Can anyone help get rid of a virus?

by **RedWingFan** » Thu Jan 05, 2012 8:42 am

Fact Finder wrote:This machine is one week old, and yes, it's my fault for not having the Anti-virus up and running while watching a football stream from Sweden.

by **YoungJRNY** » Thu Jan 05, 2012 8:59 am

Go into your Add and Remove programs or Programs and features and remove your current anti-virus, which is probably Mcaffee or Norton. Go here, www.filehippo.com and download AVG antivirus (one of the best) Malwarebytes and Super Antivirus, all free and the best anti-virus removal tools and programs on the market. Boot into safe mode and run these in safe mode. Then re-boot and run these programs in regular mode and that should wipe you free of any virus. After actually reading (I know amazing, huh?) it looks like you've done that. We've been getting some NASTY virus's as of late, one's that are quite new and a bitch to contend with.

One of the best out there that fixed ALL my problems when all else failed is called COMBOfix which runs VERY deep. Download COMBOfix and see where that takes you. Worked for me everytime I had one of these nasty, nasty bugs. ALSO, CCleaner is also a good cleaner. CCleaner is a registry cleaner as well and is another that runs deep inside the system for attacked files.

http://combofix.org/
http://www.filehippo.com/download_ccleaner/ (CCleaner)

by **Ehwmatt** » Thu Jan 05, 2012 9:13 am

Unless you have some compelling need to use PC/Windows-exclusive software (and don't want to run Windows on an Intel Mac), my first piece of advice would be to buy a fuckin Mac.

I'm not even a huge Apple fanboy. I don't have an iPhone or an iPad. But switching to Macs and Mac OS X has just made my life so much easier the last 4 years. I can use my computer to do work and surf the web instead of using it to debug and eradicate viruses, spyware etc.

by **conversationpc** » Thu Jan 05, 2012 9:26 am

Fact Finder wrote:
RedWingFan wrote:
Fact Finder wrote:This machine is one week old, and yes, it's my fault for not having the Anti-virus up and running while watching a football stream from Sweden.

I'm looking for help dude, not ridicule, my wife's already done that.

Dude, if you're watching anything from Sweden other than Swedish Stewardess Porn, you should be severely ashamed of yourself. :lol:

by **YoungJRNY** » Thu Jan 05, 2012 9:41 am

Fact Finder wrote:
YoungJRNY wrote:Go into your Add and Remove programs or Programs and features and remove your current anti-virus, which is probably Mcaffee or Norton. Go here, www.filehippo.com and download AVG antivirus (one of the best) Malwarebytes and Super Antivirus, all free and the best anti-virus removal tools and programs on the market. Boot into safe mode and run these in safe mode. Then re-boot and run these programs in regular mode and that should wipe you free of any virus. After actually reading (I know amazing, huh?) it looks like you've done that. We've been getting some NASTY virus's as of late, one's that are quite new and a bitch to contend with.

One of the best out there that fixed ALL my problems when all else failed is called COMBOfix which runs VERY deep. Download COMBOfix and see where that takes you. Worked for me everytime I had one of these nasty, nasty bugs. ALSO, CCleaner is also a good cleaner. CCleaner is a registry cleaner as well and is another that runs deep inside the system for attacked files.

http://combofix.org/
http://www.filehippo.com/download_ccleaner/ (CCleaner)

Travis, this is a box my son built me for X-mas and has no AV...(my fault I know), Matt, hey it was free and it's loaded with goodies that I'm familier with and I hate my Daughters Mac everytime I've tried it. I havn't had a problem like this for at least 3 or 4 years and everytime I got a virus I was able to get rid of it pretty easily, but not this one. Reading about this thing on google is scary. Travis, I do have CCLeaner and thats the first thing I did upon regaining function. I've ran Maleware at least 4 times from Safe and reg modes as well as ran Spybot, Adaware and Avast...now I'm off to download AVG and Combofix to the flash drive. The one little positive in this is that I'll now have a portable FD with every AV and Anti-spyware fix known to man on it. If ya need an AV call me..

Atleast you educated yourself. Never, ever, ever go undetected without a anti-virus. Attacks are getting more and more severe and unprotected systems pay the price quite hard. It's like bungee jumping without a chord pretty much. Another good anti-virus is Hitman, also try that. http://blog.freeantivirushelp.com/post/ ... nload.aspx

It also won't hurt to do a chkdsk or a Disk Cleanup. Even though it's a new system, I've gotten into the habit to check for bad clusters or attacked Temporary files that some programs won't pick up. Won't hurt to run it just for your own sake.

by **YoungJRNY** » Thu Jan 05, 2012 11:39 am

Fact Finder wrote:So the Combofix doesn't work with Windows 7 Ultimate yet, but...AVG seems to have stabalized things alot. Running a bot check now and so far no pop ups.

