Lois & Clark Forums Forums General Discussion Technical Help and How To's Computer Viruses?

For those of you who didn't hear, our household computer was hit pretty hard with a virus. In all reality, we'll probably have to wipe the HD clean and start over (thank goodness I was able to save my WIP!! *whew*). But I was wondering if anyone was aware of any of these problems or how to fix them.

• the computer restarts randomly
• runs extremely slow and the cursor always has the hourglass next to it now
• the computer shuts down when we try to install Norton Antivirus (this, btw, is why you don't let your dad use the computer before you've updated your AV software )
• one of the virus programs we found was called 124497.exe and will not let you delete it and will re-install itself after being un-installed
• will occasionally get an error box titled "Microsoft Visual C ++ Runtime Library" with the message that winln.exe was closed (or had an error) and says "abnormal prgram termination
• "web dialer" also seems to be installed, but we've thwarted that by unpluging the modem
• Any attempts to open Explorer is met with a barage of pop ups, upwards of 25 at a time

If you can't help, don't worry, I was able to salvage my files from the HD, so it can't be all that bad, can it?

Sara (who is looking desperatly for a public computer on which I'm allowed to install IRC )

Sara, I can't find the files you mention (searched the net, Norton, and McAfee), but Norton does have a free online scanner. That may work even if whatever virus/spyware you have is designed to block the locally installed version.

You can do that here.

If that doesn't work, McAfee also has a free online scanner here.

If that link doesn't work, you can also get to it by going here, and clicking the "McAfee Freescan" link located on the right side of the page under "Free Services."

You can also try here, which is another McAfee scan page.

Hope this helps, or that you find some other way to fix things. Good luck.

Paul

P.S. For public IRC access, you can go to:

http://www.undernet.org/webchat.php

It's a java interface that works in most cases.

Those two sound like you've got adware, Sara - very, very irritating software that records, transmits and reacts to the things you do on the computer. Grab one of the adware-detecting programs like Adaware (http://www.lavasoftusa.com/software/adaware/) to clean it up.

Yvonne

I agree with Yvonne. The Web Dialer is a BIG clue you've got adware. Along with Ad-Aware, try Spybot S&D, which you can find at download.com .

As far as the random rebooting, make sure you run Windows Update regularly, and install all the Critical Updates. There are at least two worms that will trigger the random rebooting without always infecting your computer, giving an RPC Call, saying your computer will shut down in 60 seconds, and starts counting down.

Definitely adware, Sara - Yvonne and Karen have given you the best advice there. I'd recommend getting both AdAware and Spybot - they're both anti-adware programmes, but they seem sometimes to catch different things.

I had a nasty bit of spyware which kept reinstalling itself after running both AdAware and Spybot, and both programmes told me they couldn't remove it (but told me where it was). When that happens, it usually means that the programme is running in the background - and if you're connected to the internet at the time, it drags whatever it needs to reinstall itself properly from the internet. So when you run your anti-spyware programme, make sure that you are not connected to the internet at the time.

Spybot has a useful little feature: when it shows you the filenames of the spyware on your computer, you can right-click on the filename and choose 'jump to location'. I find this useful when the file is deep in my registry somewhere - I don't want to go searching through thousands of files and potentially causing more problems as a result. If you're not confident about deleting files from your registry (and sometimes you have to if Spybot or AdAware tells you that they can't delete the file), then copy the filename and post it here to ask someone who knows what they're talking about whether you can safely delete it.

Good luck! Spyware is second only to viruses as a total abomination in the lives of internet users.


Wendy

Also try a site called tomcoyote.com. It has tons and tons of info about just these problems. Another program called HiJackthis or something like that, is designed to get rid of all those annoying little monsters. I had to wipe out my HD, then still had problems. But this site was invaluable. I've been clean ever since.

SQD

FYI: Sara's comp does have SpyBot. She's been using it regularly since the comp came down with a serious case of EZula/TopText a week or two ago.

Running another scan wouldn't hurt, but installing AdAware won't help. AFAIK, installing 2 anti-spyware programs on the same comp just causes conflicts.

Anyone know if that's true of Spybot + HiJackThis! ?

Paul, who was going to leave it to Sara to explain all that, but then remembered... Limited net access.

Thanks everyone for your replies!

My sister said she tried uninstalling the program, but then it just re-installs itself...for reasons that you explained. I'd download Adware, but all attempts to connect to the internet are met with *multiple* pop-up windows...though I suppose I can try again if my sister lets me.

Sara (who's going to try not to worry about *anything* on her vacation starting tomorrow )

Paul,

HiJackthis is a diagnostic tool that reads your files and lists them. Even the bad ones. You use it to locate the files that should NOT be on your computer and delete them. The site at tomcoyote has other, extremely more knowlegable people than myself, who will help you determine which files are bad and how best to get rid of them.

I had software conflicts with Spybot and Adaware. So, now I use a program called Spywareblaster which stops thousands of vermits from infecting your computer to begin with. And I use Spybot to clean my computer, though so far I haven't had many problems since installing all of it. One registry change and one cookie change that was easily handled by Spybot.

