Virus info.............

[Burke Kilgour]

:nonod:
Well, I seem to have picked up some viruses and was hoping some of the computer gurus could help me out.
I clicked on a codec download to view a video on wiring up a magnetic starter for my compressor and all hell broke loose last week on my computer. I was getting pop-ups galore on my computer about my computer being at risk bla bla bla. I brought it into a computer shop to get rid of my careless mistake and they got most of it. They took out Troj_vundo.bmf, ZLOB.trojan, and a few others but my computer is still not right.
Panda was picking up adware/adsmart (c:\windows\system32\thun32.dll) so I put the computer in safe mode and got rid of that file because Panda couldn't do it. Much better now but there's still something monitoring my internet activity because of the slow time to open new windows or tabs. Is there a list of .dll, exe etc. files I can pull out manually to get rid of the rest?
When I run Panda now it just skips the boot sector during the scan.
Spybot doesn't find anything and other on line scans just skip the boot sector scan as well (Housecall, Panda activescann 2.0, spyware terminator)

Help........................ :( :(

[Scream And Fly]

Burke,

From what you're saying, it sounds like your computer may have had infections prior to the most recent incident. Without knowing exactly what's going on there, I would give NOD32 (http://www.eset.com) a shot - in my opinion, it's the best antivirus software out there, but it's not free. The real trouble is, software is designed to prevent infection, and many of today's viruses will, once active, interfere with the installation of most antivirus applications. I do think that NOD32 stands a very good chance of helping you, however.

If it were my computer, I would make sure all of your data is backed up and reformat the drive. Not great news, I know, but it's really the only way to be sure, and if you bank online and such, you can never be too careful.

Greg

[Burke Kilgour]

Thanks Greg, I'm giving the free on-line scanner a try right now.
I had thought of reformatting the drive, but I don't have a full copy of XP, I just have the upgrade, so I'd have to put the old operating system back on and upgrade it............ I may go out and buy a full copy of XP tomorrow.
The full copy of XP will reformat the drive for me? right?
Thanks :D

[Scream And Fly]

Burke, you do not need the full copy of XP - you can perform a full, clean install of XP using the upgrade disc, as long as you have a Windows 95, 98, or Me CD. You do not need to install the old operating system first. Just boot into the XP upgrade CD, and Windows will ask you for a qualifying upgrade CD to scan, then you reinsert you XP upgrade CD. From then on, XP installs as normal.

Yes, the upgrade and full copies of XP can fdisk your drive (format fully) on installation. Actually, there's no difference between the XP upgrade and full version disc - just the check for a qualifying product.


Thanks Greg, I'm giving the free on-line scanner a try right now.
I had thought of reformatting the drive, but I don't have a full copy of XP, I just have the upgrade, so I'd have to put the old operating system back on and upgrade it............ I may go out and buy a full copy of XP tomorrow.
The full copy of XP will reformat the drive for me? right?
Thanks :D

[Burke Kilgour]

Even with the boot sector all buggered up? Computer tech here told me the infections could make their way back in if I did that.
Hmmmmmmmm, now I just have to find the disc........ LOL

[Scream And Fly]

If the MBR is toast, then yes, a standard format may not remove it. If you want to be sure, use Kill Disk (http://www.killdisk.com/downloadfree.htm). Nothing will escape it. After that, run the XP install and reformat as normal.

[pyro]

VUNDO and similar virusses will embed themselves into everyday windows EXE and DLL programs, and constantly download new viruses. There's probably a half-dozen open programs that are all actively running and sustaining the virus. You can't shut down these system programs, even in safe mode, you'll get the "access denied." It put extra shell and command lines all over the place in the registry, very tough to clean once it's running.

This one stumped me real good when we got it at the shop, I ended up re-installing.

There's a whole new round of viruses that just came out this week, and they use a fake video codec download installer to propagate. ouch.

