Spyware, viruses, & security forum: Most Nasty Freaking Virus I've encountered

shut dowm system restore in xp.

Switching to a mac should do the trick....... I use mine as a door-stop and it never gives a bit of bother.
But if you want to get some work done - leave the kiddies speak-n-spell in the mac-shop and build a proper PC

Freeware from Dr. Web. Here is the URL to download & try it yourself:

http://www.drweb.com/

Good luck!

It took a few days, but I finally fixed mine and I have not had any problems since. I got infected big time. When I ran the first spyware program, it found 6 Trojan viruses which I tried to delete or quarantine - it was successful in deleting 5 of them, but the last one was being used by Windows (2000), so it could not delete it. I re-booted, and they all came back. This was a clue to me that my windows system .dll files had been modified to include some run commands that re-installed the Trojans.

So, since these .dll files are re-created by the system at boot-up, I figured it was safe to delete the ones I thought were suspicious. Before doing so, however, I installed a firewall and set it to "block all traffic". This would prevent any of the Trojans from connecting or trying to connect with the Internet. Then, I re-booted, ran the antivirus program again, and was finally able to deleted the Trojans again & this time the last file was quarantined. I then deleted the quarantined file and deleted all the .dll files I thought looked suspicious. I then kept re-booting and kept running virus checks with different programs & re-booted several times. The .dll files were re-created clean eventually & I have had NO PROBLEMS AT ALL since.

P.S: it honestly took me about a week of trial and error to do this, so you have to be patient. It was quite a relief to finally go back on the Internet and be able to surf without further attacks. I had a new computer from work and I had totally forgotten to re-install my free Pop-Up Blocker. That is, without a doubt, the reason I got attacked to begin with. Sorry for the length of the message - hope somebody benefits from it.

I wonder why, you attempted to mess with a system that was directly infected by actually using the infected system to try and resolve the problem.

I do system repairs daily for fool customers, who have kids that love anything that looks like it might be a virus then download it and install it.
It's built into there makeup.

Since I'm sure you lost many valuable programs, and files by formating, it should never have been done.

I have a backup HD with a clean OS (XP) that if needed becomes the main drive.

1. Take your infected (C) drive out of the system, and set it to a (slave drive)

2. Set and Install your backup HD as (Master)

3. Boot up the system, set whatever AV program you have on the clean drive to do a reboot virus check of all system drives. Pay attention to what it tells you do do.

4. Now boot again , and go to work with the utilities that should be on your (backup drive) and and use them to clean you infected (now D drive)keep it mind some utilities that remove spy ware will only scan your C drive, you want those that will scan ANY drive.

I'm not going to add a lot of details about HOW to, or what to use as many are in previous posts, however I done this to save files, programs, OS's e.t.c.

Formatting in my mind is fools last resort.

Obviously you are not afraid to crack open your system. Consider a few of these possibilities when the next infection hits.

First, get the infected drive entirely out of the boot path - set it to slave or add an external hard drive enclosure.

Reload your system ROM with a fresh image from your mainboard maker. Use one of the bootable images from http://www.bootdisk.com/ to help you achieve this.

Now, get a live CD version of one of the Linux clean-up toolsets. Try http://s-t-d.org/ or one of the many offerings on Frozen Tech's LiveCD List at http://www.frozentech.com/content/livecd.php (search for security and forensics).

Once you've got the live CD going, you can explore and clean your infected drive with high assurance that you won't be spreading the infection.

All of this presumes a degree of familiarity with Windows internals, but I think you've demonstrated that.

Good luck,
Sp00ky

Swithch to Apple iMac. I did and it is smooth sailing. No more greed mania from Microsoft!

Hi, This is called Look2Me, it's a combination virus/adware/spyware, almost imposible to remove, I have had 2 customers in a row with it, the fist one I removed it after some reasearch, you need to do both a virus and adware scan in safe mode with explorer.exe terminated as it attaches itself to the process and detects when it has been found and reinstalls itself. The 2nd customer I had with it I couldn't remove it using the same process so had to format. You will find that it will reset the PC when it has been detected as well.

If all else fails and the virus comes back than it's clear that it's still in your system, remove the cmos battery for a hour. Virus's can live in the battery and reappear. On some mobo's you can clear the cmos by moving the jumper over one and waiting 3 seconds and reinslalling the jumper back to it's origional position. Then reset your bios and this should clear out all the virus.