If your compter is extremely infected, I do recommend using Hijackthis and taking advantage of the folks at are willing to help you on tomcoyote.com. Then install Spywareblaster(once you're totally clean). Make sure to update regularly and use Spybot for periodic checks. It's working for me!

SQD

I've installed AdAware and Spybot on my pc and have been using both for some time now with no conflicts at all. Installed Spyblaster too and they all work quite happily in conjunction with one another.

LabRat

Ditto LabRat. I have found that AdAware and Spybot each occasionally catch things the other misses, so having both is useful.

Just installed Spywareblaster last night - thanks for the recommendation, Robin! - so interested to see how effective that is.

And good luck, Sara!


Wendy

A perfect example of which was DSO Exploit, which appeared on my Spybot scan over the past few days and took a time to remove. Turned out to be a hole in MS's security (who'd have thunk that was possible? ) which was potentially a bit of a problem.

Took a bit of fixing and some trawling around the net to research for a solution. AdAware didn't pick it up at all.

LabRat

Oh, I had DSO Exploit as well, Rat - as Annette and John can attest to! It took me several hours and much cursing to get that one out. Had to disconnect from the Internet, as it seemed the programme was reinstalling itself every time Spybot tried to remove it. In the end - and this was where I discovered Spybot's 'jump to location' feature - I went into the registry and removed every entry Spybot pointed out.

Bloody &%&%^$%£* spyware writers!


Wendy

Yeah, that jump to location thing didn't work for me with DSO Exploit for some reason. Clicked on it and nothing happened. I think I've finally rooted it out now though.

And, yes, that was partly the problem - every time I scanned with Spybot it claimed it had fixed it, but it was there again next time around. I found an online fix which disables it and solves the vulnerability problem, but I think it's still registering on my system, even though it's effectively been declawed. I'm hoping that some critical updates from MS I installed earlier though will root it out completely.

If it hasn't, I'll try that disconnection thing. Thanks for the tip.


LabRat

Another thing to try is boot into Safe mode, and then run the programs from there. Since most of the drivers are disabled, it can't connect.

As an adjunct to Spyware Blaster, you can put ie-spyad onto your computer. It's similar to SB, but catches other pests and keeps them from crawling onto your HD.

Paul, I have Ad-Aware and Spy Sweeper on my computer and so far I have had no conflicts.

Nan

This isn't exactly about a virus, and you're welcome, Wendy! But didn't I read somewhere recently that someone had problems with the new service pack update for Windows XP? I updated about two weeks ago and installed the service pack. After, I couldn't open files. So, I promptly restored my PC to a time before the update. Any suggestions? Should I install this service pack? Is there anything I need to do first so that I can still open files? Anyone?

SQD

Don't think I've heard of anyone who hasn't had problems with SP2. I'm definitely not installing it unless I absolutely have to.

Which is a bit of a begger, because I understand you can only get Movie Maker 2 if you dl SP2. :p

LabRat

I'm running the new SP, and I haven't had any problems... Occasionally Windows tells me I really should trust it more and let it do such and such thing automatically, and I tell it no, and we get along fine <g>. So I have no reason not ot recommend getting it... Although to be honest I can't remember having any problems *before* I installed it, either.

Kaylle

Well, I've now installed SpyBot, and it's working well. Thanks.

The conflicts I was running into were with Earthlink's Spyware Blocker, which is almost spyware in and of itself, it seems (now that I'm trying to get rid of it...).

Spybot picked up the same exploit as Lab mentioned. Do you remember where you find that patch, Lab?

(EDIT: Never mind. Found this and this. )

As for SP2, it fixed some issues I was having, temporarily. They're starting to crop up again, and I'm thinking I may have to reinstall XP. Except that I seem to have lost my emergency CD somehow. Booting up takes a *lot* longer now. Otherwise, it's been good.

The main thing is that SP2 patches yet more security holes, and it's my general policy to install all Windows security patches as soon as MS announces to the entire world that the holes exist.

Paul

It was the second one you found there, Paul. Glad you got it. Sorry - should have thought to provide the link to it in my previous post.

LabRat

I've been viewing SP2 as more of a virus than a fix. I've seen a lot of people at work install SP2, then can't connect because of the firewall or something else. The only fix is to re-install their network card. Yesterday, I had someone who had recently installed SP2 have problems opening attachments in Outlook Express. For some reason, it had lost the setting for which program to open the file with... and it was a simple JPG. *shakes her head sadly* I have had coworkers say they had no problems with it, though. I'm waiting until I absolutely have to install it. (evil nasty Microsofts, trying to take over everything. We'll beats them backs, we will!)

I wanted to take a moment to thank everyone for their help and suggestions!

We ended up having to wipe the HD and start over, but the guy who did the computer did a pretty good job (put some security features on here that are thwarting my attempts to make videos ).

Now that I'm back and running again, I know what I'm doing when I use spybot. Thanks guys!!

Sara