The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
computer help??
tony_important
Registered User regular
Registered User regular
Damn, I am so bad at this, but I have no idea what the hell is going on.
I am trying to help my cousin bring his computer back from death by virus, and when I open up the list of running processes, I see "cmd.exe" running 19 times. Any idea why this is? 'services.exe' is also open a bunch as well.
I was going to reformat, but without a windows install disc, I'm unable to do so.
If it's any help, I've run virus scan about 9 times and went from some 400 nasty objects to 1 or 2.
Any advice, even if it's general, would be welcome!
I am trying to help my cousin bring his computer back from death by virus, and when I open up the list of running processes, I see "cmd.exe" running 19 times. Any idea why this is? 'services.exe' is also open a bunch as well.
I was going to reformat, but without a windows install disc, I'm unable to do so.
If it's any help, I've run virus scan about 9 times and went from some 400 nasty objects to 1 or 2.
Any advice, even if it's general, would be welcome!
[SIGPIC][/SIGPIC]
tony_important on
0
Posts
Make sure to run your virus scan in Safe Mode (Press F8 when the computer is booting... Normally I say just mash the F8 button until you get the prompt). Make sure you run an anti-spyware as well (Google search Super Anti-Spyware, great program) in safe mode.
e: Also, if you go to Start-> Run, and type "msconfig" then go to the startup tab and uncheck everything, that helps a little.
sorry, forgot the important stuff.
running xp, SP3
mcafee
downloaded ad-aware and updated it
I'm going to try the msconfig, I completly forgot about that.
In all seriousness, that's just about the truth. Rebuilding a system after it's been infected with malware is really the only way to return it to a "trusted" environment. I certainly would inform your cousin to not to use it until it's been rebuilt - and for the sake of the Intarwebernets, leave it unplugged. There's a high chance it's part of a botnet or participating in some such nasty activity.
19 copies of cmd.exe is pretty fishy. That's the command-prompt window. Do you have 19 command prompt windows open? If not, it could be a malware file in a different directory called 'cmd.exe'. Process Explorer should also be able to show you which cmd.exe on your hard drive is the one running.
McAfee is probably fine against traditional viruses, but it seems to be rather ineffective against the new malware/spyware systems out there (same for, example, Symantec/Norton).
If you want to really find out what's running on bootup, you want to run HijackThis, not msconfig. HijackThis will show you all the little hidden registry locations that cause things to run on startup, all your browser helper objects that cause things to run when you start your browser, and so on. Msconfig will show you none of this. If you post a HijackThis log in this thread, I'll check it later and see if there's anything weird in there. HijackThis can also stop things from running on startup, but clever malware will often find a way to readd itself anyway, so your best bet is to run a real anti-malware tool, which brings us to...
The best simple malware scanner is MalwareBytes Anti-Malware (MBAM). It works just like a virus scanner except it doesn't sit around in the background (well, the pay version will, but just grab the free one). Do a full scan with this tool and see what it finds.
I've been able to de-malware a couple of machines just using MBAM. Some of the nastier infections require more aggressive tools, but you don't want to use those unless you've exhausted the alternative.
I always see the "nuke it from orbit" option as a last resort. It's always available, but it's often painful and you risk losing data, settings, and programs that are otherwise important.
Thanks for the help, I'm a bit lost at this.
I really don't want to reformat because I have nothing to start with in terms of reinstall. data/programs are not really an issue on this lappy, but without any direction I don't want to start nuking the bastard either.