computer help required-part 2

[scotta]

VRSY

Sorry to sort of hijack your thread but in the last 24 hours my 'Windows Essentials Security' has been going mad picking up hundreds of threats all related to some sort of virus called 'win32-zafi-b'

I have downloaded Spyware Doctor 7 - free version and it has scanned my system and picked up 16 high level infections and 532 threats but the free version does not remove them.

My essentials security programme does not seem to be able to clear this repeating virus, it seems to jump from one file to the next. It took my PC nearly 24 hours to do a scan and clean, but the threats still keep appearing.

I will try following some of the advice already in the thread but anyone got any specific advice on this issue

Thanks in advance

If its that bad in all honesty copy all your data off then remaster the system with the recovery disks/partition then copy all your stuff back on. That is the only true way to totally get rid of the threat and infections.

[gtipirelli]

Thanks guys, not really what what I wanted to hear as I am bit of a beginner when it comes to partitioning hard drives, booting up in safe mode etc etc.

I will firstly try some of the advice already offered from earlier in the thread over the weekend before getting too depressed.

It seems to be better than it was and I am sure it is fixable. It is the only PC in the house so just a bit concerned at the moment about transferring the issue to another PC before fixing it.

Thanks and keep the advice coming. I was hoping to get a post back that gave a specific fix !!!!!!!

[edd666999]

Boot to safe mode, follow the steps I outlined about speeding your machine up but don't do the chkdsk. Download and run hijackthis, rename the exe file to something random select the option to scan and save a log,  the log that appears at the end copy and paste into hijackthis.de and it will tell you what to tick. this will decrease your scan times, download webroot internet security trial go to custom scan and under advanced select scan masked files, then uninstall, install counterspy run it with a deep scan, remove that and install avg internet security run both pc scan and a rootkit scan, then run malware bytes and if infections still show run kaspersky SOS. If after all that your still having issues then drop me a pm.

[edd666999]

Reinstalling your OS isn't the only true way to remove infections (unless you work for pc world) it is how ever the quickest way.

[cmdrfire]

Nuke the site from orbit I say.

First format the drive.


Then format it again.


Then put it in the microwave for 45 seconds at full blast*.



Then toss it in the skip.




That'll get rid of it.



/unhelpful




*I am not responsible for any damage or loss of data or life or injury or anything at all in fact caused as a result of this post.

[cmdrfire]

...


on a more helpful note:
1) use a combination of ad-aware, Spybot, and AVG to clean out a system. Best to do it offline. Disconnect the infected machines from the internet/network (this should be done IMMEDIATELY as soon as a virus/threat is discovered). Download Ad-aware/Spybot S&D/AVG onto a USB key from an unaffected computer All three have free versions available. Do NOT connect the infected machines to the network or internet. Run all three of those at least twice, rebooting between runs. A run in safe mode is also useful.
2) Use a browser like Firefox if you don't already. Do not run unsigned software unless you're 100% certain what you're running.
3) @OP, educate your niece as to why she should not just download random softwares even if it turns a her photo into a Navi face.
4) @Scotta, try this link to get rid of trojan 'win32-zafi-b". Not sure on it's effectiveness, but try it. http://www.bitdefender.com/VIRUS-33771-en--Win32.Zafi.B@mm.html

[gtipirelli]

I have tried running various bits of software that you have all recommended and it has found and deleted quite a lot.

I am however still getting Microsoft essential security going mad with 'detected items' called 'Virus:Win32/Ramnit.B'

It is popping up with threat messages saying has found 301, 302, 303 threats and it grinding the PC to a halt almost.

Anyone know any software that may help this. I am a total beginner at this and do not even know how to start the PC up in safe mode - so your instructions lost me straight after that.

I only have the one PC in the house so cannot connect to the internet in any other way.

Also, I click on the free spyot download link and it shoots off to the Google main page !!!!

Any help apreciated - this PC has all our family photos on and I losing them does not bear thinking about

[edd666999]

To get into safe mode.

Turn your machine off. As soon as you press the power button to turn the machine back on, keep tapping on F8. This will bring you to a black screen woth white writing, you will be able to select safemode with networking using the arrow keys on your keyboard

[gtipirelli]

EDD

Thanks, do you recommend I run the various malware/virus scans in safe mode.

It is all a bit chicken and egg as I need to use the PC to get onto the internet to download the software but the recommendation is always not to use the net in these circumstances.

This win32/ramnitB thing is a bugger and I cannot shift it

Thanks

Alan

[edd666999]

Yea use the internet on the pc, I remove infection as part of my job everyday and do this through the internet with a remote connection to a clients machine. In safe mode non of the infections will be able to run, so if you follow what I have previously said in this thread you will be fine

[stealthwolf]

I did mention this earlier - boot into safe mode and run each scan through that.

[gtipirelli]

Edd

Progress so far - though I can see myself getting in touch with you !!

I ran the ccleaner software and then followed your instructions for - 'click start run and type "msconfig" select the startup tab, using http://www.bleepingcomputer.com/startups/ go through and remove the un-needd ones'

I then Booted to safe mode, followed the steps you outlined about speeding my machine up but didnt do the chkdsk. Downloaded and ran hijackthis, renamed the exe file to something random select the option to scan and save a log,  the log that appears at the end copy and paste into hijackthis.de and it will tell you what to tick. this will decrease your scan times. Ths showed up some pretty nasty items which I checked off.

I then tried to download webroot internet security trial but I could not work out where or how to get it off the net. There just did not seem to be an obvious download button.

Then downloaded and tried to run counterspy but error message came up saying ‘The system administrator has set policies to prevent this installation’

I am now loading up AVG, will rerun malware bytes and try Kaspersky SOS.

I will then probably give you a shout.

My PC seems to be making a strange insect noise (like a cricket) every 10 secs or so and has done ever since the virus appeared. Before I uninstalled microsft essential security (AVG was conflicting with it) it was still picking the threats this morning.

Thanks

Alan