I can't get these virus off my computer!

Discussion in 'Computer Security' started by Professor-Falken, Jul 24, 2005.

  1. Try

    Try Bit Poster

    27
    1
    18
    s++++ happens, backup your docs, mp3's, films..... wipe the whole thing out, fresh install, restore... and try to keep your anti-virus file definition up to date.
     
    Certifications: N+ MCP 210-215
    WIP: MCSA
  2. Professor-Falken

    Professor-Falken Kilobyte Poster

    393
    2
    37
    Turned off system restore. Ran antivirus in Safemode.
    Ran every antivirus program but Panda.
    Try to delete manaully found the directory and file and deleted it.
    But got same virus again in different location after running Norton again.

    What do i next

    Anyone!

    Thanks,

    Professor Falken
     
    Certifications: Comptia A+
    WIP: Comptia Network +
  3. ffreeloader

    ffreeloader Terabyte Poster

    3,661
    106
    167
    Have you installed and run HijackThis as someone suggested to you earlier on this thread? Then post the results as a file upload as was suggested. (The HJT log is much too long to post in full.) You have a nasty bit of malware from what I can see from Google searches.

    One other piece of software that I haven't seen recommended here is spybot search and destroy. It's worth trying it too, although this piece of malware may very well block it too.
     
    Certifications: MCSE, MCDBA, CCNA, A+
    WIP: LPIC 1
  4. nugget
    Honorary Member

    nugget Junior toady

    7,796
    71
    224
    OK, how about going to Start > Run > type in msconfig and go to the startup tab. See what's running in the registry keys. Open the registry editor (Start > Run > type in regedt32) and go to those keys. Try to track down each of the programs in the relevant directorys and check them out. Also match them up with the services running in the Services tab or the task manager. Look for ones with suspect names. What's happening is that (BTW have you installed anything recently) you have a program named eg. uduhjhjhdhd.exe getting started everytime you start your pc using the registry keys for startup and run. It then makes a copy or downloads these other backdoor/trojan programs which the AV finds and deletes. Then when you start up again the process happens all over again.

    If you look in the msconfig utility then you will see a lot of programs configured to start automatically. Disable these (at least the ones you know, like Adobe etc) and restart. Maybe a recently installed program, usually music players have these things embedded in the program code.

    Edit: check out these areas for the startup registry keys.
     
    Certifications: A+ | Network+ | Security+ | MCP (270,271,272,290,620) | MCDST | MCTS:Vista
    WIP: MCSA, 70-622,680,685
  5. AJ

    AJ 01000001 01100100 01101101 01101001 01101110 Administrator

    6,893
    177
    221
    Try looking here in the registry to see if windows is starting them up without you knowing.

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    If there is anything in there that looks like the virus file then remove it.

    Usual things before you start buggering about with the registery, BACK IT UP. Of course if you feel unsure messing with the registry, then don't. Back every thing up and start again.

    I have found in the past that if the virus is here then it will start up every time windows does. If it ain't here and you've disinfected your rig then that should solve it. But for goodness sake, backup first.
     
    Certifications: MCSE, MCSA (messaging), ITIL Foundation v3
    WIP: Breathing in and out, but not out and in, that's just wrong

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.