Sweet! As long as you can get things stabilized. AVG is the first thing I put onto new systems or if we scrub a new system for a client. I don't fuck with any of those pussified shit like Norton or MaCaffee. AVG is badass and never had a problem with quick fixes.

by **Angel** » Thu Jan 05, 2012 12:20 pm

You can't ever get rid of herpes, but you can take meds to reduce outbreaks.

by **Rip Rokken** » Thu Jan 05, 2012 2:56 pm

Hey, FF - hopefully you've got it under control. Some of the Fake Antivirus-type infections are very easy to kill, but others are far from it and use rootkit technology to hide themselves from detection and resist removal. And "bootkits" are now coming back into style... these hide themselves in the master boot record, which often requires writing a new MBR code.

The worst infection I've ever seen was not that long ago - it was called "ZeroAccess" and was the only virus I've ever encountered that I ended up having to format a hard drive and start from scratch to fix. I'd kill it and it would show no trace, then spontaneously regenerate from out of nowhere. Lost that battle twice before a couple of us figured out a solid technique for taking it out. It not only hides in the MBR, but also creates hidden, encrypted freaking partitions on the hard drive where it runs some of its processes.

Here are a few extra utilities you may want to download and run just to make sure whatever you got is gone...

AntiZeroAccess - designed to detect and help remove that infection. It never worked completely for me though, but I've heard it's evolved since last time.
http://anywhere.webrootcloudav.com/antizeroaccess.exe

TDSKiller, for removing the TDS family of bootkit viruses:
http://support.kaspersky.com/faq/?qid=208280684

and here's an article on TDS:
http://www.pcworld.com/article/242286/w ... auled.html

Also, a great new utility from Microsoft - very easy to download and create a bootable disc or USB flash drive from. These are becoming more and more necessary these days, as many of the rootkit/bootkit infections cannot be detected from within Windows:

Microsoft Standalone System Sweeper
http://connect.microsoft.com/systemsweeper

Here's a video on how it works:

http://www.youtube.com/watch?v=lCY012HPrRY

Good luck!

by **mikemarrs** » Thu Jan 05, 2012 4:16 pm

Angel wrote:You can't ever get rid of herpes, but you can take meds to reduce outbreaks.

LOL

by **No Surprize** » Thu Jan 05, 2012 10:42 pm

Ehwmatt wrote:Unless you have some compelling need to use PC/Windows-exclusive software (and don't want to run Windows on an Intel Mac), my first piece of advice would be to buy a fuckin Mac.

I'm not even a huge Apple fanboy. I don't have an iPhone or an iPad. But switching to Macs and Mac OS X has just made my life so much easier the last 4 years. I can use my computer to do work and surf the web instead of using it to debug and eradicate viruses, spyware etc.

No shit. After I got my Apple on, I forgot all about a pc. No crashing, No virus, everything runs smoothly with no problems at all.

by **YoungJRNY** » Fri Jan 06, 2012 5:58 am

Try going in manually, FF. After Googling, it seems like you got the "Google-redirect Virus." Here's the description:

A Google redirect virus is installed through a Trojan horse and executed once a web browser is opened. The virus affects Google search results by showing advertisements or affiliate links instead of real search links. The redirect virus can also affect web browsing as advertisements pop up or pages suddenly redirect to a spam or ad website. Several steps are necessary to remove this type of virus and create a working virus fix. Updating the computer's antivirus and anti-spyware is the best way to protect yourself from future infestations.

Try these steps:

1. Press the "Start" button on your desktop and then click "Control Panel" button. Select the option "System and Security" and then select the "Device Manager" hyperlink. Click on "View" from the menu bar and select "Show Hidden Devices."

2. Scroll down the list until you see "TDSSserve.sys" and click on it to disable the option. Restart your computer. When your computer reboots, you should update the anti-virus removal tool on your computer.

3. Download and install a free anti-virus removal tool from the Internet on your computer. Use software tools like Google-Redirect-Virus-Remover for Windows XP and Vista, Malwarebytes' Anti-Malware, and SuperAntiSpyware to remove the virus.

4. Run the anti-virus removal tool, so that it will scan your computer and remove the Google redirect virus. The virus is known to corrupt Registry files, disable the Firewall and anti-virus removal tools that are running on your computer.

