iceman
Happy Holidays everyone!
So far my Holidays have been partly consumed with trying to get rid of a virus on my wife's laptop. At this point it's exceeded my bag of tricks, so I need some help.
The first sign of a virus was a popup from a pseudo-antivirus program called "Internet Security 2010". It warned me about several serious infections and said I needed to buy the program to remove them. I ran a scan with my antivirus program, AVAST, and after updating the virus definitions I thought I was in the clear. However, the virus had made changes to the system, like installing wallpaper and disabling the ability to change it. Also, it disabled task manager, so I couldn't see running processes. I was able to fix these things by finding the right places in the registry and making changes using Regedit. There were also messages on bootup about not being able to load things like "notepad.dll" and "winupdate86.exe". Seeing that these were associated with the virus, I used MSCONFIG to disable them at startup.
At this point I thought it would be good to get recent OS updates for WIndows XP. When I went into the Control Panel (Security) I noticed that Automatic Updates were disabled. So I went to the Microsoft Windows Update website and tried to do a manual update. It started to scan my system, but then came back and said it couldn't do an update, and gave me a list of services that needed to be running. Using services.msc I looked and sUre enough there were settings that weren't right, so I corrected them and tried again, but it still didn't work.
Thinking AVAST might not be fully removing the virus I downloaded and ran Microsoft Security Essentials. A full scan uncovered several infections and supposedly cleared them. However, when I connect to the internet AVAST is still detecting viruses (AVAST and Security Essentials are both running now) and I still can't update Windows. If I turn on Automatic Updates, the next time I look it's turned off again.
I tried to do a System Restore to back before the virus was present, using the Microsoft utility. The process seems to start OK but when I come out of the reboot, it says it couldn't complete it. Other things I'm noticing: the viruses pop up mostly when I connect to the internet, but especially when I go to the Microsoft website.
I don't know the name of the virus, but these are some of the names that the antivirus programs have come up with:
AVAST: Win32:JunkPoly[Cryp], WIn32:Malware-gen
MS Security Essentials: Win32:Opachki.A, TrojanDownloader:HTML/Fakeinit, Win32:Sopiclick.A, Win32:Refpron.gen!D
I will provide the requested logs in the posts that follow. Any help will be appreciated!!
Tom
So far my Holidays have been partly consumed with trying to get rid of a virus on my wife's laptop. At this point it's exceeded my bag of tricks, so I need some help.
The first sign of a virus was a popup from a pseudo-antivirus program called "Internet Security 2010". It warned me about several serious infections and said I needed to buy the program to remove them. I ran a scan with my antivirus program, AVAST, and after updating the virus definitions I thought I was in the clear. However, the virus had made changes to the system, like installing wallpaper and disabling the ability to change it. Also, it disabled task manager, so I couldn't see running processes. I was able to fix these things by finding the right places in the registry and making changes using Regedit. There were also messages on bootup about not being able to load things like "notepad.dll" and "winupdate86.exe". Seeing that these were associated with the virus, I used MSCONFIG to disable them at startup.
At this point I thought it would be good to get recent OS updates for WIndows XP. When I went into the Control Panel (Security) I noticed that Automatic Updates were disabled. So I went to the Microsoft Windows Update website and tried to do a manual update. It started to scan my system, but then came back and said it couldn't do an update, and gave me a list of services that needed to be running. Using services.msc I looked and sUre enough there were settings that weren't right, so I corrected them and tried again, but it still didn't work.
Thinking AVAST might not be fully removing the virus I downloaded and ran Microsoft Security Essentials. A full scan uncovered several infections and supposedly cleared them. However, when I connect to the internet AVAST is still detecting viruses (AVAST and Security Essentials are both running now) and I still can't update Windows. If I turn on Automatic Updates, the next time I look it's turned off again.
I tried to do a System Restore to back before the virus was present, using the Microsoft utility. The process seems to start OK but when I come out of the reboot, it says it couldn't complete it. Other things I'm noticing: the viruses pop up mostly when I connect to the internet, but especially when I go to the Microsoft website.
I don't know the name of the virus, but these are some of the names that the antivirus programs have come up with:
AVAST: Win32:JunkPoly[Cryp], WIn32:Malware-gen
MS Security Essentials: Win32:Opachki.A, TrojanDownloader:HTML/Fakeinit, Win32:Sopiclick.A, Win32:Refpron.gen!D
I will provide the requested logs in the posts that follow. Any help will be appreciated!!
Tom
