Antivirus XP 2008 (It's a virus, halp!!)

[Ego Slayer]

Just found something that LOOKS like a valid piece of virus-scan software called Antivirus XP 08. It even looks like it's part of Vista. Apparently it's a virus itself, from what Google tells me and supposedly shows false or exaggerated scan results, and generally screws around.

Someone said that when trying to remove it with the free edition of AVG, it froze after 20 minutes and gave a [fake?] BSOD.

I'm trying to download spybot because I'm afraid AVG is going to die on me but every Google link I click doesn't load. It just sits there blank, looking like it's loading, the text on the firefox tab even changing.

I was going to upload a pic of what the program looks like but photobucket errors every time and I try and I imagine it has something to do with the damn virus.

HELP. :smallfurious:

[Lyesmith]

A system restore might help, if it's screwing over your other options

[Ego Slayer]

Is there a way with AVG (8.0 or something) to stop the scan and make it fix whatever it's found up to that point? I doesn't need to scan for hours to find stuff... :smallmad:

Bah. It's srsly a program. It's in the start menu and everything and has an 'uninstall' option but apparently it doesn't actually install it.

And I just noticed it ate my desktop.

[Haruki-kun]

Ctrl Alt Del, and look for the process first, using processlibrary.com

Terminate the process, and THEN run the Antivirus. some processes look like they're harmless, but they're actually viruses.

For example, Internet Explorer's process is iexplore.exe, whereas there's a vires called iexplorer.exe. Not to be confused with the OS's explorer.exe. See my point?

[Wraithy]

I had the same virus earlier in the month. I presses ctrl+alt+del whenever I started up my computer and shut it down like that until after roughly a fortnight and a few Liveupdates Norton picked it up.

Sorry if my advice is useless.

[Ego Slayer]

I'm so afraid to do anything. :smalleek: I'm waiting for two computer-geeks-by-profession to call me back.

I'm tempted to CAD it, though.

This is probably what I get for having still not backed up all my files/documents. Argh, stupid Ego. :smallsigh:

[Haruki-kun]

I'm so afraid to do anything. :smalleek: I'm waiting for two computer-geeks-by-profession to call me back.

I'm tempted to CAD it, though.

This is probably what I get for having still not backed up all my files/documents. Argh, stupid Ego. :smallsigh:

Usually it's safe to do so, as long as you check the Process Library to see what you're shutting down.

[Lyserdigi]

Well, with avg you can search specific folders only, so if you know where this buggie is located, just search those folders.. I would also seriously recommend to to scan window, documents and settings, and program files folders.. if avg can fix those for you, you should be able to download and update spybot.. after that, i still recommend doing a full scan on the system while you are sleeping. And remember, spybot is NOT antivirus software, it should be used alongside with decent antivirals. and when you install spybot, in my experience it has been a good idea not to enable teatimer. It has in rare circumstances corrupted the system registry, so that the windows needed to be re-installed.

Good plugin for firefox is 'noscript' .. by default it does not allow any scripts to be run from anywebsite, making web browsing safer and page load times faster. by default, java, flash etc content are also blocked, so different blinking ads don't load.. you can allow specific scripts from the root level quite safely.. by root i mean , for example, the root of this forum is giantitp.com. this tool makes it virtually impossible for most of the malware to run directly from webpages. a good idea also is to go to your firefox tools/options , under privacy , check 'always clear my private data...' and make sure under IT'S settings that all the items are checked.. be warned though, if you save your passwords etc. within your browser. this WILL clear those too.

Hope this will help somewhat

-L-

[Phae Nymna]

OH CRAP ITS TEH VIRUS

*ahem*

If thing begin to go over your head, contact a tech person immediately. Losing everything to a virus sucks. Badly. Trust me, "I'm a doctor"/"I know from experience."

[Ego Slayer]

Damnit! It did "BSOD."

Maybe I'll try shutting it down immediately after restarting and try scanning again. Whole hour of scanning wasted. :smallannoyed:

Okay, you know I said it ate my desktop. Well... it actually ate it. Rightclick->properties... there are only three tabs, Themes Appearence and settings. And the desktop image is what looks like a dialog box from the program warning about virus infection. What. The. Flip.

[Rawhide]

Try this. (http://majorgeeks.com/RogueRemover_d5360.html)

[Haruki-kun]

Damnit! It did "BSOD."

Maybe I'll try shutting it down immediately after restarting and try scanning again. Whole hour of scanning wasted. :smallannoyed:

Okay, you know I said it ate my desktop. Well... it actually ate it. Rightclick->properties... there are only three tabs, Themes Appearence and settings. And the desktop image is what looks like a dialog box from the program warning about virus infection. What. The. Flip.


It's a bad one... *Sigh*

Ego.... back up your important files and wipe the Hard Drive.

[Don Julio Anejo]

Start your Windows in safe mode. ONLY THEN turn off the process if it's still there. And only after that run AVG.

[Flickerdart]

Smart viruses run under inside explorer.exe and also stick stuff in the registry to bring them back. I recommend Avast! or NOD32.

