The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.

Trojan/Virus problem, help?

S0upS0up Registered User regular
edited May 2008 in Help / Advice Forum
So my girlfriend downloaded something stupid onto my computer, now I get pop ups, slow computer lag, errors when trying to enter another account on my XP system, and over all utter annoyance. Oh, and google.com won't load at all.

Ad-Aware doesn't catch anything and I'm really not too sure how to fix this problem. In my 9 years of being computer savy I've never had an issue with any kind of virus/trojan. Probably because most computer folk know what they're up against. Yet, my girlfriend downloaded some sort of video, and of course she doesn't know what the problem was, but now my computer is infected.

So my question is, how do I go about fixing this problem? Are there any programs worth obtaining or any kind of process check I can run? Any and all help would be appreciated.

S0up on

Posts

  • DrFrylockDrFrylock Registered User regular
    edited May 2008
    Nowadays it's tough because you've got to deal with viruses, trojans, spyware, worms, and a whole bunch of other stuff. I was surfing on a relative's computer who had patched Windows completely, but was running an old version of something (maybe Flash player, maybe RealPlayer, I never did figure out what it was). I went to an innocuous webpage linked from Digg, the browser crashed, and suddenly the computer was completely and utterly fucked. Shit popping up in my system tray looking like Windows Defender, but really trying to get me to download (more) Russian fake-anti-spyware, you name it. Whatever had gotten me initially went out and downloaded a cocktail of all its buddies and started installing it. I pulled the plug on the Internet as fast as I could but it was too late. It disabled the task manager. It installed three new services and four browser helper objects that would reinfect me every time I rebooted or started a browser. They watched the filesystem and every time I'd delete a nasty file, three more would appear to take its place. Kill a bad process, and its friend restarted it.

    From that experience, I learned that it's now very hard to even identify what you've got, let alone fix it. Sometimes one program will do it, other times you've got to use a cocktail of programs.

    In my case, it took six straight hours with about five different tools, but I scraped the machine clean and I didn't have to nuke it from orbit.

    The best thing to do might be to run HijackThis, which will generate a log of everything running on your computer, and everything that is sitting somewhere that will auto-load. The traditional procedure is that you take this log and post it on a forum at someplace like geekstogo.com, and then people who know how to read the logs post steps you should take to systematically start removing everything bad from your machine. Different helpers seem to have different cocktails of tools that they like to apply. Having worked with PCs for 15 or 20 years now, I was able to decipher the logs myself and fix my own problem, but if you don't know what you're looking at there's definite potential to royally fuck a system.

    In my case, I was able to use a program called ComboFix to undo most of the damage. This program is basically a super-soldier against certain kinds of nasties. However, there's a warning when you start the program that about 1% of the computers that run it get so screwed up that you have to reformat and reinstall. It kills just about every process on your system, including Explorer, and then scans for nasties. It uses something like 41 passes of different techniques to search and destroy. Then, it installs hooks so when you reboot, certain files and registry keys are deleted before the OS even loads, before the virus has a chance to block you. Once this is done, I had to look at my logs and make a manual script, again passed to ComboFix, that would kill the remainder of the nasties (since they have a tendency to polymorph and rename themselves so you can never get 100% of them).

    If you're lucky, your problem is not so serious. Posting a HijackThis log on one of those forums will probably be helpful. You might also try tools like AVG Antivirus, AVG AntiSpyware, and Stinger to see if you have something simple and easy to remove.

    DrFrylock on
  • AurinAurin Registered User regular
    edited May 2008
    Also, before running your virus scans, shut off System Restore, like pronto. Many viruses use it as a place to store backups of themselves, so they'll keep replicating and reinstalling even after you've cleaned the original file off of your system.

    Aurin on
  • ReitenReiten Registered User regular
    edited May 2008
    Work from safe mode. You'll get much better results. And what Aurin said. Turn your system restore off NOW.

    Reiten on
Sign In or Register to comment.