5. Check the LAN settings on the Web browser that you're currently using. If you're using Internet Explorer, select "Tools" from the menu bar and then select "Internet Options." Press the "Connections" tab button and then click on the "LAN Settings" button. Check to make certain that the option for "Use a proxy server for your LAN" is unchecked or disabled. Click the "OK" button and close the Web browser.

6. Check the LAN settings for Mozilla Firefox browser. Select "Tools" from the menu bar and then select "Options." Click on the "Advanced" tab button. Then click on the "Network" ta button. Go to "Settings" and check to make certain that the "No Proxy" radio button is enabled. Click the "OK" button and close the Web browser.

7. Download and run an anti-rootkit tool like "UnHack Me" to fix any redirect issues on your Web browser. Anti-rootkit tools are capable of detecting any hidden rootkits that can cause your Web browser to malfunction.They will also monitor your computer for malware infections.

Here's another way of going in manually, but be CAREFUL going into the registry!

1. Click on "Start," "Computer," "Local Disk" (or "C:"), "Windows," and "System32." Find regedit.exe in this folder and right click on it. Rename to a made up name (one that you can remember). Disable regedit.exe, which will disable Google Redirect Virus from executing.

2. Download and install Anti-Malware by Malwarebytes. Run the Anti-Malware complete scan and select to search all drivers, folders and files. Complete the scan and remove any Trojan horses found.

3. Go back to the "System32" folder and rename the file "regedit.exe."

4. Click on "Start." Select "Run" and type in "regedit" or type "regedit" in the "Start Search" box. A new window will open called "Registry Editor."

5. Click on the arrow to expand "HKEY_LOCAL_MACHINE". Click on "Software," "Microsoft," "Windows," "CurrentVersion," "Run." Look for an entry in the right-hand window called "RegSvr32=%System%msmsgs.exe". Right-click and delete the file. Restart the computer.

#

Run a complete antivirus and anti-spyware scan after the registry key has been removed. Run separate programs for antivirus and anti-spyware. Some viruses are written to bypass antivirus program checks but are recognized and deleted by anti-spyware programs.
#

Delete registry keys only if there is a match. Do not remove any registry keys that do not say "RegSvr32=%System%msmsgs.exe" specifically.

by **YoungJRNY** » Fri Jan 06, 2012 6:35 am

Windows 7 is still a relatively new and improved OS and there are probably a lot of rootkits and programs out there still not suitable for such a new OS at that kind of version level (even though Windows 8 is now being worked on.)

As for the "Catalyst Control Center...Host has stopped working" error, the Catalyst Control Center is usually officiated with your Graphics Card. Try updating your Graphics Card from the manufacturer's website un-install the current Graphics Card driver and download the latest drivers once we kick this virus's ass. http://support.amd.com/us/Pages/AMDSupportHub.aspx

by **YoungJRNY** » Fri Jan 06, 2012 7:05 am

Fact Finder wrote:
YoungJRNY wrote:Windows 7 is still a relatively new and improved OS and there are probably a lot of rootkits and programs out there still not suitable for such a new OS at that kind of version level (even though Windows 8 is now being worked on.)

As for the "Catalyst Control Center...Host has stopped working" error, the Catalyst Control Center is usually officiated with your Graphics Card. Try updating your Graphics Card from the manufacturer's website un-install the current Graphics Card driver and download the latest drivers once we kick this virus's ass. http://support.amd.com/us/Pages/AMDSupportHub.aspx

I actually did remove and update drivers on Sunday or Monday but apparently I need to do that after it's clean???

Who knows, it could be the Virus giving you phony Error messages but if you're getting that message, try downloading the latest drivers from the manufacturer's website or if the Card came with an installation CD, pop that in and re-install all the drivers that came with it to be safe. Maybe those drivers you installed weren't the current up to date drivers for that particular card and it's giving you an error because of it.

by **cinkidd** » Fri Jan 06, 2012 7:29 am

Pain in the ass to have to do, but in all honesty probably the best. Reformat you hard-drive and reinstall everything. If you don't have the original discs that makes it a huge pain, but one that will prevent you from having further problems relating to the current virus.

Download and install AVG Free Antivirus. I've been using it for five years and NOT had a SINGLE ISSUE and I go to lots of "sites" that I probably should not go to.

Rich the Free Guy

by **S2M** » Fri Jan 06, 2012 7:35 am

Fact Finder wrote:
YoungJRNY wrote:Windows 7 is still a relatively new and improved OS and there are probably a lot of rootkits and programs out there still not suitable for such a new OS at that kind of version level (even though Windows 8 is now being worked on.)