If you find the file but it won't let you delete it (because it's being used by the process, and will be even if you kill and restart it) use Unlocker. The little tool kills everything using the file then deletes it, which means it doesn't have a chance to start up again.

[BizzaroStormy]

Its good to know I'm not the only one having problems with this thing. I tried to download some PSX roms and BOOM! My windows defender shows 1506 viruses. :eek:

What I did to get rid of it was start up in safe mode, ran windows defender, restarted in normal mode. I'm running another scan now but It seems to be stable.

[Haruki-kun]

Smart viruses run under inside explorer.exe and also stick stuff in the registry to bring them back. I recommend Avast! or NOD32.

I used to have Avast!..... not the best thing. Nod32 is good.

[Ego Slayer]

I can't start in normal mode anymore because the compy just randomly restarted and I had downloaded SP 3 from Windows Update, and now it doesn't start outside of safe mode.

...

This has long stopped making sense.

[Phae Nymna]

It's time, Ego. Take what you can, but let it go. *sniff* I'm here for you! *begins sobbing*

That or find the originator of the virus and give me a location. In terms of malicious revenges:

Exsanguination via Vivisection of the Carotid and Jugular > Revenge Virus

[Ego Slayer]

:smalltongue: Nah. I'll take it in Wednesday to the shop and let them screw it up the rest of the way.

Well, that's probably what I'll end up doing.

Oh noes.

I'm not gonna have webnets for days, then. Might die of boredom. :smallyuk:

[BizzaroStormy]

I keep trying to go to sites to download Nod32 but whenever I try, I sends me to some random shopping site. As well, All of my restore points are gone so that option is out the window.

[chiasaur11]

Well, it's only a matter of time till the computer warps reality.

I recommend a shotgun blast to the screen. It'll be in a better place.
By which I mean the same place, but with a hole in it.

[BizzaroStormy]

Any chance w could get some HELPFUL suggestions.

[SMEE]

You can try this:
http://www.hijackthis.de/

But it's not quite friendly to use. You run it, paste the log it generates on that text box and it'll try to tell you what is malign or not, so you can uncheck it.

[Inhuman Bot]

How vital are your files?
you could consider throwing the most importent ones onto a CD, then reseting your computer to factory condition.
The (possibly infected with a virus, remember) CD's that contain your vital files can then be used to restore them onto your computer.
A large removable drive also works.

[LiteYear]

I would highly recommend using A-Squared Free (http://www.emsisoft.com/en/software/free/) if you haven't already. I find it to be very good all-around. (although flickerdart is probably right that even if you remove the main, it will have commands to re-install itself, and those take time and effort to locate and stop them)

[TigerHunter]

http://www.windowsvistaplace.com/xp-antivirus-2008-removal-instructions-xp-antivirus-2008/spyware-removal

That's the link I gave to my friend who just got this. She hasn't tried it yet, but... might help.

If it doesn't work, I'm supposed to go over to her house and try to get it off for her. I'll let you know if I find anything that works.

[Ego Slayer]

I fought and fought and I think I won. :smallamused:

For some damned reason the computer actually started up this morning and I was able to download, run, and win with Malwarebytes! (http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html)

[BizzaroStormy]

Well...how exactly do you restore you comp to "factory condition" if you had it built from scratch? I'm running Windows XP if it matters.

[randman22222]

Nice! I've only ever gotten a virus once. I just wiped the drive and reinstalled windows for that. :smallconfused:

[Player_Zero]

Won? Huzzah!

I generally just format and reinstall windows if the slightest thing goes wrong.

Also, I reckon we should start a 'Rawhide fixes your computer' thread. :smalltongue:

[Neftren]

BitDefender has a free Virus Scan that is far superior to anything out there. Avast is good, has a firewall and other shields built in (which is why I prefer it), but for pure Virus-Squashing-Potential? BitDefender is on par with Kaspersky.

[Ego Slayer]

Hrm. This is quite weird. I still only have three tabs (theme, appearance, settings) in the preferences box. And it's only on my account. It's normal on the others.

I have a history of things being wrong with my account but not the rest of them.

Wtfzorz. :smallsigh:

[Rawhide]

Log in as a different user (must be an administrator)
Go to C:\Documents and Settings\
Rename the folder Ego Slayer (or whatever your login name is) to Ego Slayer Backup
Log off and back on again as your normal account


Note, you will have a brand swanky new profile, but thanks to only renaming the folder, you can get your data files (such as files in My Documents) from the old one.

[BizzaroStormy]

Still doesnt answer my question....HOW do you format your computer? Preferably without losing the OS since I never had the disc for it in the first place.

[Ego Slayer]

Hm. Well, if anyone is going to use Malwarebytes, repeatedly quickscan. Srsly, just do it over and over. I was scanning from someone else's account, but after I scanned my own it found 7 more infections, including the lack of desktop options. So that's fixed.

And I thought you do need a disc to restore the OS. :smallconfused:

[Castaras]

Sounds sorta like what happened to my comp Ego.

If you feel brave, go to Start - Run, and type in Regedit.

There you can edit the registry which got rid of the Desktop and Screensaver tabs.

Can't help that much though. Got Dad to do that part for me, after I eliminated all the files I could find.

