Virus, Spyware.. Need Help? Here it is

MOST ANTIVIRUS PROGRAMS ARE GARBAGE....TRULY USLESS IN THE LONG RUN...


I HAVE BEEN A PC / WINDOWS / LINUX EXPERT FOR OVER 20 YEARS... AND I WILL TELL YOU..THERE
IS ONLY ONE ANTIVIRUS PROGRAM THAT WILL PROTECT YOU FROM 99.9% OF EVERY THING OUT THERE..

NOD32

GET IT AT FILEHIPPO , FREE 30 DAY TRIAL... I JUST DELETE AND REINSTALL IT AS NEEDED

THERE IS NOTHING BETTER... IF YOU DONT BELIVE IT... DONT COMPLAIN TO ME...DO YOUR OWN
TEST...INSTALL IT AND GO INTO THE NASTYEST PLACES ON THE WEB... THEN TRY YOU AV PROGRAM
AND WATCH YOUR PC GET VAPORIZED...

IF YOU HAVE SOME REALLY BAD INFESTATION, JUST SAVE YOUR STUFF IN A FOLDER, BACK IT UP, WIPE THE PC BY REMOVING THE PARTITION AND REINSTALL WINDOWS.. THEN ADD NOD32...

I found this verry helpful
I recomend Super antispyware and CCleaner as well
I run Avira for antivirus

can anyone help me remove a mbr rootkit lol i've got many portables I've made of removers and such but I just can't seem to remove what I've got
it's super-hidden in the reg and I've got some ghost folders on my pc and also I used killswitch and can disconnect them but just can't seem to find or remove them all the way I used to have a clean copy of combofix but they infeasted it and my antivirus deleted it for me when I try and download a new copy it says it is expired and can only run part of the program

thanks in advance if anyone has any ideals

Why has NO ONE bothered to s&f the OP?

Thanks for the thread.

you know thats a really good question and deserves it

I'm coming at this from a small business perspective - making sure my team of 10 is fully protected from all kinds of viruses, malware, keyloggers etc. Instead of buying 10 separate licenses we started using Webroot's www.webroot.com... t.html and are able to protect all of our computers - and better yet manage them through one console. I'm very pleased. Already stopped one virus that could have done big time damage across our network.

well.. here's my issue thus far..

working on a friend's PC for the last week, here's the steps I used:

His condition: (after the windows update on the 3rd of July) PC running SUPER-mega slow, (the perverbial hourglass)

Ran the Combo Fix exe in Safe Mode
~found the virus under Winsystem32 dir
~after reboot, Windows ran Startup Restore
~and is now asking "Window and restore your computer to a earlier time when it was working correctly; no personal files will be removed but you may not undo this change. Do you want to continue?

Will this wipe the drive or is this the actual system restore that will restore the PC BACK to a restore point?

FORMATTING IS NOT AN OPTION here YET.. there are Critical court docs on the HD and is desperate to get them off and back them up.

Originally posted by granpabobby
I found this verry helpful
I recomend Super antispyware and CCleaner as well
I run Avira for antivirus

GL with the Avira ..

FAKE windows Anti-virus blew thur Avira ike a cannonball thru a block of cheese~!!

mine was the free version.. and yes.. it DID NOT catch it .. nor did it request my input...

Originally posted by ZOMBIEMASTER
MOST ANTIVIRUS PROGRAMS ARE GARBAGE....TRULY USLESS IN THE LONG RUN...


I HAVE BEEN A PC / WINDOWS / LINUX EXPERT FOR OVER 20 YEARS... AND I WILL TELL YOU..THERE
IS ONLY ONE ANTIVIRUS PROGRAM THAT WILL PROTECT YOU FROM 99.9% OF EVERY THING OUT THERE..

NOD32

GET IT AT FILEHIPPO , FREE 30 DAY TRIAL... I JUST DELETE AND REINSTALL IT AS NEEDED

THERE IS NOTHING BETTER... IF YOU DONT BELIVE IT... DONT COMPLAIN TO ME...DO YOUR OWN
TEST...INSTALL IT AND GO INTO THE NASTYEST PLACES ON THE WEB... THEN TRY YOU AV PROGRAM
AND WATCH YOUR PC GET VAPORIZED...

IF YOU HAVE SOME REALLY BAD INFESTATION, JUST SAVE YOUR STUFF IN A FOLDER, BACK IT UP, WIPE THE PC BY REMOVING THE PARTITION AND REINSTALL WINDOWS.. THEN ADD NOD32...

It might work but, the issue I have is that ALL other AV programs need to be uninstalled before ANY other AV programs can be installed...AND..

