help un-VIRUS- ing a PC

[sweetheart]

This *&"*£('ing PC is really pissing me off. THe start menu now has
no programs in it. "AVG" antivirus tells me that files that are
invisible are virus trojan horses... and no file utility can see them... explorer is blank, and the DOS prompt is "GONE". The
system tries to dial the internet automatically (not normal), and
i can't find whats wrong.

I have a coupla choices. Wipe the hard disk and start over with
the crap microsoft virus-ware, until this happens again. This would
involve re-installing the entire PC and such... a total pain.. :-(

I could, while i'm still on-line with the PC, order linux and pray
that i can get the system back on-line with linux....

I have no trust in anti-virus ware... it just tells me what i already
know... trojan horses are all over the bloody disk in files i am
not able to edit.

Sorry i'm severely frustrated... i fuckig hate windows, mostly
because it is a virus-haven where the most simple features are complex and obscure so that regular people haven't a prayer of getting it working again if it bugs up.

If i rebuild this PC, i could be offline for a month as i'm not so
sure that it will go back together right... have you any advise
for a perturbed and tired PC attempted-repairer?

[Maestro]

1. Can you reboot

and press F8 to get to the prompt where you can enter safe mode? This way you might be able to save some necessary files before having to do the reformat. AVG is very good. You are saying that it can't erase or isolate the trojans? Can Spybot or Adaware isolate them and delete them?

[mvd]

2. Safe mode is always the thing to try first

You said what I was going to say. Sounds like there may also be dialers on the system.

Here's a good guide:

http://www.broadbandreports.com/faq/8428

[sweetheart]

4. The start menu

has me worried. No programs means something is trashed beyond
my ability to recover it. Whether i locate the virus is now a moot
point, the PC is hosed. I'll lose peoplesoft version 7.5, when
i blow it aways... it is the only thing i can't recover from disk.

When i get it back to operating condition, surely i'll have to get
something better than AVG which just stood by and informed me that
viruses were in files i could not delete... nor find in explorer.

I "knew" this would happen, and did my best to keep the build
current with security patches and such... but to no avail.

Microsoft is crap software. If i could meet bill gates in person,
i'd slap him for wasting so many hours and days of my life with his
buggy mediocrity-ware that his monopoly forces me to buy every
coupla years, that has never ever ever in the history of its use
on any PC i have ever owned or used, not been a crashing dumping
coredumping crap software... "can i send the crash dump to microsoft"?.. "no" dammit, What good has all the other crash dumps
they've recieved done moi? The programmers at microsoft, incompetents
that they are, probably just laugh when users discovers the
features of their overpaid crapware. ha ha! wasted a few days of
your life with our crap... ha ha! I've gotta get to linux and
de-microsoft, and maybe the viruses won't be so problematic.

Thanks for your helpfulness Maestro...

peace,
-s

[Tandalayo_Scheisskopf]

9. "I've gotta get to linux "

Mandrake Linux 10.0 Official came out this week. Get it. It really, really is worth it. I am running 10.0 Community here(earlier release) and am blithely happy with it. Not only is it technically great and sound, but it is the prettiest desktop I have ever seen.

Of course, I also use the wallpapers from here:

http://www.ashafx.com

Asha r4wKz. Know it.

[Norbert]

3. This is way beyond my capabilities but...

I would trust the experts at Lavasoft.

http://www.lavasoftusa.com/

They helped me out of a jam a while back. They have a free product called AdAware6.0 that I would recommend running every other day when you are through with the problem. It is excellent.

These people know their stuff. They will ask what you are running (Windows2000XP ext.)

On edit:

Here is a link to their support forums:

http://www.lavasoftsupport.com/

[Abaques]

5. Probably quicker to format and reinstall...

...sad but true. You just described a horrible situation.

If you are interested in linux, try www.knoppix.net for a bootable cd. They have good instructions on how to install from the disk too. Probably the easiest linux install you can do. Free too.

If you want to go back to windows. Format, reinstall and download mozilla at www.mozilla.org and use it exclusively instead of Internet Explorer and Outlook. Run all your windows updates. If its XP, then set up the firewall, if not download and install blackice or some other firewall. Then download and install ad-aware from www.lavasoftusa.com and re-download and update avg from www.grisoft.com

The vast majority of viruses propagate soley through the use of IE or Outlook. Most worms are stopped by a good firewall. Using Mozilla and a firewall will keep most bad things out of your system. If you have cable or dsl, then go get a cable/dsl router from your local electronics store. It has a hardware firewall that will protect you better then software firewalls.

Good luck.

[Tandalayo_Scheisskopf]

6. The Windows Firewall...

Is, to be kind and delicate, a piece of shit. I recommend(STRONGLY!) Kerio Firewall. Free for personal use and damned good. Low system overhead too.

