Any Computer Experts Here That Can Help With Infected Computer?

[DaveP]

For me, there always comes a point where I say it isn't worth the trouble trying to fix it and just reformat my hard drive and reinstall from original disks.

It's a long process (usually takes me about two days and another month getting all my little tweaks/customizations done), but it also clears the garbage that Windows accumulates over time. (I also forget to copy at least one important file and have to work from an old backup.)

I've been thinking of doing that, but I can't find the bookmark folder (I'm using Chrome), and I don't want to have to copy the entire Google folder just for that one thing.

Look here: Google Groups

Inside the "...\Chrome\User Data\Default\" directory are two files. "Bookmarks", and "Bookmarks.bak". One is for your current bookmarks, and the other one (with the .bak extension) signifies that it is a bookmarks backup, if anything goes wrong. Bookmarks.bak gets overwritten every time you close Chrome.

 

[FantWriter]

Thanks!

They sure don't make it easy, do they? First they hide the program folder, then they don't make the bookmarks a recognized file type.

 

[Mac]

Thats some BS. They get your name and email addy and then ask you to buy something from an affiliate. No one else try this unless u want a bunch of spam emails.

You did something wrong. You do not have to buy their products to use their forum and "hijack this" is free. The downside being that the gratification isn't instant. You have to run hijack this and post the log file in the forum then wait a day or 2 for an expert to answer. I don't think I even had to sign up for the forum to use it. When I had the issue they helped me correct I used "guest" access. But it's been more then a year so it may have changed. Whenever I have to sign up somewhere and get acces I just mark their newsletters or whatever as spam and then I stop seeing them. I have not received any unwanted emails from trendmicro. Admittedly it's less then ideal as far as the wait time, but what do you expect for free?

Did you try running that online scan? Sometimes a cloud based scan can do stuff installed ones can't.

 

[Mac]

Here is a tutorial on how to use hijack this **Read Me before posting** - Trend Community

I checked and forum access is still free, there are still experts answering questions for free and you do not have to have any of their pay products to ask for help. What did you click on?

 

[Striker911]

You did something wrong. You do not have to buy their products to use their forum and "hijack this" is free. The downside being that the gratification isn't instant. You have to run hijack this and post the log file in the forum then wait a day or 2 for an expert to answer. I don't think I even had to sign up for the forum to use it. When I had the issue they helped me correct I used "guest" access. But it's been more then a year so it may have changed. Whenever I have to sign up somewhere and get acces I just mark their newsletters or whatever as spam and then I stop seeing them. I have not received any unwanted emails from trendmicro. Admittedly it's less then ideal as far as the wait time, but what do you expect for free?

Did you try running that online scan? Sometimes a cloud based scan can do stuff installed ones can't.

Oh okay. I wasn't sure if they had made some changes since you tried the link or something. I am working with a mod at the Malware bytes forum, so I better hold off till I get the things done he is asking. Same thing your helping me with. So far I have got rid of 3 infected files. More still here though. Just had to get a thumb drive.

 

[Mac]

Yeah, I would stick with the malwarebytes guy. These services are really all pretty similar. Maybe go back to trend if the mb guy can't resolve it. Too many cooks spoils the meal, they say.

 

[DaveP]

Glas you are making some progress, Striker. Virus elimination is like being in a storm at sea. Find the right direction and suddenly you are in calm waters.

Can you post the infections that you have eliminated just for grins? They should be in a file quarantine vault of the program that cleaned it. It also helps if you compare to the list of root kit (boot sector) infections. You can have one of those and it will show up on the report of some virus scanners, but they don't actually fix the problem, they just illuminate the fact that it is there. Once you know you have one, TDSS Killer is the program to use to eliminate it.

I'm not saying you have a boot sector virus, but it sounds like you might. Use TDSS Killer only if you know that you have one on the list. Your virus program may clean it and report success, but the root kit lives outside the realm of the operating system in a separate disk location and will come right back the next time you boot. They build a separate section to store themselves in and place a hook into the MBR to reload the program. When you reboot, they come right back. That's why they are so nasty.

