How do I rid myself of this nasty virus? Can I restore my my system to get rid of it?

Question

When close explorer, i can still hear advertisements running in the backround .When I look at my processes I see explorer and iexplorer still running, and the iexplorer is running at 150,000K. I tried scanning it with Norton and MOD32 and im still having the problem and pop-ups. (fyi, i deleted norton before getting MOD32) Nothing is working, how about restoring my computer? Will I lose all info on work software?

Answer 1

OK do a system restore to time you think you did not have the virus and use these free anti virus and anti spy ware install them and then do a scan and you should be alright
http://www.superantispyware.com/
http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10645435.html?tag=pop.software
these are free program so keep them and do reg. scans

Answer 2

You sound knowledgeable enough about pc's, so here's what I'd recommend:
First, if you do have a virus, chances are it has infected the files in your system restore files as well. So, first thing you need to do is update your current anti-virus program with the latest virus definitions. Next, Right click on "My Computer", then click on "Properties", then on the System Restore tab. You will see a box that says "Turn Off System Restore On All Drives".....check that box. Click on "Apply", and then "OK".
Now exit from there and reboot your computer into Safe Mode by tapping the F8 key as the pc starts up. Once in Safe Mode, run your anti-virus program so that it does a complete scan. If a virus does exist, your anti-virus program should find it and get rid of it. Once you're done, reboot into normal Windows mode and go back to System Restore and UN-check that box you checked earlier. Hope this helps.

Answer 3

It may be some other form of malware that is not considered a virus. You need to run some spyware software to clear this stuff off.

The problem with doing a restore is that if the 'virus' is present in the computer's memory it could simply re-install itself as soon as you have finished rolling back your machine.

Answer 4

You have not got a virus, Nod32 would of pick it up straight away, you have got spyware, what spyware program are you running ?
If you have the yahoo toolbar run the free Norton spyware scan (make sure you tick the cookie box), if you've not got a spyware program download ad-aware se & run it.

ZCT answer is a good answer.

Answer 5

Run a virus scan weekly.

Update and run your Anti-Virus program. Don't have one? You can run a free online scan from CA.
http://www3.ca.com/securityadvisor/virus...



Run Spybot and Adaware weekly.


Download, update and run Spybot---http://www.safer-networking.org/... . Don't forget to use the Immunize feature.

Download, update and run Adaware---http://www.lavasoftusa.com/software/adaw...

Now to prevent spyware from being installed in the first place....

Download SpywareBlaster---http://majorgeeks.com/download2859.html
SpywareBlaster doesn't scan and clean for spyware - it prevents it from ever being installed.

It's main features include:
- Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
- Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
- Restrict the actions of potentially dangerous sites in Internet Explorer.

Answer 6

yip your have been given the spectacular theory to bypass to secure mode restart your pc then upon commencing push f8 quickly until eventually you hear a beep which potential "ok i know already, you like besides in secure mode" yet a itemizing comes up in basic terms scroll down with the arrow key to the place it says secure mode. there you bypass your on your thank you to delete that nasty virus. good success

Answer 7

You may get better results by using programs and procedures designed to remove the type of infections you have on your computer.

Attacking the Trojan that downloaded the adware and the adware itself is the advisable approach.

Download and Update Ewido (now called the AVG Antispyware). Do not run:

http://www.ewido.net/en/download/

Download AdAware SE and update. Do the setup. Do not run:

http://www.filehippo.com/download_ad-aware/

AdAware SE Setup:

1. Select "use custom scanning options" then select "customize". Make sure the following options are enabled: "scan within archives," "scan active processes," "scan registry," "deep scan registry," "scan my IE favorites for banned URLs," "scan my Hosts file."

2. Select the "tweak" option. Under "scanning engine," make sure "unload recognized processes and modules during scan" is enabled. Enable "scan registry for all users instead of current users."

3. Under "cleaning engine" turn on "always try to unload modules…," "during removal unload explorer and IE if necessary," "let windows remove files in use at next restart," and "delete quarantined items after restoring."

4. Use the "select drives and folders to scan" option to ensure that your entire hard drive is scanned (if you have more than one hard drive, scan all of them (of course, do not include floppy and CD/DVD).


TEMPORARILY SHOW HIDDEN FILES AND FOLDERS.

1. Click Start, and then click Control Panel.

2. Click Appearance and Themes, and then click Folder Options.

3. On the View tab, under Hidden files and folders, click "Show hidden files and folders", and clear(uncheck) the "Hide protected operating system files" check box.

IMPORTANT: Files are hidden by Windows for a very good reason. It is not wise to experiment with these files. Unfortunately, to successfully remove modern spyware we must turn this protection off temporarily. Please turn the protection back on when you have finished cleaning your system.


EMPTY INTERNET EXPLORER BROWSER CACHE:

1. On the Internet Explorer Tools menu, click Internet Options.

2. On the General tab, in the Temporary Internet Files section, click the Delete Files button. Select the Delete all offline content check box in the confirmation dialogue box that appears, click OK. Click OK again.

RESTART IN SAFE MODE:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.



START THE SCAN WITH YOUR PROGRAM(S).



When the scan and removal are completed REBOOT COMPUTER. This will restart you in normal mode.

RESET HIDDEN FILES AND FOLDERS.

The RESTORE POINTS may be infected with the Malware and cannot be used. Delete the old one(s) and make a new one.

CLEAR OLD RESTORE POINT(S). HERE'S HOW:

1. Click Start, and then click Control Panel.

2. Click Performance and Maintenance, click System, and then click on the System Restore tab.

3. Select the Turn Off System Restore check box, click Apply, then restart your computer.

4. Return to the System Restore Tab and turn System Restore back on.


TO SET A NEW RESTORE POINT:

1. Click the Start button.

2. Point to Programs, then navigate to Accessories, then System Tools, then click System Restore.

3. Choose Create a restore point, and then click Next.

4. In the Restore point description box, type a name for your restore point, and then click Next.

5. Click OK.

NOTE: If you are using Windows XP Service Pack 2 (SP2) and are unable to access the Internet after removing Malware, there is a command that may fix the problem. It works by resetting the winsock catalogue. Click on Start, then Run and type CMD in the box. Click OK. Type "netsh winsock reset" (no quotes)into the DOS window that appears.




ADDITION INFORMATION ABOUT TROJANS:

There are Trojans that fall into the Smitfraud family. Smitfrauds are usually Homepage/Browser Hijackers. A Homepage Hijacker takes you to a website other than what you have set on your computer. A Browser Hijacker directs you to websites other than what you just selected. These require the use of a specialized program for removal. Here are two sites that specialize in removing these:

http://www.internetinspiration.co.uk/roguefix.htm

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php



Another type of Trojan that requires a specialized removal program is Vundo Trojans.

The procedure should fix Vundo-based Winfixer(WinAntiSpyware, WinAntiVirus, Blackworm, Amaena)problems.

http://www.atribune.org/content/view/24/2/

Answer 8

Check out .
http://sumiram2006.googlepages.com/comba...
It has good downloads to detect and eliminate virus/trojans/spyware
Best wishes

Answer 9

system restore is the one thats reinstalling the virus ..u need uncheck ur system restore ..scan ur comp in the safe mode(F8 for XP)..u can reactivate ur system restore once ur done ...

Answer 10

Yes you can try to restore to an earlier time. worth a try!