computer update

[seventhe]

I've been running Spybot almost non-stop (alternating between Safe Mode and a regular boot), and I've removed almost all of the malware. A couple of the things seem to keep coming back, even though a run of Spybot will claim to have removed/"fixed" all of them. I'll even boot to Safe Mode, run Spybot and have it give my computer a clean bill of health, but then the next time I restart the computer, the shit is already back on there.

What keeps showing up is PWS.LDPinchIE, Smitfraud-C.gp, and Win32.Qhost.abh. I've already googled them all, and they look like really horrible terrible things that are going to be a real pain in my arse to remove and it kind of makes me want to cry a little bit. In all honesty I'm thinking of just saying screw it and going for the total reformat... although I'm afraid that they'd fucking stay in my registry.

That's the problem -- they seem to be in my registry files. And there's one thing in the Smitfraud virus that Spybot can't seem to remove, at all. There's a Smitfraud removal program available for free on the internet but forgive me if I'm a little nervous right now about just Googling and downloading shit without knowing whether it's kosher.

Here are the other indicators I've got going on:
- The computer takes an extremely abnormal time to log in after I put in my password. (Both in Safe Mode and regular boot)
- Sometimes when I restart the computer (normal mode) I have no desktop icons or anything. I have to go in to Task Manager, terminate Explorer, and then re-run Explorer to get my desktop to load. After I do this, though, my desktop [icons, toolbar, etc] loads normally.
- I continually get the Windows prompt telling me "No connection to the Internet is currently available [work offline] [try again]" -- without me doing anything connected to the internet. So something is still running in the background and attempting to connect to the Internet.
- IE does not run. I try to open it and a window pops up, but the program immediately closes.
- The computer isn't connecting to the Internet. I gave in and plugged it back in, hoping that I could install AdAware (and some of the other virus/spyware links I had) and then disconnect it -- but the computer couldn't get onto the internet at all. IE closes instantly after I open it, and Firefox cannot connect. (The modem seems to be fine because the laptop can find the wireless - hence this entry - although I've been disabling the wireless every time I try to plug in the other computer. Anyway, I don't think it's the cable.)
- All the problems the damn thing has been finding are in the registry. I think this is why they keep reinstalling.

Anyway. Things are much better... but the computer's still pretty unuseable. Without Internet I cannot even install AdAware. Tomorrow I'm going to move on to some other free spyware/virus software in the hopes that (a) it will agree to run off of a CD and (b) it might be better. I've got a set of links saved in my browser on this computer that I'm hoping will help. Next step is to purchase a Norton Badass AntiStuff Kit and kick the computer's ass with that. After that I might just throw myself out the window.

Comments

[shanaqui]

I definitely recommend Unhack Me. It's pretty brutal and so far has not had trouble removing any of my nasties, it runs before your computer starts booting anything up, it gets stuff that no other program can even find, and it's never failed to remove something in my experience.

Risks you run: if the nasties are deeply entrenched, it may rip holes in your operating system. This hasn't been a problem for me, but someone else complained of it. Personally, I'd go for it at this point, but me and my dad were confident of our ability to build my system back up and recover files.

[first-seventhe.livejournal.com]

That's not a bad idea... especially if my alternative at this point is a total reinstall, which would wipe anything anyway.

[shanaqui]

It's also easy to use, evaluates things for you, and my computer geek dad almost had a love affair with it when he first found it. So yeah! I recommend using that, at least at first, because it's less risky than going in there and trying to do the same thing yourself.

[first-seventhe.livejournal.com]

Now if only it will run off of a CD, I might have to marry it.

[heyheyrenay.livejournal.com]

Man, this sounds pretty much what happened to me the first time spyware buttraped my Windowx XP. I had to reformat and after that I pretty much, uh, never used IE again. At all. Ever! IT IS NOT WORTH IT.

Then I bought a Mac and I have never had a virus.