If you system is Hijacked and unable to get into Admin...AND
since you can NOT uninstall to reinstall NOD32 and can NOT wipe the HD...then what?

Programs that I've have used thus far and currently UNABLE to get into Admin rights.. are as follows..
~Hijack This
~Avira
~Malwarebytes
~Kaspersky~preimum version
~Roguekiller
~WIndows One system
~Spybot S&D
~Spy Hunter
~AVG
~Combo Fix (from Beepingcomputer)

SO...as you can see my other system is currently useable.. got any other ideas I might be able to try .. because my HD can NOT be wiped until it's clean.

The only other thing I thought about trying is getting another HD/install WinXP on it, and install my version of Kaspersky on the new HD, run that. My only dilemma is how to and to what, do I connect my infected HD to recover my sensitive docs or even clean it?

ETA: here's the 'REALLY HARD WAY" to get into Vista Admin Account i.e. "What do I do: I can no longer log in or elevate to an administrator account" (it will be long sequence)

Option 3: The really hard way

CAUTION: Improperly modifying the registry can harm your system.

1. Click on the start orb. Write down your username (the name listed right below your picture on the start menu.
2. Place your Windows Installation DVD into your DVD drive
3. Restart your computer
4. When prompted, press a key on your keyboard to boot from the DVD
5. Select your language options and click Next (See picture)
6. Select the option at the bottom to repair your computer (See picture)
7. Select your Windows installation from the list. Make sure you notate what drive letter it is installed on.
8. Select the last option from the list to open a Command Prompt (See picture)
9. Type the following command, and press enter:

regedit

10. On the left, click on HKEY_LOCAL_MACHINE
11. Click the File menu at the top, and then click Load Hive
12. Click the option on the left to go to "computer"
13. Double-click on the drive that Windows is installed on (you wrote this drive letter down in step 7)
14. Double-click on the folder called Windows
15. Double-click on the folder called System32
16. Double-click on the folder called Config
17. Click on the file called SAM and click Open
18. Type "Target SAM" into the box and click OK
19. Expand the HKEY_LOCAL_MACHINE folder by clicking on the triangle next to it
20. Expand the Target SAM folder by clicking on the triangle next to it
21. Expand the SAM folder by clicking on the triangle next to it
22. Expand the Domains folder by clicking on the triangle next to it
23. Expand the Accounts folder by clicking on the triangle next to it
24. Expand the Users folder by clicking on the triangle next to it
25. Click on the folder named 000001F4
26. Double-click the item in the right called "F"
27. You are now presented with an editor. You will see two columns: a list of letters and numbers grouped in pairs on the left, with a list of symbols on the right. We will only be using the list of letters and numbers on the left.
28. Find the spot in the left column that says "11".
29. Click to the immediate right of the 11, so that the flashing insertion line is to the immediate right of 11
30. Press backspace to make the 11 disappear
31. Using the keyboard, type the number 10

This should change the information in the left column from


02,00,01,00,00,00,00,00,80,8c,d7,b2,e9,97,c7,01,00,00,00,00,00,00,00,
00,1f,ea,fd,ad,e9,97,c7,01,00,00,00,00,00,00,00,00,de,ad,60,9b,e9,97,
c7,01,f4,01,00,00,01,02,00,00,11, ...



TO:



02,00,01,00,00,00,00,00,80,8c,d7,b2,e9,97,c7,01,00,00,00,00,00,00,00,
00,1f,ea,fd,ad,e9,97,c7,01,00,00,00,00,00,00,00,00,de,ad,60,9b,e9,97,
c7,01,f4,01,00,00,01,02,00,00,10, ...

32. Click OK
33. Close regedit
34. Close the command prompt window and click on the 'Restart' button on the window that gives you the list of options.
35. When your computer restarts, log in with the account named 'Administrator'. Use this emergency Administrator account to fix your normal administrator account by using the user accounts control panel.
source

reply to post by Komodo


Have you tried using a boot disk to by bass the infected system? I recommend using Hirens Boot Disk as it comes with mini xp and lots of preloaded antivirus software on it. You can load it onto a CD or a USB key.

Originally posted by PhoenixOD
reply to post by Komodo

 

Have you tried using a boot disk to by bass the infected system? I recommend using Hirens Boot Disk as it comes with mini xp and lots of preloaded antivirus software on it. You can load it onto a CD or a USB key.

no i haven't. but wow! I'm almost afraid to get one due to the shear number of programs it comes with !

How would it bypass the the infected system?

