1. DLP Flash Christmas Competition + Writing Marathon 2024!

    Competition topic: Magical New Year!

    Marathon goal? Crank out words!

    Check the marathon thread or competition thread for details.

    Dismiss Notice
  2. Hi there, Guest

    Only registered users can really experience what DLP has to offer. Many forums are only accessible if you have an account. Why don't you register?
    Dismiss Notice
  3. Introducing for your Perusing Pleasure

    New Thread Thursday
    +
    Shit Post Sunday

    READ ME
    Dismiss Notice

Computer is Screwed 6 ways from Sunday, Advice?

Discussion in 'Tech Support' started by Ched, Oct 30, 2009.

  1. Ched

    Ched Da Trek Moderator DLP Supporter ⭐⭐

    Joined:
    Jan 6, 2009
    Messages:
    8,378
    Location:
    The South
    My computer is completely run over by spyware and crapware and fuckyouware and malware and adware and whatever-else-they-call-it-ware right now. It is most emphatically NOT COOL.

    I'll summarize what's going on in the hopes that someone can assist me.

    Around lunchtime today I noticed that I was getting pop-ups (I mentioned this on DLP's IRC at the time actually) I have a pop-up blocker so this was abnormal and I ran CCleaner (not a spyware or virus catcher, I know, but it's a very quick thing to do first). It worked. Then I tried to run Malwarebytes' Anti-Malware and it had an error.

    About this time I noticed that a Anti-Virus/Mal-ware program I'd never seen before was informing me that my computer was inundated with viruses and malware. Now I'm pretty informed on what I put on my own computer and I didn't recognize this thing so I immediately assumed that whatever virus I had was mimicking an anti-virus program in order to screw me.

    I was right. I google'd the infection that it told me I had instead of clicking on anything and it turns out that -- lsas.blaster.keyloger -- looks and acts like a fake anti-virus program. I was glad I had been skeptical.

    So my AVG Anti-Virus program isn't working any more than Malwarebytes was, so I google how to get rid of this POS thing on my computer and end up downloading SpyDoctor or something. It finds things on my computer but insists that I pay to remove them. I uninstall this.

    I download a new virus program called IObit Security 360 along with an updated version of AVG and Ad-Aware. I install things. I have to restart my computer to use them but my computer decides to restart itself.

    This is when it gets really bad. Upon getting back into my computer I notice first of all that my wallpaper is gone and replaced by a pure blue background.

    Then I noticed that 90% of .exe programs simply WILL NOT RUN. This includes all of my security software. Hell I even tried to open the task manager and my damn computer fake-anti-virus-but-actually-a-virus thing informed me that the Task Manager was attempting to send my credit card number off somewhere (bull shit) and so it stopped it for me. It does this for everything ending in .exe that I tried with the exception of firefox/IE.

    So I can't seem to run anything. Or if they are running I can't see them so I assumed it closed them. And I can't check the task manager either.

    I looked up a way to remove this crap manually but I can't find the files it mentions and I can't stop the processes because I can't get into the task manager. So apparently I can't remove it manually either.

    I re-started, hit F8, and ran Windows in Safe Mode (I have XP by the way). The virus thing does not plague me here. I installed the software I couldn't get to install earlier (there was one or two) and I run Ad-Aware (which is a POS because it didn't find anything), the new IObit software (which finds 6 things), AVG command line scan (which found something), and CCleaner. I fix/remove everything these guys find.

    I restart my computer in normal mode intending to do all this again (I know running scans in safe mode isn't that effective but I had hoped it found enough to help me get things started in normal mode) but I am right back where I started.

    I install a few of these programs on my flash drive using a computer in the library (where I am now) and try running from those, but again no luck.

    Does anyone have any ideas? I am in the library right now writing this, but I *think* I will be able to access the internet from my computer when I get home. It was letting me earlier just constantly giving me pop-ups and that stupid fake-security thing telling me my credit card is heading out to parts unknown via every program on my computer. (this is constant and very irritating). I also saw online where someone had this and even SAfe Mode ceased working -- so I am concerned.