As for the "Catalyst Control Center...Host has stopped working" error, the Catalyst Control Center is usually officiated with your Graphics Card. Try updating your Graphics Card from the manufacturer's website un-install the current Graphics Card driver and download the latest drivers once we kick this virus's ass. http://support.amd.com/us/Pages/AMDSupportHub.aspx

I actually did remove and update drivers on Sunday or Monday but apparently I need to do that after it's clean???

You got an STD from Sean Hannity. Quit dragging on his johnson. lol

This just in: Sean Hannity > Tim Tebow

by **Rick** » Fri Jan 06, 2012 12:27 pm

Fact Finder wrote:Just loaded Hitmanpro on the FD and ran that, and it found a "bootkit" threat and removed it. It's funny because the virus is still there when I surf but now Rips TDSS program opens and runs. That's what makes this virus so scary, it just seems to keep jumping around as you chase it and the Spyware folks can't keep up with it. One day my whole Desktop is gone, the nest day mouse doesn't want to work, yesterday right after regaining some function it shut off my internet connction and sound card..then I thru AVG at it which got my sound back but the damn re-directs are still there and when I click a web site a message pops up and says "Message from webp...Noooo". Nasty little bugger.

Oh and Don, I looked thru hundreds of files including hidden C:program files like you suggested and not a damn one looks like you describe. UGGGGGGGGGGGGG!

Maybe just have your son do a complete reinstall. You know it's gone then. Oh, and put an antivirus on it before surfing porn next time. :lol:

by **YoungJRNY** » Fri Jan 06, 2012 2:30 pm

I think you've pretty much done all you could, FF. I think it's time to re-format and go with a clean install. I notified my brother on his take on this certain virus and he said he actually had one in the shop today that had the same exact virus, the Google-redirect. He said he fixed the re-direct before with ComboFix (which you said it didn't run in 7Ultimate) and the other they had to do a clean install the system was so corrupted and the virus buried itself in too deep.

I think re-formatting and doing a clean install is the way to go. No use in battling this thing when it's pretty much been reeking havoc all this time with no fix.

PS: I don't know what's dirtier. Watching porn or the Bungles :lol:

by **Rick** » Fri Jan 06, 2012 3:58 pm

Fact Finder wrote:
Rick wrote:
Fact Finder wrote:Just loaded Hitmanpro on the FD and ran that, and it found a "bootkit" threat and removed it. It's funny because the virus is still there when I surf but now Rips TDSS program opens and runs. That's what makes this virus so scary, it just seems to keep jumping around as you chase it and the Spyware folks can't keep up with it. One day my whole Desktop is gone, the nest day mouse doesn't want to work, yesterday right after regaining some function it shut off my internet connction and sound card..then I thru AVG at it which got my sound back but the damn re-directs are still there and when I click a web site a message pops up and says "Message from webp...Noooo". Nasty little bugger.

Oh and Don, I looked thru hundreds of files including hidden C:program files like you suggested and not a damn one looks like you describe. UGGGGGGGGGGGGG!

Maybe just have your son do a complete reinstall. You know it's gone then. Oh, and put an antivirus on it before surfing porn next time.

Quit calling my BungHoles porn, only I can do that. And re-install looks likely..."UnHackMe" seems to have just killed me for good

Black screen and only task manager with ctrlaltdel..DAMN.

looking for system restore keys

ALT+F11 on some, if it has the hidden restore partition.

by **Rip Rokken** » Fri Jan 06, 2012 11:57 pm

FF, sounds like you have a variation of the TDSS infection, and it must have been blocking TDSS from running. Definitely try the Microsoft tool I mentioned as a last resort - then probably a good idea to start from scratch if that doesn't help. I wish ya luck!

by **Duncan** » Sat Jan 07, 2012 7:44 am

If you play this on your computer the virus will kill itself.

http://www.youtube.com/watch?v=Bz3BWPAY ... e=youtu.be

by **conversationpc** » Sat Jan 07, 2012 12:07 pm

Duncan wrote:If you play this on your computer the virus will kill itself.

http://www.youtube.com/watch?v=Bz3BWPAY ... e=youtu.be

I kinda like that song...Very moody, almost with a middle-eastern feel.

by **Rick** » Sat Jan 07, 2012 2:05 pm

conversationpc wrote:
Duncan wrote:If you play this on your computer the virus will kill itself.

http://www.youtube.com/watch?v=Bz3BWPAY ... e=youtu.be

I kinda like that song...Very moody, almost with a middle-eastern feel.

