When I turned on my used laptop I brought, it automatically sent me a security alert pop up. Is this a virus?

Question

I purchased it from a guy on Craigslist. The first day I got it home the security alert window kept popping up. After I told him what it was doing..he said "that's odd..but it did have 1 or 2 trojans before." "It was reformatted and should have been empty" he said. This was after I had the laptop in my possession. The ad said no viruses and such and did not say that it had previous viruses or I wouldn't have purchased it. Now it is not showing me anything when I turn it on. It sounds to me like he sold me a faulty laptop that still had virus(es). Did he?

Answer 1

Since you just bought this and there is none of your data stored on the computer doing a reformat would be you best option. The reformat by you should clean it completely and take it back to when it was in the box.

If you did not get the XP disks from the seller then I would immediately suspect an illegal version of XP on the computer. If you did get the disk then doing a reformat should be no problem.

If you do not want to do a reformat then download these programs and follow the steps for proper removal. The ewido is the best Trojan remover available. If these program do not remove the trojan the go to the bottom and use the sites listed there. You may have a Smitfraud or two and they need special programs for removal.

Download and Update Ewido (now called the AVG Antispyware). Do not run:

http://www.ewido.net/en/download/...

Download AdAware SE and update. Do the setup. Do not run:

http://www.filehippo.com/download_ad-aware/

AdAware SE Setup:

1. Select "use custom scanning options" then select "customize". Make sure the following options are enabled: "scan within archives," "scan active processes," "scan registry," "deep scan registry," "scan my IE favorites for banned URLs," "scan my Hosts file."

2. Select the "tweak" option. Under "scanning engine," make sure "unload recognized processes and modules during scan" is enabled. Enable "scan registry for all users instead of current users."

3. Under "cleaning engine" turn on "always try to unload modules…," "during removal unload explorer and IE if necessary," "let windows remove files in use at next restart," and "delete quarantined items after restoring."

4. Use the "select drives and folders to scan" option to ensure that your entire hard drive is scanned (if you have more than one hard drive, scan all of them (of course, do not include floppy and CD/DVD).


TEMPORARILY SHOW HIDDEN FILES AND FOLDERS.

1. Click Start, and then click Control Panel.

2. Click Appearance and Themes, and then click Folder Options.

3. On the View tab, under Hidden files and folders, click "Show hidden files and folders", and clear(uncheck) the "Hide protected operating system files" check box.

IMPORTANT: Files are hidden by Windows for a very good reason. It is not wise to experiment with these files. Unfortunately, to successfully remove modern spyware we must turn this protection off temporarily. Please turn the protection back on when you have finished cleaning your system.


EMPTY INTERNET EXPLORER BROWSER CACHE:

1. On the Internet Explorer Tools menu, click Internet Options.

2. On the General tab, in the Temporary Internet Files section, click the Delete Files button. Select the Delete all offline content check box in the confirmation dialogue box that appears, click OK. Click OK again.

RESTART IN SAFE MODE:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.



START THE SCAN WITH YOUR ANTI-VIRUS OR ANTI-SPYWARE PROGRAM.


When the scan and removal are completed REBOOT COMPUTER. This will restart you in normal mode. DON'T FORGET TO RESET HIDDEN FILES AND FOLDERS.


NEW RESTORE POINT.

The RESTORE POINTS may be infected with the Malware and cannot be used.

HERE'S HOW:

1. Click Start, and then click Control Panel.

2. Click Performance and Maintenance, click System, and then click on the System Restore tab.

3. Select the Turn Off System Restore check box, click Apply, then restart your computer.

4. Return to the System Restore Tab and turn System Restore back on.


TO SET A NEW RESTORE POINT:

1. Click the Start button.

2. Point to Programs, then navigate to Accessories, then System Tools, then click System Restore.

3. Choose Create a restore point, and then click Next.

4. In the Restore point description box, type a name for your restore point, and then click Next.

5. Click OK.

NOTE: If you are using Windows XP Service Pack 2 (SP2) and are unable to access the Internet after removing Malware, there is a command that may fix the problem. It works by resetting the winsock catalogue. Click on Start, then Run and type CMD in the box. Click OK. Type "netsh winsock reset" (no quotes)into the DOS window that appears.


ADDITION INFORMATION ABOUT TROJANS:

There are Trojans that fall into the Smitfraud family. These require the use of a specialized program for removal. Here are two sites that specialize in removing these:

http://www.internetinspiration.co.uk/roguefix.htm

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

Answer 2

Well it sure does not sound good. However lets check it for virus and while we are at it spyware/adaware. If it was reformatted it would not have these viruses.


Update and run your Anti-Virus program. Don't have one? You can run a free online scan from Trendmicro. When I have tested it it takes some time to run it but it may be time well spent if it can fix any problems.

Download and run http://housecall.trendmicro.com/


Download, update and run Spybot---http://www.safer-networking.org/ . Don't forget to use the Immunize feature.

Download, update and run Adaware---http://www.lavasoftusa.com/software/adaware/products/select_your_product.php

Download HijackThis---http://www.spywareinfo.com/~merijn/programs.php#hijackthis. Run and Save a Log. When you log comes up copy and paste the entire log at http://www.hijackthis.de/ . Analyze your results. You will then get a screen that will tell you if you have any nasty stuff in your computer. Follow instructions to deal with any nasties. CAUTION: This is a very powerful tool. Be careful.

Answer 3

It sounds like this isn't popping out of your man or woman safe practices software, so some thing has made itself at residing house on your gadget. particularly, do not take its suggestion. It sounds like spyware, so I recommend you purchased ad-conscious SE and Spybot S&D (they’re loose), set up them, replace them and run them. If both one doesn’t seem to be able to remove each little thing it comments searching, try operating it back in secure Mode. secure Mode in many circumstances prevents malware from keeping itself. also, turn off equipment fix to evict any copies of undesirable stuff which could be lurking there. To get into secure Mode: a million. signal off and reboot your gadget. 2. at the same time as the gadget starts the reboot sequence, press the F8 key back and back. 3. elect secure Mode from the consequent menu. 4. The gadget will proceed booting, besides the indisputable fact that the residing house windows personal computer will seem diverse. you would possibly want to not be able to work out the internet, for instance. Log in as Administrator. Administrator in many circumstances has no password. 5. once you're finished, signal off and reboot decrease back into prevalent mode. replace and run all of them frequently. good success.