    Ideally I could find a program that does nothing but remove this crap and can do it from Safe Mode, but that might be wishful thinking. I have a little time to google in the library before I have to leave.

    Help would be appreciated. Also, I thought about just... re-formatting or whatever and starting over. However I'm not sure if the CD that this computer came with can fully re-install Windows. Don't you sometimes just get... a CD that doesn't do that or something? I don't know, but I heard you can't always count on that.
     
    Last edited: Oct 30, 2009
  2. Johnny Farrar

    Johnny Farrar High Inquisitor

    Joined:
    Mar 14, 2009
    Messages:
    521
    Location:
    In front of a Computer.
    Get rid of the AVG and SpyDoctor. Try Avast and Spybot, both are free and pretty decent. After you install Avast, schedule a boot time scan for the computer that should take care of the viruses.

    If this doesn't work, try re-installing windows. If your computer came with a Windows-XP CD then you can easily do that, if you do not have any data to lose.
     
  3. Ched

    Ched Da Trek Moderator DLP Supporter ⭐⭐

    Joined:
    Jan 6, 2009
    Messages:
    8,378
    Location:
    The South
    I have most of my data backed up, but I am not sure if I have the correct CD to allow me to re-install. I will have to find it first I guess.

    Boot Time Scan -- got it.

    I haven't tried Avast but I have tried Spybot and remember being unimpressed compared to Malwarebytes. I am getting it again though in hopes that something will offer a boot-time scan. That's a brilliant idea I just have to find a program that does it, and apparently that's Avast. Awesome! *goes to try this*
     
    Last edited: Oct 30, 2009
  4. Johnny Farrar

    Johnny Farrar High Inquisitor

    Joined:
    Mar 14, 2009
    Messages:
    521
    Location:
    In front of a Computer.
    I don't think Spybot offers a boot-time scan. Just install avast first, install it in the safe mode if you can't do it normally. After you finish installing you will be asked to restart when you will get a dialouge box asking you if you want to schedule a boot-time scan. Do that. After that you can try out the anti-spyware software.
     
  5. Agnostics Puppet

    Agnostics Puppet Professor

    Joined:
    Sep 28, 2008
    Messages:
    490
    Location:
    Denver, Colorado
    Something similar happened to my fathers computer a few weeks back. Almost exactly what happened to yours actually Cheddar. He ended up taking it in to have it fixed since we couldnt figure out what to do.
     
  6. Nukular Winter

    Nukular Winter The Chosen One DLP Supporter

    Joined:
    Jun 8, 2006
    Messages:
    2,216
    Location:
    Seattle
  7. Ched

    Ched Da Trek Moderator DLP Supporter ⭐⭐

    Joined:
    Jan 6, 2009
    Messages:
    8,378
    Location:
    The South
    I can't get Avast installed. I downloaded the install file in the library but when I can't do it from safe mode since it has to download something else that saves somewhere automatically.

    I can't run the exe file from normal mode to get it to work, and I can't figure out how to access the internet from Safe mode (ideas on internet from safe mode?)
     
  8. Jamven

    Jamven Headmaster DLP Supporter

    Joined:
    Nov 2, 2006
    Messages:
    1,120
    Location:
    Hunting Bullwinkle's assassin
    Did you try the "Safe Mode with Networking" option?
     
  9. Rahkesh Asmodaeus

    Rahkesh Asmodaeus THUNDAH Bawd Admin DLP Supporter

    Joined:
    Apr 3, 2005
    Messages:
    5,128
    Location:
    Atlanta
    If it were me, I'd probably say "fuck it" and format and reinstall Windows. If you don't have the Windows XP CD, I would download it. As long as you have a working key, usually found on a sticker on the bottom of your laptop or the side of a desktop, it's all legal.
     
  10. Johnny Farrar

    Johnny Farrar High Inquisitor

    Joined:
    Mar 14, 2009
    Messages:
    521
    Location:
    In front of a Computer.
    You will get two types of setup file on the net. One which downloads the setup files from an online server to install on your computer and other that already has all the requisite files.

