Very infected with ? - Tilted Forum Project Discussion Community

flat5 · 11-02-2005, 08:24 AM

Someone had installed and used ADSL without any protection.
The machine he brought me is infected with something(s).

The first thing I did was connect the hard disk to my machine and run Norton Anti-Virus 2003, Ad Aware SE Pro v5, Spybot v1.3, No Adware on the drive.
Nothing found. So I'm thinking the registry must be checked but I know of no program that will check the registry on an inactive Windows directory.

So I put the drive back in his machine and start Windows XP build 2600 Dutch. It loads. The desktop has a message on a black background that the machine may have a virus and click here. Mouse clicking on anything has no effect. Right click is also inactive. Ctl-ESC will not get me into the start menu. CTL-Alt-Del will let me stop processes. I see nothing obvious to me that I should stop. (no expert at this). I try stopping a few things and they start again.

I re-boot in safe mode and also have no control over the machine.
Mouse buttons have no effect.

Restart again in safe mode with command line, as administrator. Try the system restore utility and get a message that the utility is disabled and I must start in normal mode as admin. and enable it. cuss cuss sware sware.

I'm at a loss. I had hoped to be able to install some anti trogen programs and maybe clean the registry or at least run Hijack This.

Anyone got advice besides back up what data I can and reformat?

Thank you.

Nimetic · 11-02-2005, 10:45 PM

I'm not a PC specialist, but here's some things that might be useful..

a) when you ctl-alt-del, there's an option "New Task". You can use this to run
cmd (W2K/NT) or command (others). That is - you can use this to
obtain a command line.

b) try looking in \winnt and \winnt\system32 - or equivalents under XP.. not sure
what they are. Often, stuff installs itself here. Files with recent
date-times (later than the install date) are suspicious and may reflect either
a windows update or virus/trojan etc.

c) you can run windows.. system file compare (sfc) from the command line... it
compares files to the install CD. Helped me out once.

d) the screen that says that you may have a virus is sometimes itself a result of
a virus (search "about:blank"). I've had that. Sometimes if IE has been
hijacked, or explorer has been stuffed - this happens. Explorer runs when
the desktop is loaded it seems - so problems with that cause a
frozen machine.

Search for and try the utility "Autoruns Utility". I think it comes from
sysinternals or system internals website.

e) The latest virus/trojans seem amazingly sophisticated... with multiple parts.
You might find that it takes multiple passes to completely rid yourself of it.
Suggest you use a personal firewall in the meantime so that you can see
what the PC is doing and who it is trying to contact.

Good luck.

flat5 · 11-02-2005, 10:49 PM

Good ideas.
Sent them to the printer.
I'll check them out.

Aro23 · 11-03-2005, 11:22 AM

try microsoft anti-spyware

flat5 · 11-03-2005, 11:58 AM

After backing up data, I deleted all Windows files dated from Nov. 1, 2005.
This has stopped the malware and I can run programs.
Norton has been messed with and I'm trying to remove it and re-install it.
Usually a complicated task.

Nimetic · 11-05-2005, 04:36 PM

Good to hear...

That should hopefully allow you to run all your anti-spy/virus utilities etc from safe mode anyway. Take my advice and run them overnight. Bloody boring watching their slow progress if you ask me. So many times I've made the mistake of starting these programs during the daytime (then not had access to do much else).

Good luck.

viejo gringo · 11-05-2005, 08:02 PM

be sure and turn system restore off---they sometimes keep a copy in the restore files.....AVG will check them all..

flat5 · 11-06-2005, 05:57 AM

installed "the Cleaner". It found nothing but tracking cookies.
Had to replace wininet.dll. Gave up on complete uninstalling Norton.
No error messages so good enough for now.
Installed McAffee av.

He came by today and picked up the machine.
He only plans to use it for two weeks. He gets a new machine then.
I really have to call him and make him turn on Xp's firewall.
He plans to just use the net for email for awhile.

hrdwareguy · 11-08-2005, 07:30 AM

A guy I work with had this on his machine....can't remember what it was but I found a lot of information on Symantec's site about it. What you basicly have is an application that has set a bunch of registry flags that are used in group policy to force the desktop and prevent you from changing your settings. It also runs as an app in the systray.

