Virus Removal?!?! (help) | xltronic messageboard
 
You are not logged in!

F.A.Q
Log in

Register
  
 
  
 
Now online (2)
big
Bremzen
...and 250 guests

Last 5 registered
Oplandisks
nothingstar
N_loop
yipe
foxtrotromeo

Browse members...
  
 
Members 8025
Messages 2614103
Today 0
Topics 127542
  
 
Messageboard index
Virus Removal?!?! (help)
 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:07 [#00950197]
Points: 9601 Status: Lurker



i downloaded some virus scanning freeware last night
(AntiVir 6) and discovered much unruly material on my comp -
most of which i deleted.

however, there were many that couldn't be removed - a couple
were "LOCKED" by Windows, and some were within archives
containing vital files.

How the hell do i remove these?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:10 [#00950208]
Points: 9601 Status: Lurker



anyone?

*hopes fleetmouse happens to magically wander in*


 

offline Jazembo from The Earth ball on 2003-11-14 13:14 [#00950212]
Points: 2788 Status: Regular



you seem to be having a lot of computer trouble these past
few months, is this normal or are you going through an
unfair time?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:21 [#00950221]
Points: 9601 Status: Lurker



it's definitely not normal. I'm pretty sure a lot of the
troubles are stemming from these viruses though - lots of
Java and Trojan viruses. many of the glitches i've been
having the past few weeks have vanished with the removal of
most of them, but i don't want to take any chances in simply
leaving the other ones.


 

offline earthleakage from tell the world you're winning on 2003-11-14 13:24 [#00950224]
Points: 27795 Status: Regular



or are you visiting some dodgy websites?


 

offline earthleakage from tell the world you're winning on 2003-11-14 13:27 [#00950227]
Points: 27795 Status: Regular



java viruses are common, just uninstall/delete thw plug-in,
and reinstall


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:28 [#00950229]
Points: 9601 Status: Lurker | Followup to earthleakage: #00950224



alright maybe a bit of that too - but i'm going to avoid
that from now on.

so, any advice on how to delete the fuck out of these files?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:29 [#00950231]
Points: 9601 Status: Lurker | Followup to earthleakage: #00950227



alright i'll try that - what about the others? some trojan
files or two were in my C:\_RESTORE directory.... they were
in archives so they couldn't be deleted, and i can't delete
them manually...


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:31 [#00950234]
Points: 9601 Status: Lurker



oh how strange.... i don't any plug-ins installed.... (can't
remove them from Control Panel) so i guess they're not
causing problems?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:32 [#00950235]
Points: 9601 Status: Lurker



*don't have any java plug-ins installed at Control Panel


 

offline Jazembo from The Earth ball on 2003-11-14 13:39 [#00950242]
Points: 2788 Status: Regular



are you running xp?


 

offline virginpusher from County Clare on 2003-11-14 13:41 [#00950245]
Points: 27325 Status: Lurker



eww trojans can be yukky and fun. Depending on if you are
the host or not :P

which ones do you have? anyone remember Sub7 or Netbus from
back in the day?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:41 [#00950246]
Points: 9601 Status: Lurker | Followup to Jazembo: #00950242



no - WinME (yuck)


 

offline Jazembo from The Earth ball on 2003-11-14 13:47 [#00950253]
Points: 2788 Status: Regular



if i were you here is what i'd do,

1. Run your virus scanner, make a note of the virus names
that it detects and can not remove.

2. Search the web or microsoft's site for removal tools
specific to these viruses.

3. Remove!!!

4. Get a better virus scanner as your current on is clearly
not up to the job.

5. Get a firewall, if a trojan or virus is installed on your
pc in the future, at least it will not be able to broadcast
your entire list of porn sites, i mean personal detail to
the entire net.

6. Relax


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:47 [#00950254]
Points: 9601 Status: Lurker | Followup to virginpusher: #00950245



i actually saved the log from the scan - me has....

Dummy.class
VerifierBug.class
Desex
StartPage.Y
Qhost.A.1

and a file named WIN386.SWP which is locked my windows....


 

offline Jazembo from The Earth ball on 2003-11-14 13:48 [#00950256]
Points: 2788 Status: Regular



You first post in this topic is very worrying Oddioblender,
why did you only just intall a virus scanner last night?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:49 [#00950258]
Points: 9601 Status: Lurker | Followup to Jazembo: #00950253



alright, i'll take a look....

any antivirus software you recommend?


 

offline virginpusher from County Clare on 2003-11-14 13:49 [#00950259]
Points: 27325 Status: Lurker



Firewalls are a must! Sygate is my choice


 

offline Jazembo from The Earth ball on 2003-11-14 13:49 [#00950260]
Points: 2788 Status: Regular



ok if you start from the top of the list and i will start
from the bottom. Together we will find the removal tools for
these bitches.

