. The real-time or "online" scan usually examines all files that are accessed as they are loaded. This slows down the loading time a little bit, so having more than one is a performance drag. You can have as many offline scanners as you wish.

Posted 7 months ago #
Top
 
harpeter
Posts: 34

Thanks Scott. Could you tell me how to make a UBCD4win disc.

Posted 7 months ago #
Top
 
ScottW
ScottW
Posts: 6609

harpeter, I had meant to make the words "UBCD4win disc" a hotlink in the above post. That website has all of the files and instructions to build your own bootable CD. In addition, The Geek has an article about it:
http://www.howtogeek.com/howto.....covery-cd/

Posted 7 months ago #
Top
 
harpeter
Posts: 34

Thanks Scott, I'll check those links out.

Posted 7 months ago #
Top
 
BobJam
BobJam
Posts: 878

I recently did a UBCD4win myself, and you may get some tips, especially on what NOT to do, here. Scroll about two thirds down in that thread, and you'll be able to cut to the chase.

Looking back on it, the effort was actually easy if I had not gotten sidetracked on slipstreaming.

Posted 7 months ago #
Top
 

RSS feed for this topic

Reply

You must log in to post.

Our Friends
Getting Started


About How-To Geek
What Is That Process?
svchost.exe
jusched.exe
dwm.exe
ctfmon.exe
wmpnetwk.exe
mDNSResponder.exe
wmpnscfg.exe
rundll32.exe
wfcrun32.exe
Ipoint.exe
Itype.exe
Wfica32.exe
Mobsync.exe
conhost.exe
Dpupdchk.exe Adobe_Updater.exe

Copyright © 2006-2009 HowToGeek.com. All Rights Reserved.