Infected! O_o;

[a3-h]

Hokay, so I Used to use msInternetExplorer. Nevermore. Switched to FireFox, yesyes.

One day I thought to check the forum out, and got infected by this evil shit that was using the WMFexploit through the forum.
I've installed Sygate Firewall, Avast antivirus, SpybotS&D and adaware, and I've run them a bunch of times.. And i'm Still not rid of the crap!
Sygate tells me every 30 seconds that something is trying to access the net. I don't know if I should allow winlogon to access.. Argh!
Is there anything else to do but to format my hdd?

/a

 

[Klepto]

Argh! Is there anything else to do but to format my hdd?

The answer.

(USER WAS BEAT TO DEATH FOR THIS SHITTY POST)

 

[vic20-ian]

Why exactly?

 

[Klepto]

Why exactly?

Why is it the answer or why was I beaten?

It's the answer because I'm fairly sure Linux can't catch what a-3h has. Many people believe Linux to be inherently more secure than Windows.

I was beaten because my post was a despicable example of flamebait, zealotry and trollism condensed into two words and a URL. I'm surprised I wasn't roasted slowly over an open fire for it. I completely failed to point out that Linux is not the Holy Grail of operating systems and may indeed be wholly inappropriate for a non-technical gamer with only Windows expierience.

In summary, I think my execution was just and mercifully swift.

 

[chimpoid]

...although your "half an answer" can be considered correct after a fashion.
Boot windows and kill of the auto-restore thingy. That windback feature that they have. Then reboot in safe-mode and run the scan from there.
If that fails pop on AVG. It's pretty damn swift at eliminating most things.

Last resort. Boot linux and run virus scan from there. It may have more luck. If not then provided you haven't used NTFS you should be able to pluck out the offending article and clear out the "recycled" folders from windows. Back up data from your win partition with any linux cd-r/dvd-r tool (there are plenty to choose from on Ubuntu "Gnomebaker" will do the trick) and then reboot windows.

At that point if there is still no joy, fdisk the beast and after re-installing scan your backed up data again and then re-install as required. Perhaps even consider dual booting with a small linux partition in case of emergencies in the future. You might never use it but it can be a real help in some situations.

So, Linux can be useful as a safe platform from which to fish out the nasties even if you don't want to make the switch for good.

 

[nickspoon]

Knoppix or Puppy can save the day if you use them right.

You could try checking your C:\WINDOWS directory for a winlogon.exe. The real winlogon is in C:\WINDOWS\SYSTEM32. Find it anywhere else, it's a trojan.

 

[DemonStar55]

linux isn't the answer, it is still infect-able by this

well if you run it through WINE

 

[daclassicgamingmaster]

Argh! Is there anything else to do but to format my hdd?

The answer.

(USER WAS BEAT TO DEATH FOR THIS SHITTY POST)

​

HAHA damn klepto :lol:

 

[chimpoid]

DemonStar55: Linux infectable through wine? :blink:
Wine may be infectable. Provided you (a) put some real effort into it and (B) run a windows based scanner under wine.
For reference/comedic value
Running Windows viruses with Wine

From Linux run ClamAV. That runs natively and picks up windows viruses nicely. Safe as houses.
Perhaps even look at AVG free for Linux. It possibly picks up windows nasties as well.

I forgot to specify in my first post "boot live linux" and instead just said "boot linux". Apologies.

 

[ste_167]

Nice response, Klepto!

 

[a3-h]

Knoppix or Puppy can save the day if you use them right.

You could try checking your C:\WINDOWS directory for a winlogon.exe. The real winlogon is in C:\WINDOWS\SYSTEM32. Find it anywhere else, it's a trojan.

​

Ok, that seems fair, i guess.
I tried unblocking it (winlogon.exe in windows/system32) through sygate, and it immediately tries to connect to some f***ing commercial site with the pop-ups and the commercial and the hoyvin-mayvin. @_@;
Same goes for rundll32 (also in sys32 folder).