Just type' X removal tool' in yahoo, or microsoft, where x
is the name of the virus. I will post link when i find a
tool.


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:50 [#00950261]
Points: 9601 Status: Lurker | Followup to Jazembo: #00950256



you didn't know? i'm mentally handicapped. :D


 

offline Jazembo from The Earth ball on 2003-11-14 13:50 [#00950264]
Points: 2788 Status: Regular



I swear by AVG for Antivirus software, it is free, easy to
use and updates are made at least once a week


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:51 [#00950266]
Points: 9601 Status: Lurker | Followup to Jazembo: #00950260



rockin! thanks...


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:52 [#00950269]
Points: 9601 Status: Lurker | Followup to Jazembo: #00950264



umm... that's what i'm using. :D


 

offline Jazembo from The Earth ball on 2003-11-14 13:55 [#00950275]
Points: 2788 Status: Regular



well microsoft seem to be about as much help as a fart in a
spacesuit. You say you already use AVG? Can i ask you if you
ran the web update after installing but before scanning?


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 13:58 [#00950277]
Points: 9601 Status: Lurker



yeah i ran the update then scanned - the reason the files
can't be removed is because they're archived (hiding in ZIP
files)

i can't remove them manually through WinZip.


 

offline virginpusher from County Clare on 2003-11-14 13:59 [#00950279]
Points: 27325 Status: Lurker



neat i am downloading that as my norton just ran out


 

offline Jazembo from The Earth ball on 2003-11-14 14:01 [#00950281]
Points: 2788 Status: Regular



HMMM, then there must be programs using the files. If you
Use ctrl+alt+del and try to close as many non essential
programs as you can, no music, video drivers etc. Just keep
the basic windows stuff open and the virus scanner. Then try
to remove them again.


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 14:01 [#00950282]
Points: 9601 Status: Lurker



alright... i'm taking an online virus scan at trendmicro -
maybe that will help.


 

offline Jazembo from The Earth ball on 2003-11-14 14:02 [#00950284]
Points: 2788 Status: Regular



Also if you can dissable the windows swap file then you will
be able to remove the virus in WIN386.SWP


 

offline Jazembo from The Earth ball on 2003-11-14 14:03 [#00950285]
Points: 2788 Status: Regular | Followup to Oddioblender: #00950282



no more scans will help cos you already know that you are
infected and what with, you need removal tools and a way to
remove


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 14:04 [#00950288]
Points: 9601 Status: Lurker



i'll be non-responsive for a bit while this runs...


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 14:06 [#00950289]
Points: 9601 Status: Lurker



good point.


 

offline Jazembo from The Earth ball on 2003-11-14 14:06 [#00950291]
Points: 2788 Status: Regular



If you post the contents of the ctrl+alt+del box than i will
let you know which programs to close.


 

offline pomme de terre from obscure body in the SK System on 2003-11-14 14:08 [#00950293]
Points: 11941 Status: Moderator | Show recordbag



Oddioblender from Birth Valley, Motavia OR Ft.Worth,
Texas - your choice (United States) on 2003-11-14 17:04
[#00950288]
Points: 4084 Status: Addict
Moderators only: Del msg


i'll be non-responsive for a bit while this runs...



ok dude.. we'll be right here.


 

offline Jazembo from The Earth ball on 2003-11-14 14:12 [#00950295]
Points: 2788 Status: Regular



i think he's dead...


 

offline pomme de terre from obscure body in the SK System on 2003-11-14 14:27 [#00950307]
Points: 11941 Status: Moderator | Show recordbag



he's being totally nonresponsive..

im worried.

ive called all the hospitals, HE ISNT IN ANY OF THEM!!!!1


 

offline Jazembo from The Earth ball on 2003-11-14 14:29 [#00950309]
Points: 2788 Status: Regular



looks like the agents got him, god damn it pomme, you told
me he was the one..


 

offline Jazembo from The Earth ball on 2003-11-14 14:29 [#00950311]
Points: 2788 Status: Regular



sorry, 'the one' should have read 'THE ONE!'


 

offline Jazembo from The Earth ball on 2003-11-14 15:07 [#00950359]
Points: 2788 Status: Regular | Followup to Oddioblender: #00950289



Sorry mate, i've got to go now, the only advice that i can
gove you before i go is...

Disable swap file usage in My Computer >(right click)
Properties,> Performance> i can't remember from there (i use
xp). This should let you remove the virus hiding in the .swp
file at least.

1. Check for updated dat files for AVG every couple of
days,

2. Set AVG to auto scan every 24 hrs

3. Install Kerio firewall

Good luck!



 

offline fleetmouse from Horny for Truth on 2003-11-14 15:55 [#00950425]
Points: 18042 Status: Lurker



You people... if I set your hair on fire and gave you a
glass of water, you'd drink it. :-)

Here is my magic formula for never getting infected with
viruses:

1) Don't use Microsoft Internet Explorer. Now that they have
90% of the market, they've lost interest in fixing bugs and
security calamities. Use Firebird or Mozilla.