Edit: Ah, you solved the lost desktop options. Nevermind. :smalltongue:

[Ashtar]

Still doesnt answer my question....HOW do you format your computer? Preferably without losing the OS since I never had the disc for it in the first place.

Formatting your computer and keeping the OS are two mutually incompatible options. You format your computer to remove everything (including the OS).

[Neftren]

Well...how exactly do you restore you comp to "factory condition" if you had it built from scratch? I'm running Windows XP if it matters.

Technically if you built it yourself, you probably bought a copy of Windows XP OEM edition? If you don't have the disks and you built your computer after 2002-ish, you could probably generate a bootable CD off your computer. Or try to find the person you got the disks from. Or find the IT guys at wherever you work (if there is an IT guy) and get the disks off him. Then reformat your hard drive. If you don't know how to do it within the DOS prompt or in the BIOS configuration, refer to this (http://www.cyberwalker.com/topic/45) link. Then do a clean reinstall with your disks. Remember that if you reformat, you essentially wipe your hard disk clean.

@Ego: If you can get into Windows, I highly recommend downloading BitDefender Free Edition. It's the top rated virus scanning software next to Kaspersky and it'll find anything that went wrong, all the way down to your system root. Find it here (http://www.bitdefender.com/PRODUCT-14-en--BitDefender-Free-Edition.html).

[BizzaroStormy]

Eh, it doesn't matter anymore. I just took it to the guy that made it and had him wipe it and reinstall Windows. Now I begin the long process of reinstalling and patching all my games.

[TigerHunter]

http://www.windowsvistaplace.com/xp-antivirus-2008-removal-instructions-xp-antivirus-2008/spyware-removal

That's the link I gave to my friend who just got this. She hasn't tried it yet, but... might help.

If it doesn't work, I'm supposed to go over to her house and try to get it off for her. I'll let you know if I find anything that works.
TigerHunter: 1
Antivirus XP 2008: 0

Yeah, just run Malwarebytes. Kills it dead within five minutes.

[Neftren]

Ugh. Now it's my turn to come under attack by rogue viruses.

BitDefender nailed most of them. However, it didn't get rid of the Spyware/Adware.

[TigerHunter]

Ugh. Now it's my turn to come under attack by rogue viruses.

BitDefender nailed most of them. However, it didn't get rid of the Spyware/Adware.
http://www.malwarebytes.org/

[Neftren]

If only I could access Firefox. I'm getting a wierdo system lockup after login.

[TigerHunter]

If only I could access Firefox. I'm getting a wierdo system lockup after login.
Can you download it off of another computer, put it on a flash drive, and transfer it over? That's what I had to do in order to fix my friend's computer.

(Get any important files off the flash drive first and reformat it afterwards.)

[Neftren]

Yeah I just did that. I think I'm mostly stable, except for this one spyware that keeps coming back. Trying to find the registry root so I can terminate it for good.

[TigerHunter]

Yeah I just did that. I think I'm mostly stable, except for this one spyware that keeps coming back. Trying to find the registry root so I can terminate it for good.
Googling its exact name will usually give you a site with a list of the files the virus is associated with and should be deleted.

[Neftren]

Googling its exact name will usually give you a site with a list of the files the virus is associated with and should be deleted.

It's not the file name that's the issue. It's the fact that it's buried itself into my registry so that it continually reinstalls itself after it gets deleted.

[TigerHunter]

It's not the file name that's the issue. It's the fact that it's buried itself into my registry so that it continually reinstalls itself after it gets deleted.
It should show you which registry file to delete, though.

/shrug

[Neftren]

Except that if it's gotten into the System32 files, I won't be able to slice it out.

[Samiam303]

Weirdly, I'm coming back from the dead to mention that I got the exact same virus a day or two ago. I wonder what the connection is. Glad to hear that program worked for you, it's the same thing that I was recommended but I haven't had time to deal with it yet. I got it in XP instead of Vista, so I've just been suffering through using Vista instead of XP while I put off dealing with it.

[Cobra_Ikari]

I had this virus earlier in the year. I ended up having to wipe my computer and reinstall, since it tore up things to the point that I could no longer run executables. Good luck.

[Neftren]

Weirdly, I'm coming back from the dead to mention that I got the exact same virus a day or two ago. I wonder what the connection is. Glad to hear that program worked for you, it's the same thing that I was recommended but I haven't had time to deal with it yet. I got it in XP instead of Vista, so I've just been suffering through using Vista instead of XP while I put off dealing with it.

oh no this virus is on my XP machine. My Vista machine is safe.

[phoenixineohp]

My family got hit by this one too. And my dad fell for it and bought the software before realizing the hook. So cancelled credit cards etc later.... I got a program I like called spy sweeper and it took it off. We run xp not vista and we also found that it kept disabling our firewall option. Annoyingly efficient little bugger.

[TigerHunter]

My family got hit by this one too. And my dad fell for it and bought the software before realizing the hook. So cancelled credit cards etc later.... I got a program I like called spy sweeper and it took it off. We run xp not vista and we also found that it kept disabling our firewall option. Annoyingly efficient little bugger.
Imagine if we could redirect the energy people put into making these things into something more positive.