Topic: virus?

[tomcj2]

Wife "restricted" profile wont work, its actually the weather pc, so I need it to boot right into main profile so all the weather stuff starts auto.  I will just ban her from it, we have a mac to play on (lots of news on mac's being targetted now but only with respect to pirated software), and she has a laptop for work, there is no reason for her to use my pc.

Andrew

My wife and her children used to use my laptop.  Every time I needed to use it, it was terribly slow due to all the junk the put on it.  On many occasions I would spend an hour or so cleaning it up, and giving the "don't load crap" lecture.  I even gave them a restricted user profile, but they worked around it.

About a year ago I bought them a cheap ($229) Compaq desk top and swore that I would never use it.  Just now, for the first time, I went on it.  I could walk to the library to get what I need online faster than using that machine.  I will not tell her that I used it and I WILL NOT clean it up until it stops totally.

[mackbig]

Thanks ironton, I stumbled accross hijackthis a few times over the years.  I did find a forum today about various infections, and they always ask for the hijack this log.  So I was at the site today, and planned on trying it tonight.  Thanks for the hosting offer.  Luckily I have my mac and laptop to get files, then use my network or usb to get it on to the infected one.  Hijack should be ok to do this method since it does not have an update requirement.

I will post an update tonight, good or bad.

Andrew

A program I've used with some success is called hijackthis (trendmicro) and it is a free download.  Their webpage says hijackthis - "quickly scans your Windows computer to find settings that may have been changed by spyware, malware or other unwanted programs. HijackThis creates a report, or log file, with the results of the scan. 
It does not determine what is good or bad. and warns you "Do not make any changes to your computer settings unless you are an expert computer user."
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Good Luck - hope you can avoid the reformat!

[SlowModem]

I didn't review the thread, so I don't know if Windows Virus Check (I think it's called one stop live or something like that) has been mentioned:

http://onecare.live.com/site/en-us/default.htm

I use it occasionally.  It takes a long time to upload the updates with dialup.  But it seems to work well.  It checks registry and other things, too.

[mackbig]

Update: nothing really

Downloaded spybot S&D - ran it, took a long time, all it found were tracking cookies
did another malwarebytes scan or two (both safe and regular mode) nothing
Another round of superantispyware (both safe and regular) a couple more tracking cookies
took a look on hijackthis.  nothing jumped out   even on the forums that ask for the logs, the usual answer is to run the 3 above programs....

Tried a restore to the day prior to initial possible infection (april 17), did not work in regular mode, seemed to work in safe mode, but after reboot it said "there were no changes made to pc, choose another date... hmmm?

Anyway going to pick up some drives tonight.   then keep playing till tomorrow morning.  Try to find my xp install cd, I think the only other CD I dont know the location to is MS office.   Then I will make decision tomorrow, whether to just use my january clean image and restore vws data, install wasp and strinklink... or whether to try and start a new....

Andrew

[Anole]

Forgive me for jumping in late to this and I may have misssed something along the way.

Everyone is assuming that the problem is a virus. While it certainly looks like you had an infection that doesn't mean that that is what is/was causing your IE issue. Have you tried to run IE in safe mode? Not Windows safe mode, IE safe mode. Pull up the Run dialog and type in:
 
iexplore.exe -extoff

This will start IE in safe mode which means that none of the add-ons will start. If it starts in safe mode then you probably have a bad add-on causing the issue. If that's the case go to the control panel and open the internet options. chose the programs tab, then manage add-ons. Disable everything (make sure you choose all the options in the pull down), then open IE. If it works repeat the above and start enabling add-ons until you find the one that is causing the issue.

As a side note, running Ad-Aware, Spybot, Malwarebytes, Superantispyware, and your regular AV software all on the same machine is just asking for trouble. Personally, I stopped using Spybot and Ad-Aware years ago. I've seen Ad-Aware in particular cause serious issues (unbootable system) after a so called cleanup on more than one occasion. The program that seems to be working best right now for spyware infection cleanup is Malwarebytes. If you've manually updated it with the most recent definitions and the scan comes up clean then the system is probably clean and there is something else wrong.