    The latter will be of a larger size than the former. Just search it in Google.
     
  11. Richard

    Richard Supreme Mugwump

    Joined:
    Jul 5, 2006
    Messages:
    1,789
    Location:
    California
    You could also try "SuperAntiSpyware". It works for me just fine. Ad-Ware is total horseshit.
     
  12. Ched

    Ched Da Trek Moderator DLP Supporter ⭐⭐

    Joined:
    Jan 6, 2009
    Messages:
    8,378
    Location:
    The South
    I appreciate the help folks. Giving all of this a go now.

    I've got Avast running via the "Safe Mode with Networking" (thanks for the heads up about that option) to DL it (didn't stay in library long enough to read about the other downloadable file, but that's a good idea to have on a flash drive for the future) and it did the scan at Boot option so hopefully that will work.

    If it doesn't then I'll try getting Windows re-installed somewhere. Spent a good 6-8 hours last night making sure I had everything important backed up so it should be OK if I go that route.

    Thanks!
     
    Last edited: Oct 30, 2009
  13. Oz

    Oz For Zombie. Moderator DLP Supporter

    Joined:
    Jan 31, 2008
    Messages:
    9,027
    Gender:
    Female
    Location:
    Baile Átha Cliath
    Cheddar, the only way to guarantee you get rid of everything is a complete format and reinstall. After that, first thing you do is get AVG or avast, Malwarebytes Anti-Malware, and SUPER Antispyware and have them running at all times. Run light scans weekly, in-depth ones monthly, and if you're super paranoid, format and reinstall every couple of months too.

    That said, the best way to avoid viruses is common sense. Avoid visiting dodgy sites, filesharing programs like limewire and bearshare, and don't insert removable drives that you don't know exactly what is on them.
     
    Last edited: Oct 31, 2009
  14. Lord Ravenclaw

    Lord Ravenclaw DLP Overlord Admin DLP Supporter

    Joined:
    Apr 2, 2005
    Messages:
    4,372
    Location:
    Denver, CO
    This. That being said, if you want to try getting rid of stuff, run Malwarebytes from Safemode, and install Avast (run its boot-time scan, then uninstall because it's crap).
     
  15. Shezza

    Shezza Renegade 4 Life DLP Supporter

    Joined:
    Dec 12, 2005
    Messages:
    1,342
    Location:
    Australia
    I'd listen to Oz, Ravenclaw and the others. Even if you do clean everything up, there'll always be a slim chance and a nagging feeling in the back of your head that something still slipped by and the next time you go to do your banking, etc., some Russian mob is going to nick all of your details. Go to isohunt.com or w/e, download an XP disc and format/reinstall.

    Honestly, unless the stuff you have vital or hard to get, I'd leave that too. I had a virus recently, backed everything up to a USB and reinstalled- then reinfected the new OS with the USB stick when I tried to get it all back. There's always a danger of the virus spreading to your backups.

    Good luck.
     
  16. lucis

    lucis Seventh Year

    Joined:
    Jun 27, 2009
    Messages:
    291
    Presumably you need to get files off your computer. At the same time, you don't want any viri to get on to the media and reinfect your computer. Since you can't trust your computer any more, the easiest solution is to burn a Linux LiveCD (eg. Ubuntu) and use it to copy the files on to a freshly formatted USB stick or a new CD. Be sure to only copy files you recognise. Then reinstall over you old installation.

    Even then, you might still get a virus to cross over to the new installation: it might embed itself in one of your files and use a vulnerability in a program you use (eg. Word) to execute itself when loaded.

    Personally, I'd recommend installing Linux. No more viri. No more malware, etc. Fast, and contrary to popular belief, user friendly. But I'm horribly biased. So maybe just ignore me.
     