[Burke Kilgour]

Yup, last week was it. The thing that really "got me" so to speak was the fact that I was doing technical search for compressor wiring and nowhere near the "stuff" that is usually associated with viruses. Caught me off guard (as they had planned)..............
Thanks for the info Chad.
Greg, I assume if I use Kill Disc then I'll need a full copy of XP because Windows won't find a previous version?
I can't find my XP upgrade disc anywhere. I think I lent it to someone that had a cheat to put it on a laptop or something like that, I'm racking my brain to think of who it was though.
Is there a way of pulling the key code out of my machine, so I could just load another copy of XP on?
Thanks

[stvmerc]

VUNDO and similar virusses will embed themselves into everyday windows EXE and DLL programs, and constantly download new viruses. There's probably a half-dozen open programs that are all actively running and sustaining the virus. You can't shut down these system programs, even in safe mode, you'll get the "access denied." It put extra shell and command lines all over the place in the registry, very tough to clean once it's running.

This one stumped me real good when we got it at the shop, I ended up re-installing.

There's a whole new round of viruses that just came out this week, and they use a fake video codec download installer to propagate. ouch.

Pyro, that is great info, thanks, any idea where I can read more about these new viruses? thanks.

[Burke Kilgour]

Greg, is there anything I should know about Kill Disc (other than there's NO return)?

[Scream And Fly]

Greg, is there anything I should know about Kill Disc (other than there's NO return)?

Burke, I think they have a free version of Kill Disk, and I believe there are other similar free applications like it.

No, you do not need a full XP disc - just your upgrade disc and a Windows 95, 98, or Me disc for the CD-check XP will do during setup.

[Burke Kilgour]

I'm just about to start the process, so I figured I'd ask. Yes, there's a free version. Thanks :D

[Scream And Fly]

I'm just about to start the process, so I figured I'd ask. Yes, there's a free version. Thanks :D

Just let me know if you need any help along the way. I'll be checking this thread from time to time.

[Burke Kilgour]

Admittedly I'm a bit nervous about it.

[Burke Kilgour]

Well Greg, I need help right off the bat. :nonod:
I can't get my computer to boot off the A drive discette, I formatted it as a MS-DOS bootable disc and made sure the boot order was right but it won't do it................. this stuff is frustrating.........

[Scream And Fly]

Well Greg, I need help right off the bat. :nonod:
I can't get my computer to boot off the A drive discette, I formatted it as a MS-DOS bootable disc and made sure the boot order was right but it won't do it................. this stuff is frustrating.........

Is this for the Windows boot disk? Your computer should be able to boot off the CD-ROM drive. Just set your boot order to 'CD-ROM' first, and make sure the Windows XP upgrade disc is in the drive :)

[Burke Kilgour]

No, this is the Kill Disc "bootable floppy" made online from their site.

[Scream And Fly]

No, this is the Kill Disc "bootable floppy" made online from their site.

I'll have to read up on why it's not booting for you. Are you positive you have your BIOS set to boot from the floppy first?

[Burke Kilgour]

Yup, checked it many times, I tried 2 different ways. One from the "one step bootable disc creator" on their site and anoter time from a MS-DOS formatted disc.

[Scream And Fly]

Yup, checked it many times, I tried 2 different ways. One from the "one step bootable disc creator" on their site and anoter time from a MS-DOS formatted disc.

That's strange. In that case, I would try making a rescue disk from one of the antivirus companies. I would have to check, but I believe some will allow you to do this for free. If so, it would likely be easier than using Kill Disk. Maybe give Avdisk (http://www.avdisk.org/index_en.html) a try. I'll look more into it in the morning, if that's alright. Some more info here: http://www.free-antivirus.info/anti-virus/avg-antivirus-free-edition.html

[Burke Kilgour]

OK, got Kill Disc to work when I loaded it onto a CD and put that in the first boot order, worked just fine.
The next problem was getting XP to boot onto the blank computer. I ended up putting my ME recovery disc in and booting that first, then XP went on no problem.
I'd like to do it again, and put XP on fresh without ME first, at least I know I have a clean slate right now.

[Wile E. Coyote]

i had the vundo, or virtumonde, (also wintroj32, and a half dozen other names) it embeds in dll's and is a pita to get rid of, wish i'd seen this sooner, you could have gone to vundo fix and they have a free download that kills 95% of it, and windows defender belive it or not gets the other 5% either way, hope it works out for you

[Burke Kilgour]

Well, it was a good time to "clean house" so to speak.
She's runnin' mint now.
Thanks anyway :D

[Denny <><]

Don't remember those days anymore since 5 years ago i bought a merc and a mac