I like it too. Nora has a great voice. Reminds me so much of Grace Slick in that song.

by **Abitaman** » Sun Jan 08, 2012 3:08 am

I had the virus on on of my computers. It came up as an widow 7 update. Even though Avast and Spyware Terminator were SCREAMING warnings, my wife saw windows 7 update and pushed it thinking it would stop whatever Avast was warning about.
She let the virus in. Did all the same things yours did.
Over a couple days I was able to get rid of it. It shut down all my protection, Avast, Defender, Spyware Terminator, and Adware. I could not turn them on, much less find most of my stuff. What it did was put everything as hidden folders. I was able to unhide my protection, then I could scan. But icouldld not find the virus, since iinfecteded the programs and they thought it was part of windows.
So I went to my other computer, downloaded Avast onto my jump drive. Took it my infected computer, scanned it. It found the virus and removed it.
Make sure your virus protection on the other computer has the updated virus library. If this doesn't work, downloadifferenternt anti virus program on the old computer (AVG and Avast are the best and the are free), put on jump drive and scan infected computer.
Hope this helps. I do side work on computers agivegiove a discounts for people if they let take off their Norton or Macfee anti virus and put on Avast or AVG. I also recommend Spyware terminator, Adware, Windows Defender, and Spybot Search and Destroy. I use the others as a supplement to Avast or AVG.
The only reason we got the virus was because my wife pushed install instead letting Avast block. That will not happen again, I changed setting.

by **RPM** » Sun Jan 08, 2012 5:39 am

Ehwmatt wrote:Unless you have some compelling need to use PC/Windows-exclusive software (and don't want to run Windows on an Intel Mac), my first piece of advice would be to buy a fuckin Mac.

I'm not even a huge Apple fanboy. I don't have an iPhone or an iPad. But switching to Macs and Mac OS X has just made my life so much easier the last 4 years. I can use my computer to do work and surf the web instead of using it to debug and eradicate viruses, spyware etc.

I second that. Bought a mac mini with lion. lOVE IT. now I just use a computer instead of trying to get it to keep
working right!

by **artist4perry** » Sun Jan 08, 2012 5:44 am

Rick wrote:
conversationpc wrote:
Duncan wrote:If you play this on your computer the virus will kill itself.

http://www.youtube.com/watch?v=Bz3BWPAY ... e=youtu.be

I kinda like that song...Very moody, almost with a middle-eastern feel.

I like it too. Nora has a great voice. Reminds me so much of Grace Slick in that song.

It would die of happiness!

P.S. Duncan before you criticize Nora, lets hear you sing. :wink:

by **Rick** » Sun Jan 08, 2012 10:29 am

artist4perry wrote:
Rick wrote:
conversationpc wrote:
Duncan wrote:If you play this on your computer the virus will kill itself.

http://www.youtube.com/watch?v=Bz3BWPAY ... e=youtu.be

I kinda like that song...Very moody, almost with a middle-eastern feel.

I like it too. Nora has a great voice. Reminds me so much of Grace Slick in that song.

It would die of happiness! P.S. Duncan before you criticize Nora, lets hear you sing.

You can't please everyone. And with Duncan's humongously wide musical window, I'm surprised he doesn't like that. I'm pretty sure Nora knows how good of a vocalist she is, and isn't worried about someone that doesn't care for their style.

by **artist4perry** » Sun Jan 08, 2012 2:51 pm

Rick wrote:
artist4perry wrote:
Rick wrote:
conversationpc wrote:
Duncan wrote:If you play this on your computer the virus will kill itself.

http://www.youtube.com/watch?v=Bz3BWPAY ... e=youtu.be

I kinda like that song...Very moody, almost with a middle-eastern feel.

I like it too. Nora has a great voice. Reminds me so much of Grace Slick in that song.

It would die of happiness! P.S. Duncan before you criticize Nora, lets hear you sing.

You can't please everyone. And with Duncan's humongously wide musical window, I'm surprised he doesn't like that. I'm pretty sure Nora knows how good of a vocalist she is, and isn't worried about someone that doesn't care for their style.

This is true. But I appreciate how she does what she loves. She has great talents and I too find her to be like Grace Slick.

by **YoungJRNY** » Sun Jan 08, 2012 2:57 pm

So Nora's the fix to the TDSS Google re-direct virus? I'll put that on my flash drive right now, haha.

MR

Can anyone help get rid of a virus?

Re: Can anyone help get rid of a virus?

Re: Can anyone help get rid of a virus?

Who is online