How to get rid of a virus

[Fliplip]

After having issues with Eset Security tonight after upgrading to 7077 i now find i have a bloody virus. My first real viral problem after all these years.
Im not sure what it is but its very persistent.
At the moment im scanning my HDD from XP using Eset and its found a few things but i know the W7 regestry has some lines in it that need sorting out. But of course i cant access regedt. Nore can i install any Av.

Any ideas for a work around other than a format/instal.

Cheers.

Dave.

 

[TechOutsider]

Malwarebytes Anti-Malware should work.

http://www.malwarebytes.org/mbam.php

Let's refrain from suggesting to install another full AV suite. He already has ESET; another real-time AV could result in conflicts. And let's not turn this into a product a vs. product b thread.

 

[Fliplip]

Thanks, ill try that.
I cant get Eset working properly with 7077 so im not protected by anything other Defender and the W7 Firewall.
And now i cant install anything. Ive done the scan from XP and it found 11 threats but still im infected.
Its stopping me from showing all files, using regedit, gadgets wont open and Ie tries to download something without promoting.

Dave.

 

[SIW2]

Hi Fliplip,

You could try a free bootable anti - nasty app., like this

Dr.Web LiveCD is a software product that features a standard, Dr.Web scanner

It also has a file manager in it.

There is a free bootable registry editor from here:

PC Regedit, Purchase PC Regedit

It says purchase , but they are doing it free now.
Hope it helps.

 

[TechOutsider]

A bootable CD is an option, however it takes time; you have to download/burn the .iso file. Also, you will have to constantly download an updated .iso file for the most up to date signatures for scanning your computer.

 

[johngalt]

Only if you are constantly having to scan your system from outside of windows - this is a *right here right now* situation and thus is a very good and viable alternative.

It is rare for a person to have only one computer and only have access to said computer and no other computer all day, every day, in this day and age, thus whenever you need a new version (as in when your computer becomes re-infected) then you can DL it again at another PC and use it.

There is no sense in keeping it handy unless you are on permanent dialup (including at your job) and or the above scenario is true....

 

[Mercurial]

use eset anti virus not smart security since it wont know how to override windows 7 FIREWALL bercause it was built for xp and vista, just use windows firewall for now ;O

eset AV + windows firewall and defender turned off = best combo

 

[dmex]

eset AV + windows firewall and defender turned off = best combo

Eset doesn't protect IPv6 interfaces, ICMPv6, Teredo, Edge Traversal, RPC Endpoints and a few other protocols, so its kinda not a good idea to disable Windows Firewall...

There are other new protocols that other firewall`s have yet to support so DO NOT disable Windows Firewall until third party products actually support Windows7 and properly protect all protocols and interfaces

 

[Fliplip]

WOW, thanks all for the help.
I must admit i thuoght i was going to get some rude answers, must be spending too long on other forums.

The Malwarebytes sofeware did seem to do the trick.It found 11 infections and deleted them. I can now open regedit and also show all files, the two things i couldn't do before running it. SO i think its cleared. My PC had a BSOD when i got up so im not sure how far the in depth scan got last night as i went to bed with ti still running. The BSOD was to do with the power management and its happened before, nothing to do with the virus.
Once i re booted i found that Gadgets wont work. This was happening when i had the virus so not sure what to do now. The other thing i was getting was IE popping up loads of times. I didnt see that this morning but sometimes it takes a few mins for it to happen and i couldn't hang around. Ill see what happens to night when i get home.

Im going to try and put Nod32 on tonight as i do have a licence for it and keep using the W7 firewall. I couldn't put it on last night as the virus was preventing me form installing anything.
Im assuming having just windows Defender isnt enough.
I have ICMPv6 turned off (to be honest i dont know why i need it).

At the end of the day if i have to re install 7077 its not a big deal. I was hoping i could get by untill the RC comes out and then do a clean install.

Thanks again for all the tips. Your a right friendly bunch.

Dave.

 

[jimbo45]

If you have an infected computer my only solution would be basically to

1) Format the hard disk again (full format)
2) Write Binary zeros (X'00') on EVERY SECTOR / CLUSTER including the MBR on track zero.
3) Restore the MBR
4) restore a Clean image of your OS.

If you haven't got 3 and 4 - decent backup software will save an MBR and a disk image I use acronis but there are others then install the OS again from SCRATCH using a known CLEAN install disk.

You can use a VISTA PE or a BARTPE or even a UBCD4WIN rescue disk to format the drive which had the virus -- and write the binary zeros -- don't forget this last step at is the only sure way that there's nothing lurking on the disk which could come back and byte you later.

You'll have to google a bit on making these rescue disks but anybody doing beta testing with "unofficial builds" should have these tools at their disposal. It takes a bit of extra time creating these tools but its time well spent.

Cheers
jimbo

 

[Fliplip]

Thanks jimbo but ill take my chances with an AV package for now.
As this is only for testing ive not got anything crucial on the HDD so i can afford to start over (and its probably best to do a clean install each time anyway).

Dave.

 

[TechOutsider]

Researching on Google, I found that gadgets don't work when UAC is disabled. Possibly, the malware disabled UAC. I would if I was writing the virus .

Here, read this link:

Fix Gadgets Not Working or Showing When UAC Is Set To Not Notify or Disabled in Windows 7 Beta » My Digital Life

 

[Fliplip]

Thanks. I read that earlier and tried it out on another PC runing 7068 but it made no difference.
On my home PC it was still set at 2.

As it turns out i had to format my HDD after all. There were so many .exe files infected that i just couldnt fix it.
Even my XP instal was awash with them. Im pretty sure ive got it under control now but as ive done a clean instal of 7077 im going to try and use that as my main OS at home.
Ive given up on Eset for now and am using Avast. Im not sure how well its working (and it has refused to scan certain folders already) but for now its up and running.

I want to make a backup image of my C partition while its all nice and clean. Any one recomned anything? I wanted ot use the windows one but its insisting on doing both my system drives and i only want ot back up my W7 one.

Thanks again fo rall the help.

Dave.

 

[TechOutsider]

Don't bother backing up your Windows 7 partition. Just backup the documents. You will have to reformat/reinstall Windows 7 every thirty days since you do not have a product key for Build 7077. Interim builds are leaked every couple of weeks, or recently, days.

 

[darkassain]

the actual public beta keys should keep working AFAIK so no need to reformat every 30 days...

 

[Fliplip]

winver says mine expires on 2/3/2010 so i wasn't sure why techoutsider said what he did unless he knows something i dont.

I cant see this install lasting long anyway, not with this bloody virus on my PC.
XP has fallen apart so im just down to 7077 for now.
Still scanning the other drives.

 

[TechOutsider]

winver says mine expires on 2/3/2010 so i wasn't sure why techoutsider said what he did unless he knows something i dont.

I cant see this install lasting long anyway, not with this bloody virus on my PC.
XP has fallen apart so im just down to 7077 for now.
Still scanning the other drives.

Ok, my mistake, public beta keys work.

Anyways, didn't you say you reformatted/reinstalled? Why are you still scanning your PC?