My computer has a virus... but.. has it, really??

[dehro]

some background to the current situation:

my PC is equipped as follows:
Microsoft Windows 7 Home Premium
Versione 6.1.7601 Service Pack 1 Build 7601
Produttore SO Microsoft Corporation
Produttore sistema Hewlett-Packard
Modello sistema p6610it
Tipo sistema PC basato su x64
Processore Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz, 3200 Mhz, 2 core, 4 processori logici
data BIOS American Megatrends Inc. 6.12, 12/07/2010
SMBIOS 2.6
Directory Windows C:\Windows
Directory System C:\Windows\system32
and I mainly use it for work, plus a couple of outdated, but still current to this setup, games (cheap games like Drakensang or the first Witcher)

spoilerised for wall o'text, for which I apologise
last friday it crashed badly.. the keyboard started to be all over the place, the whole thing started to be sluggish and when I shut it down to reboot it didn't turn back on again, freezing on the windows logo.
so I tried fiddling around and managed to get to the HP backup manager, which let me put together a backup (which took the better part of a day to download on an external HD).
I realised that whatever went wrong might end up saved together with the backup, but not having made one in too long a time previous to the crash, it seemed the only option.
Once I had the backup, I formatted the PC back to factory settings, windows and almost nothing else.
it took me the entire weekend, but I managed to re-install most of what I had lost, software-wise and all of my data, which in no small part I had on a separate netbook as well.
all of the software (mainly office, a few games, and a few graphics tools) are either original or opensource.
I also reinstalled the antivirus (AVG, which is now in trial version, so complete with all the other tools) and scanned the system completely, finding nothing before and after having "unpacked" my backup files.

the only exception to having everything original and so on is Adobe Acrobat, which I downloaded the trial version of from a p2p source instead of the adobe website. I did this about a week before the crash, and did the same on my netbook, which has not crashed nor shown signs of trouble.
since that didn't affect my netbook and after multiple scans didn't seem infected with anything, I installed it again after the reboot.

now, to the two problems I'm experiencing:
1)at some stage during my re-installing of several smaller softwares (such as, for instance dropbox, google drive and a few other small things) my computer decided I didn't have the authority to install stuff (despite my account having full admin privileges and despite having previously installed those very same softwares without a hitch). the only way for me to solve this was to run the install files "as administrator" with programmes such as Dropbox warning me that this may cause issues to the software's correct functioning.
is this just a new default situation?

the more serious one
2)going through my various dvds and stuff, I decided to try and install all my older games to see which ones still run on the current system and which ones to do away with.
now, some games installed, no problem, some said they weren't compatible with a x64 computer, but several of them gave me quite a lot to worry about.
as I try installing them (and we're talking about legit DVDs that are easily 10 years old) AVG lights up like a christmas tree and warns me that the virus
WIN32/HEUR has been detected, making me abort the installation.
now, this virus, I believe, wasn't even possible back when those games were created.. also, this is the only occurrence of the virus (me trying to install old stuff).. when I scan the whole thing, AVG, the same antivirus that warns me about it, doesn't find a thing.
reading up on it, I find that it's a rather sneaky one which however seems easy to find and remove.. either manually (but no sign of the virus turns up where it's supposed to be) or through download of one or the other (trial) programme.. I've installed 2 of them and both claim to have fixed the issue, if issue there was.. then of course they suggest I sign up and pay for the software's full package to tweak and fix other things on the 'puter... they all say that...
I have uninstalled both of them after they supposedly fixed the win32-heur issue.
today I tried installing.. uhm.. I believe it was heroes of might an magic 3.. a 14 yo game.. and bingo, AVG lights up again, for the same virus.

what gives? the internet says it's a rather serious virus, very good at hiding..which may well have caused my initial system crash and is liable to cause more damage.. yet when I try to look for it outside of the "alerts on installation" nothing turns up where it's supposed to.
more importantly, I seem to be unable to find a website where this is discussed and where the solution isn't "download this, it should fix it".. which after having tried it twice, makes me think that whoever replies like that is just trying to plug his own software, whether it solves the issue or not.

