Virus Removal, Help !

Fr0dders

Fr0dders

Fr0dders

Caporegime
Joined
18 Oct 2002
Posts
33,478
Location
West Yorks
Hi guys

wondering if somebody can help me out here. My dad's PC has a virus on it, which changes the nameserver in IE to something it chooses, thus sending you to random links (and no doubt earning the writer a portion of the referals)

but anyway, i know where this virus is. its in the tempoary internet files folder. But nothing can touch it. Every program i use to access the folder crashes. NOD32 crashes, AVG crashes, windows explorer crashes, user accounts deletion crashes, windows disk cleanup wizard crashes

absolutely everything i do crashes. And it still loads in safe mode. But i cant find the entry in my startup folder to stop it running. Any suggestions ? the anti virus programmes are useless, they just crash when they try and scan the area.
 
Can you manually delete the temp internet files and IE5 folders in safe mode?

Other method (if anti-virus won't play) is to navigate using an internet explorer window, but then end the explorer.exe process.
 
both methods crash as soon as i get near the user folder

i cant actually get into user folder before it crashes.
 
ive tryed booting into safemode with commandline access

i run the delete command, but it doesnt actually delete everything

even though ive used the *.* switch

i really dont want to have to format my Dads PC (he has no backups or anything)

any other pointers on a way to boot into windows without this virus loading ?
 
sounds like there's random crap in your hosts file..?

open that in notepad and look what it's like
 
MrLOL said:
i run the delete command, but it doesnt actually delete everything

even though ive used the *.* switch
Click to expand...
If the attributes of the file are flagged as hidden, system or read only, the file won't get deleted - try:

attrib -s -h -r *.* && del *.*

Before doing that, though - have you tried Hijackthis? That will look in all the startup locations for you (but you have to decide what to get rid of...) post a log here.
 
=walls= said:
Before doing that, though - have you tried Hijackthis? That will look in all the startup locations for you (but you have to decide what to get rid of...) post a log here.
Click to expand...

yup

ive actually deleted the user profile and re-created a new one. And totally stripped it bare. Theres only about 3/4 entries in Hijack this now. Still hasnt gone

bledd. said:
sounds like there's random crap in your hosts file..?

open that in notepad and look what it's like
Click to expand...

hosts file is empty apart from localhost. Its actually a trojan, as it crashes every programme that attempts to get near the file. As soon as i head to C:\documents and settings\simon windows explorer crashes within seconds, but doesnt crash when browsing c:\windows etc..

also AVG crashes when its scans that directory, disk clean crashed when i tryed to clear tempoary internet files etc..

i know its in there,but its a nasty virus and NOD32 can scan, but doesnt pick anything up. AVG does find it, but crashes when it gets to the file. Same as diskclean does.

any other ideas ?
 
Bare in mind ,theres some nasty virus's , spyware & malware that's so new there nothing to locate them or get rid of them . I remember years ago a new nasty on a work Pc that nothing shifted , NewGenLook was it's name and at the time there was nothing to fix it .It brought hard core porn the the screen and was so invisible nothing would shift it. I got rid of it in the end though ........it's called a Format .Remember to back up often in case you get a nasty .
 
For the future ,once your Dad's Pc is up and running with all the drivers/programs on , get hold of a program like Ghost , I use Paragon . This can make a perfect copy/image of your drive to a disk or spare hard drive .If you get a nasty virus or whatever you just copy your image back to your Pc drive .This might only take a couple of minutes ,but WOW ,is it quicker than formatting and doing all the installation again .
 
I would give Trend House call a try before the format as you got nothing to loose and they have the most up-to-date pattern files...

Here
 
You must log in or register to reply here.
Back
Top Bottom