11-02-2005, 08:24 AM	#1 (permalink)
flat5 Very Insignificant Pawn Location: Amsterdam, NL	Very infected with ? Someone had installed and used ADSL without any protection. The machine he brought me is infected with something(s). The first thing I did was connect the hard disk to my machine and run Norton Anti-Virus 2003, Ad Aware SE Pro v5, Spybot v1.3, No Adware on the drive. Nothing found. So I'm thinking the registry must be checked but I know of no program that will check the registry on an inactive Windows directory. So I put the drive back in his machine and start Windows XP build 2600 Dutch. It loads. The desktop has a message on a black background that the machine may have a virus and click here. Mouse clicking on anything has no effect. Right click is also inactive. Ctl-ESC will not get me into the start menu. CTL-Alt-Del will let me stop processes. I see nothing obvious to me that I should stop. (no expert at this). I try stopping a few things and they start again. I re-boot in safe mode and also have no control over the machine. Mouse buttons have no effect. Restart again in safe mode with command line, as administrator. Try the system restore utility and get a message that the utility is disabled and I must start in normal mode as admin. and enable it. cuss cuss sware sware. I'm at a loss. I had hoped to be able to install some anti trogen programs and maybe clean the registry or at least run Hijack This. Anyone got advice besides back up what data I can and reformat? Thank you.

11-02-2005, 10:49 PM	#3 (permalink)
flat5 Very Insignificant Pawn Location: Amsterdam, NL	Good ideas. Sent them to the printer. I'll check them out. Last edited by flat5; 11-02-2005 at 10:52 PM..

11-05-2005, 04:36 PM	#6 (permalink)
Nimetic Junkie Location: Melbourne, Australia	Good to hear... That should hopefully allow you to run all your anti-spy/virus utilities etc from safe mode anyway. Take my advice and run them overnight. Bloody boring watching their slow progress if you ask me. So many times I've made the mistake of starting these programs during the daytime (then not had access to do much else). Good luck. Last edited by Nimetic; 11-05-2005 at 04:39 PM..

11-08-2005, 07:30 AM	#9 (permalink)
hrdwareguy "Officer, I was in fear for my life" Location: Oklahoma City	A guy I work with had this on his machine....can't remember what it was but I found a lot of information on Symantec's site about it. What you basicly have is an application that has set a bunch of registry flags that are used in group policy to force the desktop and prevent you from changing your settings. It also runs as an app in the systray. __________________ Gun Control is hitting what you aim at Aim for the TFP, Donate Today

11-02-2005, 10:45 PM	#2 (permalink)
Nimetic Junkie Location: Melbourne, Australia	I'm not a PC specialist, but here's some things that might be useful.. a) when you ctl-alt-del, there's an option "New Task". You can use this to run cmd (W2K/NT) or command (others). That is - you can use this to obtain a command line. b) try looking in \winnt and \winnt\system32 - or equivalents under XP.. not sure what they are. Often, stuff installs itself here. Files with recent date-times (later than the install date) are suspicious and may reflect either a windows update or virus/trojan etc. c) you can run windows.. system file compare (sfc) from the command line... it compares files to the install CD. Helped me out once. d) the screen that says that you may have a virus is sometimes itself a result of a virus (search "about:blank"). I've had that. Sometimes if IE has been hijacked, or explorer has been stuffed - this happens. Explorer runs when the desktop is loaded it seems - so problems with that cause a frozen machine. Search for and try the utility "Autoruns Utility". I think it comes from sysinternals or system internals website. e) The latest virus/trojans seem amazingly sophisticated... with multiple parts. You might find that it takes multiple passes to completely rid yourself of it. Suggest you use a personal firewall in the meantime so that you can see what the PC is doing and who it is trying to contact. Good luck.

11-03-2005, 11:22 AM	#4 (permalink)
Aro23 Crazy	try microsoft anti-spyware

11-03-2005, 11:58 AM	#5 (permalink)
flat5 Very Insignificant Pawn Location: Amsterdam, NL	After backing up data, I deleted all Windows files dated from Nov. 1, 2005. This has stopped the malware and I can run programs. Norton has been messed with and I'm trying to remove it and re-install it. Usually a complicated task.

11-05-2005, 08:02 PM	#7 (permalink)
viejo gringo Registered User Location: Deep South Texas	be sure and turn system restore off---they sometimes keep a copy in the restore files.....AVG will check them all..

11-06-2005, 05:57 AM	#8 (permalink)
flat5 Very Insignificant Pawn Location: Amsterdam, NL	installed "the Cleaner". It found nothing but tracking cookies. Had to replace wininet.dll. Gave up on complete uninstalling Norton. No error messages so good enough for now. Installed McAffee av. He came by today and picked up the machine. He only plans to use it for two weeks. He gets a new machine then. I really have to call him and make him turn on Xp's firewall. He plans to just use the net for email for awhile.