Be careful with HijackThis. It is a tool intended for use by folks who understand the specifics of what the report is telling you. It will delete exactly what you tell it to and will not warn or suggest. It assumes you know what you are doing. Also be aware that you may need to rename it. Some infections will detect and interfere with it unless you rename it.

[mackbig]

Thanks Anole.

I was planning on uninstalling spybot sd and superantispyware anway.  and just keep malwarebytes. The other two seem to run all the time.  Also going to remove CA AV.   I did not kill anything with hijackthis, the warnings are pretty scary...

I thought at first it was just an IE issue.  But the fact that FF has been crashing on occasion too, especially when going to AV sites, and that my ca and malwarebytes are blocked from updating makes me think its definitely something trojan like.   Since all my issues went away saturday night (albeit temporarily) after malwarebytes removed the Daonol trojan that was definitely the issue.  Of course not sure how it regenerated Wednesday morning.

thanks,
Andrew

[jmcmurry]

Several months ago I had something similar and it turned out to be a root kit.  My paid version of AVG 8.0 identified it, but could not permanently remove it.  Just prior to formatting I found and tried an older beta version http://www.softpedia.com/get/Antivirus/AVG-Anti-Rootkit.shtml and it worked!  This may not be the solution, but it's worth a try.

- Jim

[mackbig]

Thanks Jim, worth a try...
Andrew

Several months ago I had something similar and it turned out to be a root kit.  My paid version of AVG 8.0 identified it, but could not permanently remove it.  Just prior to formatting I found and tried an older beta version http://www.softpedia.com/get/Antivirus/AVG-Anti-Rootkit.shtml and it worked!  This may not be the solution, but it's worth a try.

- Jim

[sam2004gp]

...Tried a restore to the day prior to initial possible infection (april 17), did not work in regular mode, seemed to work in safe mode, but after reboot it said "there were no changes made to pc, choose another date... hmmm?
....
Andrew

As I mentioned above.

Again, you can try a "restore point" but many viruses also disable that to keep you from going backwards.  .....

[mackbig]

I am done.... formatting my new 650 gig drive... found all my main CD's for installs....
Unfortunately I selected format nfts, rather then format nfts (quick).... and the former is not quick.

Thanks for all the suggestions, and advice. 

Sam I know you have been try to win "who will be last..." for some time... however you are the winner of the "i told you so..." in this thread.  Had I put the effort of the last few nights into installing clean xp and all my programs I would be done by now......

I stopped by tiger direct on way home from work and picked up the drive.  As the sales person was walking me to the checkout he stopped at a display... "sir, we have a special CA internet security suite, regular 99.99 on for 19.99 after rebate..... "  i stopped him cold, "that software's inability to do what it said it can do, is the reason I am buying this drive".... "oh"

Andrew

[Mark / Ohio]

Well Andrew, we can't say you went down without a battle neither.      

Regular $100 now only $20..  hmm, maybe that says something right there.      That's the trouble with all these security programs.  In the end even after we take in the product reviews and personal experiences of others, we often never really know how well they are working for us on our own computers until it is too late.   

[SlowModem]

Friday, April 24, 2009 story

Conficker virus begins to attack PCs: experts

[mackbig]

Got the important stuff done (all my weather apps, and ftp stuff). Only missed a few hours of weather, and an hour of very active lightning (but it was way off). Amazing how fast a clean pc is, and boots up

going to try AVG, so opnion is the Free version good enough?  they have a "deal" called trial pay, you get the full version for a year for free, but you need to try or buy another product.  Guess its like a time share.

So free version, trial pay, or just buy it???

Andrew

[andro700]

I use AVG personally. My wife's computer used the free version for over 5 years with no infections. I got a deal with AVG Internet Security a 3 PC license for 49.99. I have no complaints using AVG whatsoever. 