Um. If you can't solve the problem, buy a mac? >.> I mean, at least consider it before throwing yourself out a window. >.>

[first-seventhe.livejournal.com]

Haha, tell this to my "I DON'T NEED YOUR TRENDY INTERNET TOYS, IE IS FINE" boyfriend. >.>

I gave him the Firefox talk last night. "Look, honey, I know you don't really care, but all these websites say that Firefox is way more secure than IE, so maybe in the future, you could try to use that?"

guess who was browsing the computer when IT happened. hint: wasn't me.

[owlmoose.livejournal.com]

You can't uninstall IE from a Windows machine, but you can hide it -- take the icons off the desktop, out of the toolbar, out of the applications shortcuts in the Start menu, etc. -- and make Firefox the default browser. Maybe if he has to work too hard to find IE, he won't use it. We did this at the school where I used to work, and it cut down on virus problems a thousand percent. (Of course, after the change was made, I can't tell you how many students sat down at the computer and called me over after sitting and scratching their heads for 15 minutes. "Where's the Internet?")

[first-seventhe.livejournal.com]

Y'know, that's a good point. If I can get this machine back up and running, I'm taking IE off of everywhere I can find it.

[venefica-aura.livejournal.com]

Help removing registry keys? Particularly This bit.

You can do it. Don't give up hope. It can be beaten. Though this appears to be a mutated version of what I dealt with. Egads.

And some free software:

Spybot Search & Destroy

[first-seventhe.livejournal.com]

Spybot is my BABY so far. Seriously, that thing took out almost everything on there. Props, Spybot. Serious props.

[itsbuttery.livejournal.com]

Adding to the recommendations: HijackThis. While it's spyware/malware related, it's less a hard drive scanning program as it is a startup/registry scanning one. It's probably the best way to make absolutely sure nothing is opening in the background when Windows starts that you don't want it to (best run it in Safe Mode, of course).

It's also extremely dangerous just because of how easy it makes it to delete anything set to start when Windows does, so be careful with it.

[itsbuttery.livejournal.com]

Oh! Here's a handy tutorial, actually. With this, you'll be in a lot less danger of screwing up your PC further from wrongly deleted stuff with HT.

[first-seventhe.livejournal.com]

Oh, SWEET. Hooray tutorial. People were making me nervous. I'm a total computer moron!

[rosencrantz.livejournal.com]

We also have a manual registry removal program on our computers, too. They're *ultra dangerous* to use if you accidentally delete the wrong thing, but if you can get one up and running you can punch on through and remove the malware registry keys fairly easily. Just be 100% sure it's the bad file(s) only you're taking out if you use one of those programs.

[first-seventhe.livejournal.com]

I've got the addresses of the "bad" registry keys written down at home (I was hoping some program could "quarantine" them or something, but apparently all this freeware needs to be installed WHILE connected to the internet... bitches), so. I'm just worried because... shit, I don't even know what the registry is. The only thing I know how to do with it is go in and find my Adobe Photoshop license key so that if I have to reinstall my pirated copy on another computer, I have it. Srsly, computer retard here. So how do I know if they're important? Or can I just delete them?

[rosencrantz.livejournal.com]

Remember your first post about viral bullshit on your computer? Somebody gave you a link to "what file is this?" where you type in a filename and the website spits out what it is and whether or not it's important.

Basically, use that website to test the filename you want to delete. If it says "Oh hey this is a crucial file to running your operating system" that means whatever malware you had corrupted an important registry key, and you're SOL. Your best hope is either to hope Norton can repair registry files and/or reformat (bleh).

If that website spits out a "what the hell is this?" or "hey, that's malware" then hit that delete button on your registry cleaning program without even thinking twice about it.*

*edit the 1: this might actually result in you having to reinstall various SOFTWARE on your computer, if, say, it's a registry key needed by photoshop, or mozilla, or trillian, or whatever. But re-installing software is relatively painless compared to reinstalling your OS, so hey. As long as it's not a core file? Baaaaleeetion, baby.

[first-seventhe.livejournal.com]

Okay, so here's another question. Let's say that the virus DID infect my OS and I have to reformat. I'm actually not really upset about that because both of my computers are due for a good reformatting (it's why I got the external hard drive set up in the first place - was planning on doing it in April/May anyway). Here's what I'm wondering;
(1) if the virus is "in" the registry file, and I try to copy various files over to my external hard drive (in safe mode), do I risk transferring the virus? If I copy the files over and then promptly scan the shit out of the external drive? Or are ALL my files SOL if I can't get rid of the virus?
(2) If I reformat, will that DEFINITELY get rid of the little bitch?