2) read the Virus Bulletin once in a while and try some of
the recommended products - scanners that do really well on
their tests. Currently I'm running Nod32 based on
their recommendations - it is not only an excellent virus
removal/detection tool, it is also cheap and not a memory
hog.

3) If you do get a virus, search for its name or filename on
Google. You will almost certainly turn up something in the
way of removal instructions. Sometimes you can even type in
the text of an error message and get very useful
information. Sometimes you have to do another search based
on what the first search revealed - patience and
perseverance are your watchwords, my friends!



 

offline Jarworski from The Grove (United Kingdom) on 2003-11-14 16:20 [#00950471]
Points: 10836 Status: Lurker



I love this board, all your answers belong to us


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 16:30 [#00950487]
Points: 9601 Status: Lurker



i couldn't remove the following:

Classloader.D
Java.ByteVerify
StartPage.Y
Qhost.A.1

i guess i'll try the program fleets recommended.


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 16:31 [#00950488]
Points: 9601 Status: Lurker | Followup to fleetmouse: #00950425



by the way, i left for a restart - turns out AVG nailed it
after a reboot... but the other four still remain and
absolutely positively can not be uninstalled manually.


 

offline fleetmouse from Horny for Truth on 2003-11-14 16:36 [#00950497]
Points: 18042 Status: Lurker | Followup to Oddioblender: #00950488



Ya mean ya can't just delete them? That probably means the
virus is still in memory cuz it's locking the file.


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 16:47 [#00950509]
Points: 9601 Status: Lurker | Followup to fleetmouse: #00950497



will Nod32 take care of this? i'm d/l'ing it now....

btw, you wouldn't know of any software that accelerates a
modem connection, would you?

this file alone will take me an hour and a half to
download..... *sob*


 

offline fleetmouse from Horny for Truth on 2003-11-14 16:55 [#00950518]
Points: 18042 Status: Lurker | Followup to Oddioblender: #00950509



btw, you wouldn't know of any software that accelerates a
modem connection, would you?


rotflmao! There ain't no such animal - but there's plenty
that make that claim and will fuck up your machine and
install spyware - one friend of mine installed some shit
like that that completely hosed his networking. I combed
through the registry and reinstalled networking files for
like three hours before I gave up and wiped his box and
reinstalled everything. Fortunately he's a newbie so he had
nothing important saved.

I thought you got rid of the byteverify trojan? Wasn't there
a remove tool for it?

Yeah Nod32 can handle just about anything - I had a
java-based virus installer try to start up on me and it
caught it.

You might have to run the on-demand scanner instread of the
monitor to remove the virus, and reboot once or twice.

You will be displeased to note that the first thing Nod32
wants to do is download a big virus signature update. :-)
Let it do its stuff; a scanner without updated signatures is
useless as bull tits.


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 17:02 [#00950530]
Points: 9601 Status: Lurker | Followup to fleetmouse: #00950518



yeah, i didn't think there was such a thing, so luckily i
haven't downloaded such a thing. strange - my modem was
connecting fine as few weeks ago at 46k, but ever since it's
been screwy, so i guess this might the cause. I even updated
drivers.... or it could be that Juno sucks the balls.

Thanks for the Nod32 link btw - i'm sure the long wait will
be worth it. :D


 

offline Oddioblender from Fort Worth, TX (United States) on 2003-11-14 17:06 [#00950533]
Points: 9601 Status: Lurker



how about something that OPTIMIZES your modem connection, as
in making in run smoother, and/or more stable?

i'm betting that's not realistic either...


 

offline fleetmouse from Horny for Truth on 2003-11-14 17:13 [#00950537]
Points: 18042 Status: Lurker | Followup to Oddioblender: #00950533



It has more to do with the quality of your phone line,
whether it goes through a digital interchange, how good or
crappy your modem is... also how compatible it is with the
modem on the other end. You'd think these things would be
universal but some modems implement particular protocols
better than others, so if the two modems can't handshake at
a high speed they trade down until they're stable.

Get a part time job and get highspeed - you've got the room
and board covered for now, right? It's such a joke fussing
over a modem to squeeze out an extra 1K per second when for
a few bucks more you can download at 100K or better per
second.


 

offline hAnkyPhexTwin from Tucson, Arizona (United States) on 2003-11-14 17:15 [#00950540]
Points: 326 Status: Lurker



I got another problem to add. I'm trying to fix this one
computer that has 2 boot sector viruses called XYZ. I am
using Sophos Antivirus to disinfect it in dos no matter how
many times i did it, it still comes back. I even Fdisk /mbr
like 8 times in a row cause i was pissed at it...still
there. any suggestions on killing the bastard?


 


Messageboard index