I have never seen a more infected computer in my life

[Som]

boot into safe mode with command prompt.... its an exe usually located in C:\Users\<username>\ or C:\Users\<username>\appdata

sometimes its under C:\ProgramData too, deleted the exes reboot and run malwarebytes, its not that hard really ... all these malwares are the same

[McKay]

Still can't. Go to "more Reply options" and upload it from there. Thanks eddie. :)

Here you go.

[farmeunit]

I offered to fix one of my teacher's daughter's laptops and she has this virus (don't worry link is safe): http://blog.yoocare....fine-to-unlock/

Along with a ton of other viruses/malware/crapware/etc. She is running Windows 7 and has a ton of personal data on it (so she says). I'm doing the job tomorrow. I'm here to tell my plan of attack and take suggestions.

1. I'm going to boot into safe mode with networking and remove those registry entries as shown in the tutorial in the link above.

--I'll take 2 Advil before doing this... :argh:

2. I'm going to remove the crapware

--So I can get some f***ing work done. It's slowing down her machine and clogging up the computer. I will use:

* Revo Uninstaller

* CCleaner

3. Go ham on the malware

- Get all the other crap off. I will use:

* Malwarebytes

* Spybot

* Install MSE when all is said and done. (It's my antivirus of choice)

4. General System maintenance

* Update Drivers

* Update Programs

* Do Windows Updates

What Do ya think?

Boot LiveCD. Copy files. Reformat. Reinstall files. Done.

[spacer]

4. If you're doing your job correctly you're not going to miss something. That's my point. If you're so worried that you're going to miss something, then you're not as confident in your abilities as you should be.

The only problem with that, is that there are no tools or practices that will fully identify, quarantine, and clean a computer with 100% accuracy and guarantee. No anti-virus or malware tool will catch everything. A multi-pass reformat of the drive and its boot sectors is the only way to be sure you have cleaned the infection.

[Astra.Xtreme]

/Facepalm...

LIke I said...we're going in circles. You want to spend your time not learning how to properly clean an infection...cool.

Make sure the next time you hear a knock in your engine that you just drop the whole thing out and replace it then...after all...proper diagnosis and repair is worthless.

Yeah because cars problems have the same principle as PC problems...

FYI, you're just going to lose people's respect if you start demeaning yourself to trolling... Just saying.

[f0rk_b0mb]

Here you go.

Thanks. :) Oh dear...I'd probably fresh install that....with Windows 2000. :)

[Shane Nokes]

Settle down... There's no reason to flip out just because people don't agree with you.

Perhaps for starters, you have to understand the context of the OP's situation. He's saying this is a severely infected machine, so that probably means it's not going to be an easy fix via a virus scan or combo fix. If the infection regenerates, then you'll just be wasting your time trying to get rid of every trace of it.

I still stand by my belief that a backup and reinstall is much quicker. I do it all the time for my client, and it makes both of us feel better knowing that it's a clean slate. Backing up files takes a few minutes to an hour or two, unless they have multiple GBs in media. Then reinstalling Windows takes maybe 30 min via USB. Copy back the files, and you're done in a couple hours and will have full performance.

I'm not saying you're lying, but if it only takes you 3 hours tops to fix any sort of infected machine, then you must not have seen anything severe. Running a full virus scan alone takes an hour or more depending on how fast the PC is. Then anything additional just tacks on more time. The biggest problem I see on PCs is that it's either not fully updated or there's too much crapware installed. A fresh install solves every single one of these problems in minimal time. But again, look at the context of this thread. If the PC is not clearly crippled, then yeah a reinstall probably isn't the best answer.

Flip out? Wow...lol. Dude I'm sitting drinking Game Fuel laughing my ass off. If you think an internet forum makes me flip out...you should see what I've done for the past several years as my day job. :p

The virus cannot replicate if the code isn't running. If the hard drive is scanned offline and handled properly you can clean ANYTHING off it.

As regards severity...I've seen everything man. You do this long enough and work on thousands and thousands of machines...you end up seeing it all. I've seen machines with literally hundreds of infections.

I once had to kick the primary IT guy out of a server room (ends up he's the one who infected the machine by sneaking to view porn in the first place) so that I could clean a machine that we couldn't afford to actually flatten. He hadn't been doing his job and making backups...and our job required that things stay up and running. It was a mission critical type of business (emergency response and such).

Now that one was fun...and the longest case I've ever had to deal with since there wasn't a way to take this system offline without taking the whole place down...

[Brandon H Supervisor]

Thanks. :) Oh dear...I'd probably fresh install that....with Windows 2000. :)

like I said "Oh dear god, KILL IT WITH FIRE!!"

:laugh:

[f0rk_b0mb]

The only problem with that, is that there are no tools or practices that will fully identify, quarantine, and clean a computer with 100% accuracy and guarantee. No anti-virus or malware tool will catch everything. A multi-pass reformat of the drive and its boot sectors is the only way to be sure you have cleaned the infection.

Whoa! Hold up! You mean to tell me this crap can jump from the main partition to the hidden recovery partition? In my situation is this a possibility?

