Tips for getting rid of a nasty virus?

urahonky

First things first: I work in IT and have seen a lot of nasty viruses in my time, but this one is pretty bad. I'm unable to boot into safe mode or "last known good settings" (which, in my opinion, never works anyway). And when I do boot it up in normal mode, I'll get a "countdown" and after a certain amount of time the computer will reboot.

So I was thinking of booting up with Knoppix or another live CD and running a virus scan on it, but I'm not sure if that will work. I don't have the computer in my possession yet.

I have an external HDD enclosure kit, but I don't want to risk getting my desktop infected. But that would be worst case scenario. I know about AVG and stuff... But does AVG have a command-line scanner? Those seem to be more effective, but I'm not sure if it has that.

...That went all over the place. Basically, do you think it's possible to boot the computer in Knoppix and run a virus scanner in that? Is there a PBE (preboot environment) that has a virus scan built in?

Thanks for the help guys.

amateurhour

I don't think the freebie versions of avg have a command line scanner built in.

There shouldn't be a problem booting into Knoppix though. I'd set up the HD to boot last and try to boot into it with a thumb drive as well as a live cd if at all possible. I've seen a lot of scenarios where the cd boot fails if there's a lot of problem with the bios, or if it's been changed. I have no clue what causes it, but I've seen it more than once.

What's your antivirus you're using? Also, is there any more info on the virus, or is it just causing boot problems? If it's just the boot problems it could be a corrupted HD sector, and not a virus.

urahonky

Well it seems to me that it's doing what the old Bloodhound virus is doing, preventing anything from happening whilst in Windows. As soon as it boots up into Windows, it'll give a countdown and shut down again. Supposedly unable to boot into safe mode (the person told me that she's tried that and it wont completely load).

I personally have an expired copy of Trend Micro on my computer at home (expired a few weeks ago, but never really bothered paying the $30 to renew, not yet anyway). I don't think she had one on her computer. Also, she doesn't have her recovery CDs. So it'll be fun to try and get it back to normal without corrupting anything.

Not sure if her computer supports USB booting, but I'll give that a shot. I have Ubuntu installed in one of my old thumb drives. That way I can run a virus scan from a CD or something.

amateurhour

I'd get my hands on the machine and try booting into safe mode.

If you can, or if you can just get into the main os, immediately go into running programs, see what's causing it, then go into registry (regedit) and try to manually remove it first.

If none of that works, trend is the way to go. We use it in the corporate environment we have here and I love it.

urahonky

Yeah, good idea. I was going to boot into it, and then msconfig and remove all bootup items and see if that helps or not. My main concern is the countdown. She didn't say how long it gave her, but I assume 60 seconds.

Regardless, thanks for the info amateurhour.

Trentus

Can you get to cmd and do a shutdown -a to stop it rebooting? It's amazing how often that works.

ApexMirage

you can bypass the 60 seconds by changing your system time. Go to your clock and wind it back a year and wave goodbye to the timer.

urahonky

Oh sweet, I'll try both of those suggestions. Thanks, I didn't know that.