Answers, and a bit of a scolding because you ain't listenin', girl!

[rosencrantz.livejournal.com]

Alright, first off: your computer's "registry" is just a bunch of keys which should make you able to run certain programs. You know this already because you use one to "unlock" (cough) your version of photoshop. Theoretically, viruses shouldn't be able to corrupt registry keys. I say this theoretically, because I can't say with 100% certainty that this never happens. That means, if you find a bad file in your computer's set of registry keys, the chances are that you can delete it and not worry about it afterwards. But that's why I say "double check" with that "What is this file" website, to make sure you're not deleting an IMPORTANT registry key, but rather just a virus.

The second thing - about your external HD - if you want to save your files and then reformat your computer, that is pretty much the only way you can do it. Viruses need your computer to run, they can't run off of your hard drive alone. So ... you might copy the infected file onto your external HD, but as long as you don't plug that external HD back into your computer before you've put Norton Big Wall of Security on it, then you should be okay. If you plug your theoretically virus-carrying HD back into your fully-protected computer, Norton will kill the virus before it hits your computer's OS. Just remember - make sure Norton is scanning your HD as soon as you plug it into your healed computer.

Save your files to your external HD, format your computer, reinstall the system completely, get all the latest state-of-the-art firewall/virus protection shit + Windows service packs / patches / etc (same goes for your browsers), and THEN plug your external HD back into your computer. The most important thing is that you do the reformatting / reinstallation of your computer COMPLETELY OFFLINE, install Norton COMPLETELY OFFLINE, then get the service packs / Norton virus updates ONLINE (*while* your firewall is up), go OFFLINE AGAIN, install everything completely, and THEN plug in your HD and scan it. WHILE YOU'RE OFFLINE!

I can't stress this enough: 90% of what you do should be offline. Period. The only point in time you should be going online with your computer in this process is to get the security pack and viral updates. Other than that, make sure you are completely disconnected from the internet until your computer is 100% working again.

Reformatting, even repartitioning your HD, will "cure" your computer for 100% sure. A virus can't physically change your hardware and all what reformatting is is wiping your hardware completely clean. If it doesn't work for some reason, either

A) you connected to the internet before it was done, you bad girl
B) you didn't install Norton / didn't get the latest updates before you connected to the internet, you bad girl
C) it's a virus the rest of the world has never seen the likes of before yet and we should all panic

Okay, one last recap:

#1 Priority: Norton Internet Security 2008 on a disc. Like, yesterday.
#2 Priority: Work OFFLINE. OFF. LINE. No free stuff downloads to 'hope' you can cure your computer. Bite that bullet, work OFFLINE!

Re: Answers, and a bit of a scolding because you ain't listenin', girl!

[first-seventhe.livejournal.com]

Hey, I had a friend over who was like "don't buy anything, this free stuff should be able to fix the problem, or at least try it first before you go pay a lot of money for that crap." Blame him! XD

And it never really reconnected to the Internet anyway. Which was pretty sucky overall.

Re: Answers, and a bit of a scolding because you ain't listenin', girl!

[rosencrantz.livejournal.com]

Kick the crap out of your friend. In theory you should have gone out to the store and bought Norton before doing anything else. The free stuff works well if you can access it safely, but by definition when you have shit on your computer you can't access *anything* on the internet safely. Even if you were to reformat *right this instance* you *still* couldn't access the internet safely afterwards.

2009 you might have options, when your Norton license expires, as long as you shopped for good freeware before then. Right now, though, I'm afraid you gotta spend the money on a commercial product.

Or make your friend spend the money on a commercial product for you, since he gave you jacky crap advice. ;P

Re: Answers, and a bit of a scolding because you ain't listenin', girl!

[first-seventhe.livejournal.com]

HAHAHA. I'M SURE THAT WOULD GO OVER WELL. XDDD