    Last edited: Nov 1, 2009
  17. Silens Cursor

    Silens Cursor The Silencer DLP Supporter

    Joined:
    Nov 23, 2008
    Messages:
    2,224
    Location:
    The other side of reality
    Having done a fair bit of anti-virus work, and having dealt with that damned 'fake-anti-spyware' a total of three times by now (when you have a job as a residence technician, you have to deal with some pretty retarded stuff), here's the way I've always dealt with it:

    1. Get into Safe Mode ASAP (you've already done this).

    2. Find the root directory where this fake-anti-spyware thing has hidden itself, and delete it from there. Typically, it insulates itself pretty deep within your system, and if you haven't already deleted the shortcut that it has, you might be able to find the root directory. One thing is for certain, and that is that your anti-virus programs will not be able to find this thing - it disguises itself as a legitimate program.

    3. Make sure that it is really gone and not just lurking in another folder or in the Recycling Bin (these things have a nasty habit of replicating). To make sure it's gone, I'd advise taking out any other folders where this thing might have taken up root. Note where this directory is (I'd advise writing it down somewhere). For good measure, delete the shortcut that it'll appear in the Task Bar or on the Desktop.

    4. Restart your computer, and load again in Safe Mode.

    5. Go to the directory where this thing was lurking and recheck to see if the thing hasn't replicated itself. If it has not, load one of the many suggested anti-virus programs and do a COMPLETE scan. Not just something quick, something that will check anything and everything. Odds are, you'll have a fair amount of shit that'll need to be deleted. Once this is done, restart your computer. If it has replicated itself, completely reinstall Windows.

    6. Open your computer up in Normal Mode, and check the root directory you wrote down. If it is empty of viruses, you are a happy man and your problems should be fixed now.

    Hope this manages to help. I've only had to deal with the replicating fake-anti-spyware thing once, and it was nasty as hell to get rid of. Good luck.
     
  18. lucis

    lucis Seventh Year

    Joined:
    Jun 27, 2009
    Messages:
    291
    If you are going to try and just remove it (which I recommend against: reinstall):

    When you find the binary, consider uploading it to: http://www.virustotal.com/
    You can find details about how it works, etc, and may find something that will help you. You'll also be helping antivirus professionals. :D

    Even if you do get it: you won't ever be sure it isn't still around. For example, viri sometimes replace libraries with infected versions... As I mentioned earlier, they can also hide in normal files. This is probably being overly paranoid, as it is unlikely your virus is that sophisticated. But just be aware...
     
  19. Ched

    Ched Da Trek Moderator DLP Supporter ⭐⭐

    Joined:
    Jan 6, 2009
    Messages:
    8,378
    Location:
    The South
    Thanks guys.

    What I ended up doing (all on suggestions from here) was getting Avast! (I forget how I managed to get it downloaded finally) and running a boot time scan. That caught some stuff but the virus was still there. It got enough though to let me run .exe files from normal mode again.

    Every time I tried to install Malware Bytes it would delete the mbam.exe file, even from safe mode. So after about 4 tries in Safe Mode I managed to rename the file and then I was able to run it.

    Between those 2 programs I think I finally got the crap that was plaguing me. I've also run a few other things like IObit Security and AVG and MalwareBytes another 5 times. I am not getting popups anymore and the rest of the system seems to be working fine -- but it's slower than it was before all of this.

    I'm still concerned it's lurking somewhere though so I'll probably take everyones advice here and re-format soon. I just have to make sure I can get some of my programs re-installed again. There are a few I can't do without and don't have CDs for, etc.

    Thanks again all. I'd probably have ended up needing to pay someone to fix it without your help.
     
  20. SmileOfTheKill

    SmileOfTheKill Magical Amber

    Joined:
    Mar 24, 2007
    Messages:
    1,219
    Location:
    Florida, Sigh...
    Best thing to do once everything is removed and you have the anti-crap all up and running is use more anti-crap programs.

    On Firefox I use Noscript, Adblock Plus, and Web Of Trust. You can secure things even more but that is what I have.

    I also have to ask, do you use a router that you own at home? My router got infested with a virus so until I figured that out, I got a virus every time I connected to the router.
     
Loading...