[Grinner]

Where did you buy these games? I once bought a game off the internet and had this very same problem. I ended up installing it into a sandbox, scanning it with multiple scanners, and concluded that the alert was a false positive.

As for the initial failure, it's possible that the previous installation had developed a few bad sectors, corrupting critical data.

If you feel up to it, install one of the older games into a sandbox, install a couple of scanners (maybe Malwarebytes and Kaspersky), and get a few second opinions.

Edit: Also, run SCANDISK.

[dehro]

I most likely bought them in a supermarket, mall or gaming shop, but I don't really remember.. as I said, most of those games are at least a decade old.

[angrymudcrab]

The running as administrator part of reinstalling might just be from having UAC turned on. By default, 7 will make you explicitly confirm that you want to do something as an administrator, which wasn't necessary in xp and earlier. It is a security feature and can cause mischief with with older software that wasn't written with UAC in mind. You can turn it off in the control panel under user accounts and selecting "Change User Account Control Settings".

More detailed instructions on how to shut off UAC here. (http://windows.microsoft.com/en-us/windows7/turn-user-account-control-on-or-off)

For your second problem, since the game is a legit copy it is probably a false positive. AVG can apparently be apparently somewhat overzealous (http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=14461) at times. Does it say what the name of the exe it is complaining about is called? That might give you some more info to search for. Assuming it is a false positive, you will have to whitelist the game in avg or it will keep trying to get rid of it.

EDIT: You should keep UAC turned on until you are certain it is a false positive.

[dehro]

The running as administrator part of reinstalling might just be from having UAC turned on. By default, 7 will make you explicitly confirm that you want to do something as an administrator, which wasn't necessary in xp and earlier. It is a security feature and can cause mischief with with older software that wasn't written with UAC in mind. You can turn it off in the control panel under user accounts and selecting "Change User Account Control Settings".

More detailed instructions on how to shut off UAC here. (http://windows.microsoft.com/en-us/windows7/turn-user-account-control-on-or-off)

For your second problem, since the game is a legit copy it is probably a false positive. AVG can apparently be apparently somewhat overzealous (http://forums.avg.com/us-en/avg-forums?sec=thread&act=show&id=14461) at times. Does it say what the name of the exe it is complaining about is called? That might give you some more info to search for. Assuming it is a false positive, you will have to whitelist the game in avg or it will keep trying to get rid of it.

EDIT: You should keep UAC turned on until you are certain it is a false positive.

I did solve the UAC thing just the way you outlined.. the odd thing is that the issue came up with very recent software that I had first installed within the last couple of months.. but didn't need to do as admin the first time around. by which I mean that yes, it did ask that I confirm through the fuzzy admin screen, but it didn't actually..not work unless I started out as admin..
not sure I'm making myself clear here..anyway, not much of an issue there.

as for the old games.. yes, every time, the issue is declared as being with the install file or setup file of the game or software. I'll have a look into the whitelisting thing.. since I'm pretty sure that those copies were legit and they never gave me a problem all those years ago
we're talking 10 to 20 years ago, which is why half of them don't run simply because they're just too outdated.. and then you have oldies like rage of mages or an NHL game, both from the nineties, that still work)

come to think of it, I might just turn up the UAC again and see if AVG is still gonna be snippy about those games...

[angrymudcrab]

Hmm, that is odd. Turning UAC on again probably won't affect AVG's false positives. The value of UAC is to prevent programs from running/installing without the administrator's permission/knowledge.

[Rosstin]

I would back up the stuff you care about, run a complete wipe using DBAN (http://www.dban.org/) and then reinstall the OS from scratch.

This is a nuke from orbit solution I admit, but it does always work.

[angrymudcrab]

I would back up the stuff you care about, run a complete wipe using DBAN (http://www.dban.org/) and then reinstall the OS from scratch.