[Shane Nokes]

Yeah because cars problems have the same principle as PC problems...

FYI, you're just going to lose people's respect if you start demeaning yourself to trolling... Just saying.

It's called a comparison. If you were knowledgable about how vehicles work these days you would understand that it's an apt comparison.

That said I'm not trolling, but you can keep claiming that all you want. Feel free to add me to your ignore list...it's pretty easy to do on here, and I won't mind. :)

[xWhiplash]

And you say a full scan takes around an hour? Yeah right, I had old computers that a full scan took 3 hours to complete because A) it was a slower drive and B) they had so much stuff on it.

I have seen a full scan (even from Malwarebytes) take longer than a format and install would take. Even the quick scan on somebodies machine took 35 minutes!

[Shane Nokes]

Whoa! Hold up! You mean to tell me this crap can jump from the main partition to the hidden recovery partition? In my situation is this a possibility?

Infections can hit any point on a system in order to hide. They can even create their own small hidden partitions.

That's what we were talking about earlier with rootkits and MBR infections and such. Those can still be cleaned...but for those who aren't certain they are 100% capable of doing so the best option is to back up and do a low-level format as those can be nasty.

And you say a full scan takes around an hour? Yeah right, I had old computers that a full scan took 3 hours to complete because A) it was a slower drive and B) they had so much stuff on it.

I have seen a full scan (even from Malwarebytes) take longer than a format and install would take. Even the quick scan on somebodies machine took 35 minutes!

As I said...going in circles....

If you don't want to see my posts or deal with what I say...just add me to your ignore list...it's easy and I won't mind. ;)

Oh and btw...show me where I said that a full scan takes an hour...show me a single place where I stated that.

I said the longest an infection has taken me to clean is a total of about 4 hours...the scan is usually the longest part of things. It's the cleanup where I'm extremely efficient.

[f0rk_b0mb]

Infections can hit any point on a system in order to hide. They can even create their own small hidden partitions.

That's what we were talking about earlier with rootkits and MBR infections and such. Those can still be cleaned...but for those who aren't certain they are 100% capable of doing so the best option is to back up and do a low-level format as those can be nasty.

If this machine does have a rootkit, I can remove it by opening up gparted in a Kubuntu live CD, deleting the small partition (it'll probobly be a few megs. right?), merging it with the big partition and if it doesn't boot, boot into a 7 install CD, open up CMD and type /fixmbr and /fixboot. Right?

[Brandon H Supervisor]

Infections can hit any point on a system in order to hide. They can even create their own small hidden partitions.

That's what we were talking about earlier with rootkits and MBR infections and such. Those can still be cleaned...but for those who aren't certain they are 100% capable of doing so the best option is to back up and do a low-level format as those can be nasty.

As I said...going in circles....

If you don't want to see my posts or deal with what I say...just add me to your ignore list...it's easy and I won't mind. ;)

Oh and btw...show me where I said that a full scan takes an hour...show me a single place where I stated that.

I said the longest an infection has taken me to clean is a total of about 4 hours...the scan is usually the longest part of things. It's the cleanup where I'm extremely efficient.

you didn't and that's actually why a few people including me were confused at why you were able to clean so fast

i've had the experience of waiting 3 hours for a scan too

[xWhiplash]

Infections can hit any point on a system in order to hide. They can even create their own small hidden partitions.

That's what we were talking about earlier with rootkits and MBR infections and such. Those can still be cleaned...but for those who aren't certain they are 100% capable of doing so the best option is to back up and do a low-level format as those can be nasty.

As I said...going in circles....

If you don't want to see my posts or deal with what I say...just add me to your ignore list...it's easy and I won't mind. ;)

Oh and btw...show me where I said that a full scan takes an hour...show me a single place where I stated that.

I said the longest an infection has taken me to clean is a total of about 4 hours...the scan is usually the longest part of things. It's the cleanup where I'm extremely efficient.

I thought you did somewhere, maybe it was somebody else. My apologies. But, you said yourself that you can fix ANY computer within only a couple of hours.

A regular PC repair shop though...you can take the time to properly clean the machine. I can be done with that even in the worst of cases within a couple hours.

If it takes you longer, you obviously do not know what you are doing and need to change professions. I just told you from experience, ONE SCAN took 3 hours. That is all I mean, is that from my own experience, just one scan took longer than a format and install would have taken.

[Brandon H Supervisor]

If this machine does have a rootkit, I can remove it by opening up gparted in a Kubuntu live CD, deleting the small partition (it'll probobly be a few megs. right?), merging it with the big partition and if it doesn't boot, boot into a 7 install CD, open up CMD and type /fixmbr and /fixboot. Right?

naw, you don't even need to do that much, kaspersky and Norton both have a couple great rootkit removers (about the only thing norton is good for :p) that will do that for you

[Shane Nokes]

If this machine does have a rootkit, I can remove it by opening up gparted in a Kubuntu live CD, deleting the small partition (it'll probobly be a few megs. right?), merging it with the big partition and if it doesn't boot, boot into a 7 install CD, open up CMD and type /fixmbr and /fixboot. Right?