Try the free version for a while to see how your computer runs and if you like upgrade to the pain version.

When I repair and clean computers I install the free version of AVG.

Of course this is my opinion.

Chuck

[sam2004gp]

Got the important stuff done (all my weather apps, and ftp stuff). Only missed a few hours of weather, and an hour of very active lightning (but it was way off). Amazing how fast a clean pc is, and boots up

going to try AVG, so opnion is the Free version good enough?  they have a "deal" called trial pay, you get the full version for a year for free, but you need to try or buy another product.  Guess its like a time share.

So free version, trial pay, or just buy it???

Andrew

I run the AVG Free on my 5 home machines and about 20 of my work machines.  There is no reason to go further than that, as long as you are behind a good hardware firewall.  Just do those windows updates, use FF with the Adblock Plus and Noscript extensions, download and run windows defender, turn off email preview in your email reader program, and never open email from unknown sources, and you should be good.

Once you get the machine tweaked just the way you like it... Spend that money mentioned above on a disk imaging program like Norton Ghost or Drive Snapshot; or perhaps another extra hard drive, and make a backup image of your machine.  If it gets a virus at another point at least you are already half way there with your setup.  At any given time I have at least 3 differently dated image backups of every machine in the house including the weather computer.  I then run incremental backups of all "data files" daily to an external HD for my Primary computer, the wife's computer and the weather computer.   The last time I got a virus on my main machine, my image backup was a month old, so all I had to do was reload the windows updates, and then I restored the previous days "data files".  My machine was back to where I started before the virus within an hours time.

As for my Weather Computer, besides an image backup about once a month I back up the entire VWS folder every 6 hours to the external HD.  This also makes it easy when you are wanting to mess with the innards of VWS and worried about screwing something up royally.

[mackbig]

Sam
this is exactly what I planned to do back in January.  I ghosted by disk as I thought it sounded like it was going to fail.  I just forgot about the monthly part.  I have all my daily backups as well on my NAS.   So I plan on doing it more frequently going forward, at least every time I do some major changes ....  I could have been up and running quicker had I just used the January image, but as you said clean is better, I did have tons of "use once" stuff on there.  So I will leave that image as a worst case scenario backup.  Maybe move it off site for some real disaster recovery....

I actually want to ghost my clean image that I have right now.  Its only 7 gig.  I takes so long to install windows, do all the updates, install all the drivers and peripheral stuff, so many reboots, and downloads....

I admit I am not that strong when it comes to hard disks and partitioins etc.  I know how to make a single image on another drive.  However is the follow possible... take a 750 gig drive, make 3 partitions, could I then put 3 separate images of my weather pc drive on the one drive....assuming it is about 250 gig?  I would be using Ghost.

Andrew

Once you get the machine tweaked just the way you like it... Spend that money mentioned above on a disk imaging program like Norton Ghost or Drive Snapshot; or perhaps another extra hard drive, and make a backup image of your machine.  If it gets a virus at another point at least you are already half way there with your setup.  At any given time I have at least 3 differently dated image backups of every machine in the house including the weather computer.  I then run incremental backups of all "data files" daily to an external HD for my Primary computer, the wife's computer and the weather computer.   The last time I got a virus on my main machine, my image backup was a month old, so all I had to do was reload the windows updates, and then I restored the previous days "data files".  My machine was back to where I started before the virus within an hours time.

As for my Weather Computer, besides an image backup about once a month I back up the entire VWS folder every 6 hours to the external HD.  This also makes it easy when you are wanting to mess with the innards of VWS and worried about screwing something up royally.

[sam2004gp]

Yes it is possible to do the three partitions, but if that drive fails then your back to square one.  You should at the least have the image on a separate drive, preferably external or such.  Then as more precaution, you should make copies of that image to dvds, in case you have a major hardware malfunction or electrical issues.