This is a nuke from orbit solution I admit, but it does always work.
That might be problematic if he doesn't have an install disk. Some computers have a separate partition with the install data on it and use that to do reinstalls. Besides, I think he already did a reformat of the main partition at least.

[dehro]

That might be problematic if he doesn't have an install disk. Some computers have a separate partition with the install data on it and use that to do reinstalls. Besides, I think he already did a reformat of the main partition at least.

this.

Indeed windows came pre-installed and I don't have the disk.. also, HP has indeed a partition which is where I did the reformat from.
I'm not completely IT-illiterate, but I'm not sure enough in my computer-fu to wipe the machine completely. The last time I did something like that was back in the day of Windows 3.1...
anyway, everything I need, and a fair number of the things I want but not necessarily need, seem to work, except for that couple of old games that flagged the virus thing.. so I'm going to cross my fingers, perform a few more scans and hope that it is indeed a case of false negatives.

that said, I'm skint enough not to really want to spend money on troubleshooting and "fixing" software (beyond the antivirus, which is free anyway and has never betrayed me before).. so.. does anybody know a decent free software to do those small tasks like debug, scandisk, defrag, deleting obsolete or rerouted files and such??
I could do all those things manually of course, which is probably the best way anyway..but there's something comforting in having a small popup now and then telling you that something somewhere has solved a few problems for you that you didn't know you had.. :smallamused:

[Rosstin]

I could do all those things manually of course, which is probably the best way anyway..but there's something comforting in having a small popup now and then telling you that something somewhere has solved a few problems for you that you didn't know you had.. :smallamused:

Haha, this is an interesting perspective. It's interesting to see another, more trusting, point-of-view. Myself, those kinds of pop-ups always make me nervous. I hate it when things are going on in the background that I don't know about. I'd much rather run a scan manually than have an always-on software constantly running processes and doing mysterious things.

I'm a big fan of Mac because I'm not required to be running AVG antivirus constantly.

[factotum]

WIN32/HEUR means it's not actually a virus--it's AVG recognising virus-like behaviour (the HEUR means "heuristics"). Chances are this is nothing malicious, it's just your games are so old that they're doing stuff in their installers which is considered dodgy in this day and age.

[angrymudcrab]

You are probably better off using the built in tools for those. The problem with things running in the background it that they are memory and processor time being spent on something you aren't focusing on. So if you are playing a game that is less resources available for the game to use. It looks like you have a fairly good setup hardware wise, but I hate spending resources on things running in the background without good reason. That said it is kind of a personal quirk, ymmv.

I tend to follow Aster Azul's method for solving my Windows problems(I learned about having no install disk with an install partition the hard way when I was a kid, hence my caution), so I don't really have any names for you. But in general, open source software is good and won't have attached viruses. That said, a lot of the projects are aimed at GNU/Linux not Windows. A good preventative is to use Firefox with the noscript and adblock addons(though be sure to whitelist comic sites like this one). The amount of things I had popping up on my monthly scans dropped like a rock once I started using noscript.

[Winter_Wolf]

WIN32/HEUR means it's not actually a virus--it's AVG recognising virus-like behaviour (the HEUR means "heuristics"). Chances are this is nothing malicious, it's just your games are so old that they're doing stuff in their installers which is considered dodgy in this day and age.

Echo that.

Older games give hell to new OSes. Win7 in particular, but at least it's usually fixable. Unlike Vista, which caught hell and never had decent solutions, unless you counted downgrading to XP. :smallannoyed: Sadly things like UAC are pretty necessary unless you want to go through the whole paranoid watch everything like a hawk control freak routine (which I do anyway). Tropico 3 and BG2 gave me hell until I turned off UAC and rebooted my computer.

[factotum]

Unlike Vista, which caught hell and never had decent solutions, unless you counted downgrading to XP.

Actually, the solution to older games in Vista was extremely simple--don't install them in Program Files! You could just create a folder (say, C:\Games) with appropriate permissions and use that as the base folder for all your game installs--that way UAC woudn't care overmuch what happened in there.