Chimpoid:
I'm not shure what you mean by wind up function, but I Did run the antivirus, adaware and SBSD through failsafe.
Oh well, I guess I'll just have to convert to Linux. I've been meaning to do that for quite a while, but just haven't had the time to get involved in all that wich is involved in learning a new OS.. ^_^;;


Luckily I've partitioned my hdd into three different sections for emergencies just like this. I'm just a little worried that if I Do fdisk my c: I'll have a trojan somewhere on my other hdds that'll mess everything up again.
On the other hand, it seems as if i've managed to get rid of the virus, as avast isn't finding anything when I run it now (my comp is just very slow from all the unwanted activity going on).
The only thing that pops up every time i do a scan is in adaware, coolwebsearch-somethingsomething.

/a

 

[chimpoid]

Sorry, I forget the name of the function. It's some quick-restore thing that winXP has.
It's causes problems because windows auto-reinstalls system files tht are deleted (I believe) and because the virus masquerades as a windows system file XP restores it after your AV software deletes it.

As stated earlier:
Boot a live linux disk, run Clam AV from there (with the latest dat files) that should clear anythign nasty out.
or:
Install AVG for windows ("free.grisoft.com" I think) and give it a whizz. It's about the best of the bunch in picking up the stray viruses that other software leaves behind.

If avast finds nothing and yet .dll files are still attempting to connect to sites then there are still some fixes to be made.

Found it. System Restore, that's the one. Right click "My Computer" select the "System Restore" tab and then check the box "Turn off System Restore". Once your system is cleaned you can turn it on again but it is inadvisable as it is of little practical use.

Hope it all goes well with the repair.

 

[nickspoon]

Knoppix or Puppy can save the day if you use them right.

You could try checking your C:\WINDOWS directory for a winlogon.exe. The real winlogon is in C:\WINDOWS\SYSTEM32. Find it anywhere else, it's a trojan.

​

Ok, that seems fair, i guess.
I tried unblocking it (winlogon.exe in windows/system32) through sygate, and it immediately tries to connect to some f***ing commercial site with the pop-ups and the commercial and the hoyvin-mayvin. @_@;
Same goes for rundll32 (also in sys32 folder).

In which case, a virus has inserted itself into winlogon.exe and rundll32.exe. These shouldn't normally be accessing the internet. Rundll32 and winlogon are both essential parts of Windows and when each is run (winlogon on startup, rundll32 when using certain Windows functions such as the Control Panel) the virus runs too.

You need to download AVG Free and do a full system scan. AVG Free is an amazing antivirus program anyway, and I advise you keep it. If a full system scan doesn't turn up anything, try going into C:\WINDOWS\SYSTEM32 and running both winlogon and rundll32 manually.

 

[a3-h]

Sorry, I forget the name of the function. It's some quick-restore thing that winXP has.
It's causes problems because windows auto-reinstalls system files tht are deleted (I believe) and because the virus masquerades as a windows system file XP restores it after your AV software deletes it.

As stated earlier:
Boot a live linux disk, run Clam AV from there (with the latest dat files) that should clear anythign nasty out.
or:
Install AVG for windows ("free.grisoft.com" I think) and give it a whizz. It's about the best of the bunch in picking up the stray viruses that other software leaves behind.

If avast finds nothing and yet .dll files are still attempting to connect to sites then there are still some fixes to be made.

Found it. System Restore, that's the one. Right click "My Computer" select the "System Restore" tab and then check the box "Turn off System Restore". Once your system is cleaned you can turn it on again but it is inadvisable as it is of little practical use.

Hope it all goes well with the repair.

​

Ok. So System Restore off, scan with AVG (Anti Virus God, btw..? latest virus defs of course..
No good. AVG went right past both rundll and winlogon (just realized svchost is infected too without detecting anything.. Scanned them all individually too, no go there either.
As soon as i turn off my firewall to check if the coast is clear I get the pop-ups again.
This is rather annoying, i must say.

AVG Did find a shitload of other trojans, tho, but I guess they're all back by now. ;;;

/a

 

[Shikaku]

Try in safe mode.

 

[a3-h]

Try in safe mode.

​

Oh.. Did I forget to write that? ;
My bad.
Scanned it in safemode, and no go.