I haven't used Vista much if at all: I actually cringe & shiver when I hear that word *grin*.

reply to post by Komodo


Hirens boot disk has a complete pre installed version of XP called mini XP on it so when you turn on your computer it uses that as an operating system rather than your infected operating system. But it still allows you to access your hard drives when it has loaded up.

The Mini XP has 100's of pe-installed maintenance programs already on it and a whole bunch of anti-virus programs. You don't have to install anything on your original system , its all self contained in the boot disk and runs from there.

You will have to tell your bios to boot off either your DVD drive (if you are going to burn it to a disk) or your USB drive if you are going to install it to a USB stick.

When you have booted up off the Mini XP you then use the pe-installed anti-virus programs to scan your hard drives for virus's. The advantage of this is that the virus/trojan on your infected system wont be active during the scanning so it will be much easier to detect and destroy.

You can also add other antivirus programs to the boot disk or load then into minixp from a USB drive if you want.

Its not 100% guaranteed to cure the problem but when all else fails its well worth a try. Hirens Boot disk is an amazing bit of kit. When i was training at Microsoft Academy i showed it to the instructors there and they instantly wanted a copy. lol

Originally posted by PhoenixOD
reply to post by Komodo

 

Hirens boot disk has a complete pre installed version of XP called mini XP on it so when you turn on your computer it uses that as an operating system rather than your infected operating system. But it still allows you to access your hard drives when it has loaded up.

The Mini XP has 100's of pe-installed maintenance programs already on it and a whole bunch of anti-virus programs. You don't have to install anything on your original system , its all self contained in the boot disk and runs from there.

Well first you have to tell your bios to boot off either your DVD drive (if you are going to burn it to a disk) or your USB drive if you are going to install it to a USB stick.

So when you have booted up off the Mini XP you then use the pe-installed anti-virus programs to scan your hard drives for virus's. The advantage of this is that the virus/trojan on your infected system wont be active during the scanning so it will be much easier to detect and destroy.

You can also add other antivirus programs to the boot disk or load then into minixp from a USB drive if you want.

Its not 100% guaranteed to cure the problem but when all else fails its well worth a try. Hirens Boot disk is an amazing bit of kit. When i was training at Microsoft Academy i showed it to the instructors there and they instantly wanted a copy. lol

edit on 12-7-2012 by PhoenixOD because: (no reason given)

ok ..

understand now.. thx ~!

how the heck can I get one of these CD's ?? LOL .. there's no order/buy now on their website.

reply to post by Komodo

Info page:
www.hiren.info...

Download:
www.hirensbootcd.org...

U can also download Unetbootin' (for Windows, I presume) and then use it to download to a USB.

reply to post by Komodo


Apparently they don't host a download at their site.

You can download the latest version here

Info on how to install it to a USB drive and make the drive bootable can be found here.

Good luck on your mission

Thx all ~!

I got help from a friend that was IT Help Desk for a long time. Had the blue screen of death so he reinstalled Vista.

Still need to check out Hiren's BootCD; Thx for Lady & Phoneix for you assistance. Deeply Appreciated! Thx!

There's a free helpdesk online that either has your problem explained on their website, or they will get back to you by e-mail in a short time. They are:

protonic.com...

On Protonic's "About Us" page, they explain how to send in questions that their site does not yet address, plus lots of other basic info. They cannot write entire programs for users, and will not help with illegal activities like hacking, etc. Next time I need computer help, I will still check with ATS first, but Protonic definitely sounds interesting.

andrewvandalay
I'm coming at this from a small business perspective - making sure my team of 10 is fully protected from all kinds of viruses, malware, keyloggers etc. Instead of buying 10 separate licenses we started using Webroot's www.webroot.com... t.html and are able to protect all of our computers - and better yet manage them through one console. I'm very pleased. Already stopped one virus that could have done big time damage across our network.

Webroot is a great antivirus system. I have been using it for 2 years now and haven't had any issues - even though I go to a lot of questionable sites/download from non-standard sources.

With their multi-license model i also give the extra licenses out to my family members that have historically had malware issues and it gives me the ability to monitor their system's health from www.webroot.com.

Great product!

That said, it's great at detection but doesn't get everything. For the viruses that do get through super anti-spyware is my cleaning tool of choice. The free version works wonders.

Just for reference here is a website with a list of offline anti virus programs. Download the ISO and burn it to cd and boot to it.

Offline virus bootable discs

Sorry this isnt the thread. but i m having a problem, when i try to create a new topic or a new thread the page just appears with the ATS template but i have no option to do it...anyone may know why? sorry i hijacked the thread but i couldn createa new one so...