I've dealt with them before and they can run you nuts until you figure out how to eliminate them. A strong telltale is the same virus that shows up over and over as being eliminated by your virus checker program n multiple attempts. Some don't even register on OS virus checkers. TDSS Killer has always been reliable for me in those cases.

How to remove a bootkit

A bootkit is a type of malware that infects the Master Boot Record (MBR).

This infection method allows the malicious program to be executed before the operating system boots. As soon as BIOS (Basic Input Output System) selects the appropriate boot device (it can be a hard disk or a flash drive), the bootkit that resides in the MBR starts executing its code. Once the bootkit receives the control, it usually starts preparing itself (reads and decrypts its auxiliary files in its own file system that it has created somewhere in the unallocated disk space) and returns the control to the legitimate boot loader overseeing all stages of the boot process.

The main feature of a bootkit is that it cannot be detected by standard means of an operating system because all its components reside outside of the standard file systems.
Some types of bootkits hide even the fact that the MBR has been compromised by returning the legitimate copy of the MBR when an attempt to read it has been made.
A system infected with a bootkit can be cured with the TDSSKiller utility.



List of malicious programs

Rootkit.Win32.TDSS, Rootkit.Win32.Stoned.d, Rootkit.Boot.Cidox.a, Rootkit.Boot.SST.a, Rootkit.Boot.Pihar.a,b,c, Rootkit.Boot.CPD.a, Rootkit.Boot.Bootkor.a, Rootkit.Boot.MyBios.b, Rootkit.Win32.TDSS.mbr, Rootkit.Boot.Wistler.a, Rootkit.Win32.ZAccess.aml,c,e,f,g,h,i,j,k, Rootkit.Boot.SST.b, Rootkit.Boot.Fisp.a, Rootkit.Boot.Nimnul.a, Rootkit.Boot.Batan.a, Rootkit.Boot.Lapka.a, Rootkit.Boot.Goodkit.a, Rootkit.Boot.Clones.a, Rootkit.Boot.Xpaj.a, Rootkit.Boot.Yurn.a, Rootkit.Boot.Prothean.a, Backdoor.Win32.Trup.a,b, Backdoor.Win32.Sinowal.knf,kmy, Backdoor.Win32.Phanta.a,b, Virus.Win32.TDSS.a,b,c,d,e, Virus.Win32.Rloader.a, Virus.Win32.Cmoser.a, Virus.Win32.Zhaba.a,b,c, Trojan-Clicker.Win32.Wistler.a,b,c, Trojan-Dropper.Boot.Niwa.a, Trojan-Ransom.Boot.Mbro.d, e, Trojan-Ransom.Boot.Siob.a, Trojan-Ransom.Boot.Mbro.f.

 

[bassnut]

Even after removing a virus isn't it possible to still have registry problems that need correcting?

 

[Striker911]

Even after removing a virus isn't it possible to still have registry problems that need correcting?

Good question.

 

[Mac]

I'd go so far as to say that not only is it possible. It's common. Once you get your system back to normal avg's pc tuneup has a registry fix built in. It's only free on the first scan. after that it's 30 bucks a year. (worth it if you ask me)

 

[Striker911]

I'd go so far as to say that not only is it possible. It's common. Once you get your system back to normal avg's pc tuneup has a registry fix built in. It's only free on the first scan. after that it's 30 bucks a year. (worth it if you ask me)

TY. I looked at AVG registry fix. Found thousand if problems. Just would not let me run it. Think I am about to get back into fixing it. Its been a long day.

 

[DaveP]

Registry hooks can still exist and clutter up the registry, but they are harmless if they point to eradicated programs or routine in the OS. We all have junk in our registry that slows things down. Registry cleaners will generally take out entries that are useless.

This one (CC Cleaner) is free and highly respected. It backs up the registry before cleaning.
http://www.piriform.com/ccleaner/builds