[racenet]

Sam,

What do you use to make your backup's onto CD's/DVD's across multiple disks? I haven't found anything I really like for that job & I'm open for suggestions.



Bob

[sam2004gp]

Racenet, I use Cobian Backup
http://www.educ.umu.se/~cobian/cobianbackup.htm
...for my VWS backup and other backups on my weather machine; every 6 hours and I just back those up to another Hard Drive.   


For my image backups I use an older version of Norton Ghost. 
http://www.symantec.com/norton/ghost
In Ghosts setup I created a settings file that parses the image backup files into 630 Mb sized files. With this I can burn it to CD or mutliple files to DVD, manually with Nero.

For incremental "data backups",  I use a free "lite" version of Retrospect that came with a replacement harddrive.  It will span data across cds, dvds, and tapes.
http://www.retrospect.com/products/software/retroforwin/

[mmorris]

A router should be your first line of defense even if you only have one computer and you might have to turn on some of the security feature as some are not on by default. Software is good for the second line of defense. Third line is you..   

[mackbig]

Well its been almost a week now... 

"new" pc is running perfect. All that crap installed and de-installed over the years sure does slow down a pc.   I now have lightning fast boots, and have completed installing all my non weather apps, drivers etc. Kind of like spring cleaning after 3 years.

Went with AVG free version, no resource or conflict issues with my weather setup so far.  Have malewarebytes on there as well.   Got all the ms updates, and service packs prior to wx install.  and have two clean bootable images, one stored offsite.   And the usual nightly backups going to NAS.

Thanks again for all the assitances and comments.

Andrew

[sam2004gp]

....

Thanks again for all the assitances and comments.

Andrew

That's what we are here for.

[mackbig]

Well its the one month anniversary of my re-imaging my pc....

Found this out the hard way.  I went on CWOP to check my data.... no data. hmmm.  Why did I not get a quality control report.  Last one was May 2nd???   Well after getting these quality reports for years, and there never being anything worth noting on them, I guess I stopped reading them altogher.  So between April 27th and may 2nd, I did not even read the "no data" ones... .Doh....

I know I re-setup vwsaprs and tested it... but somewhere in all the boots and reboots that windows does after a clean install, it was removed from my startup... well that is the guess.  I am at work right now, so its just a guess.  Oh well its only a month.... maybe I should wait till June 1st to restart, so it just looks like May never happened.

On the positive side, computer is running perfectly.  I have 2 clean images (one base install with just weather stuff, and one monthly image of everything) and my normal nightly NAS backups. 

Moral of the story, dont get complacent with qc emails...sometime they actually mean something.

Andrew

[mackbig]

hmmm?  I got home and sure enough vwsaprs was open and working. I checked my cwop again, nothing, I checked the findu link on cwop page, nothing.  I clicked on the findu link in vwsaprs, tons of data...every 10 minutes since 1pm April 25.   Was just about to email philip, and kazaa.

the config file for vwsaprs is hidden somewhere.  So when I restored my weather data to the "new" computer a month ago, it was the only program I had to re-configure, all my other software was fine (vws, nexstorm, wasp, etc).  So I did my gps coordinates (painfull as you can not type it in, you need to use up/down arrows) and put "my" cwop code in.  Clicked the upload button. Sent fine.  Clicked the check data button, saw the data there.   Then went on to other things....yes I still totally missed the QC emails telling me no data was being recieve.

So after further investigation, it turns out I keyed the cwop ID wrong. So my data was going to a defunct ID in a different city, in Florida no less.  oops.  Its too bad there is no authentication at all for cwop uploads... it would prevent accidental stupidity like mine.  Well at least I did not ruin an active members data.   I guess I should report this to Philip so he can potentially scrub the "bad" data that was sent over the past month.

Andrew

[DanS]

Knowing the incorrect CWOP ID is there any way the CWOP folks can go in and retrieve that data? Or since it's an assigned user it all vanished?