[Tandalayo_Scheisskopf]

7. What OS are you running?

n/t

[Prisoner_Number_Six]

8. Reboot into Safe Mode (F8 as described in other posts)

When (if) it comes up with a START menu, go to START, then RUN, then type in MSCONFIG. A utility will open up. You will see a series of tabs at the top. Go to STARTUP. Uncheck EVERYTHING.

When (if) it reboots into "normal" Windows, update your virus definitions (if the virus hasn't broken the antivirus engine you have installed) and do a full scan. You can also go to Add And Remove Programs within CONTROL PANEL and uninstall anything you don't recall installing.

But it sounds like your machine may be beyond these steps. Remember, if you have files you can't afford to lose, a PC techie can pull the hard drive and rescue them BEFORE you wipe and reinstall!

Three words: BACKUP BACKUP BACKUP

[sweetheart]

10. Reply to ALL

Thank you for the wise advise. I have to sleep on it, having no
more emotional maturity left to do anything but fix the PC with
a frikking sledge hammer. ;-)

This may be the moment to jump towards linux... what do you do
for powerpoint, word and excel? Is there an alternate linux sorta
thingie? Will my internet provider ISP disk hook me back up with
the internet under linux?

Oh dear. I'm sorry if i'm a bit crabby about this. This is the
second PC i've lost to internet microsoft viruses. My main machine
never gets near a network, so no worries on losing important files...
though i'm gonna get in in the chops for losing peoplesoft 7.5...
oh well... (pout)

Really thank you for the things. I'll try the f8 thing tommorrow
first thing, and if it still looks irreparable, then perhaps linux
really is the future. I always loved Solaris, and if linus is any
even close to solaris, i'm already in love... just the networking
on Unix can be obscure... ooh, what pains i've had getting unix
boxes to talk X.25 and PPP.... past lives...

tomorrow is a new day... (today) :-) and it is my gift that i can
still write this post on DU from a PC that has otherwise seen its
last moments of microsoft operating products.

Thanks again to all of you who spoke up. I appreciate it.. really.

WOOF! :-)

[Madrone]

11. what do you do for powerpoint, word and excel?

OpenOffice. It's a better Office than MS office. In fact, it can open corrupt word documents, for example, and when you re-save the document it fixes it so MS word can open it again.

http://www.openoffice.org

You can run it on windows, too.

[Maestro]

12. After you reformat

Get a firewall. I personally use Zone Alarm Pro, but any will do. Set that up to your liking. Then do as I suggested in my previous post about adding Adaware and Spybot to your installation. The links were posted by another poster. Actually Spybot can be found here: http://www.safer-networking.org/

I still would suggest AVG. I have used many anti-viruses and this one is the best to me. I use the pay version. I keep it up-to-date religiously. I have not had a bug since switching to XP and in its defense, I can't believe I am defending Winblows, but it has more viruses because so many people use it and try to exploit it. If OS X for example for the MAC had as many users you would find as many viruses. But anyhow, try to to do those things and stay vigilant and you shouldn't have too many more problems. Fingers crossed.

[Pinko Commie]

13. All good ideas so far

I would first try booting to safe mode, and see what you can do from there. If not, try booting from a live cd or rescue disk, if you have one. Just because the programs are gone from the start menu does not necessarily mean the programs are gone, so you might be able to run some things from DOS or thr Run box. And you can try to back up needed stuff. Backing up software at this point would be tough, but you might be able to get source code and data OK.

If you can get to the net cleanly, try going out to some of the security sites like pcflank.com, Symantec, grc.com, etc. Many have remote malware tests they can run, although I'm not sure they can remove what they find. Also, try getting HijackThis, and try posting your Hijack log to some of the security sites. They will try to help you there.

If you can, definately get spybot and adaware, and run them. They may be able to clean it up pretty well. In fact, I read of a situation like yours where the repairman booted to safe mode, ran spybot & adaware, and cleaned everything.

In the future, you should, at minimum,
- Install a good firewall. Kerio, Sygate, Agnitum, LooknStop get pretty good recommendations. Norton and McAfee are not really the best.
- Definately install SpyBot and Adaware.
- Get a good AV program. AVG is good, but my experience is that the free version would not delete anything it found. AntiVir and Avast are good, too.
- Install SpywareBlaster and SpywareGuard

You will be safer not using IE and Outlook. Try Mozilla or Firefox. Also, webmail is generally safer than using an email client.

Also, consider keeping a multi-boot system, with one OS just for internet access. Which OS to use as your internet system depends on your own taste and needs. But if you do experience problems, its easy to reformat the partition and reinstall. Probably good to do this once in a while anyway, since you never know what could have gotten through your defenses. A multi-boot system also gives you an alternate, clean OS to boot to so you can debug any problems, or backup needed files.

Hope this helps.

Goodluck. Godspeed. Kirk out.