For rootkits it depends. Generally TDSSKiller is the best way to go, but it doesn't get everything. There are a few other tools that can be used.

When it comes to rootkits though...those can be a pain. That's why I said if it's the case where the person doesn't care so much and you're not 100% sure you can get it...then there is nothing wrong with doing a low-level format and reinstall once everything is backed up.

It took me a while to figure out rootkits and the best ways to clean them. I have a system that I infect on purpose on a regular basis with new stuff as it comes out so I can work on manual cleans.

[majortom1981]

With an infection this bad I find it the easiest to go into safemode first and go through the registry by hand and scan the registry for unneeded entries. Then go into services and make sure you didn't miss anything. Then I go and delete the files manually. Then I use ccleaner and an antivirus.

[Shane Nokes]

you didn't and that's actually why a few people including me were confused at why you were able to clean so fast

i've had the experience of waiting 3 hours for a scan too

Indeed, and that's why I've said that the scan is usually the longest part. Once I know everything that's on the system I can go in and do a very quick clean since once I know what it is I know what to get rid of. :)

After that I do another scan of the system and make sure it's all good.

I think one thing I do differently is that I always handle the scans offline. I don't bother with scans when the system is up and running unless there's absolutely no other option...which has only happened once.

[sc302 Veteran]

Things get infected bad....teenagers are the number one cause of retarded computers, they click on and allow everything.

[Shane Nokes]

I thought you did somewhere, maybe it was somebody else. My apologies. But, you said yourself that you can fix ANY computer within only a couple of hours.

If it takes you longer, you obviously do not know what you are doing and need to change professions. I just told you from experience, ONE SCAN took 3 hours. That is all I mean, is that from my own experience, just one scan took longer than a format and install would have taken.

Indeed. I should have said few instead of couple. The max for me is about 4 hours. That's to scan and clean, and scan again.

As I mentioned above...it might have to do with how often I infect my test machine, and the fact that I do my scans offline. That cuts out a lot of time.

I do agree that it's faster than a format and install...but only a format and install. That ignores putting all of the data back on the machine exactly as it was when you got it.

Maybe it's just my work ethic, but I want my customer to walk out with their machine exactly as they gave it to me...just minus the infections.

[f0rk_b0mb]

Things get infected bad....teenagers are the number one cause of retarded computers, they click on and allow everything.

^^ THIS!!!

[Astra.Xtreme]

Flip out? Wow...lol. Dude I'm sitting drinking Game Fuel laughing my ass off. If you think an internet forum makes me flip out...you should see what I've done for the past several years as my day job. :p

The virus cannot replicate if the code isn't running. If the hard drive is scanned offline and handled properly you can clean ANYTHING off it.

As regards severity...I've seen everything man. You do this long enough and work on thousands and thousands of machines...you end up seeing it all. I've seen machines with literally hundreds of infections.

I once had to kick the primary IT guy out of a server room (ends up he's the one who infected the machine by sneaking to view porn in the first place) so that I could clean a machine that we couldn't afford to actually flatten. He hadn't been doing his job and making backups...and our job required that things stay up and running. It was a mission critical type of business (emergency response and such).

Now that one was fun...and the longest case I've ever had to deal with since there wasn't a way to take this system offline without taking the whole place down...

I'd classify post #38 as a mild flip-out, but whatever.

If you've seen it all, then there's no way you can fix any sort of scenario in the short duration of a few hours.

Unless you have a single app that will fix everything, running scans alone and actually diagnosing the problem kills hours and hours.

Scanning/diagnosing, fixing, and updating takes a lot of time and there is no way around it in even the best case.

The right way to fix a system is the method with a combination of the lowest time spent (customer cost) and the best future reliability. All I, and a few others, have been saying is that it doesn't take much for a backup and reinstall to be the fastest and most reliable choice.

[ShiZZa]

Personally if you don't know what to do and you have to question yourself you might not want to take someones personals things and do the work.

[Shane Nokes]

I'd classify post #38 as a mild flip-out, but whatever.

If you've seen it all, then there's no way you can fix any sort of scenario in the short duration of a few hours.

Unless you have a single app that will fix everything, running scans alone and actually diagnosing the problem kills hours and hours.

Scanning/diagnosing, fixing, and updating takes a lot of time and there is no way around it in even the best case.

The right way to fix a system is the method with a combination of the lowest time spent (customer cost) and the best future reliability. All I, and a few others, have been saying is that it doesn't take much for a backup and reinstall to be the fastest and most reliable choice.

So saying that I'm baffled and stepping back because I don't want to **** people off is flipping out?

Man I'd hate to see what you'd call someone actually flipping out. ;)

You can try to tell me the same thing over and over again...and it doesn't change what I've been doing for years...without an issue.

The way I do things is the reason why I've worked for the government, and why places like MS have me consult on things and even contract my work at points.

I'm good at what I do, and security happens to be one of my specialties.

Personally if you don't know what to do and you have to question yourself you might not want to take someones personals things and do the work.

This ^^