Please help me kill this unknown virus

[Guest aida135]

Hi

 

Last night a virus attack my PC while i'm online. First my internet

browser help box pops up, then it types letters into the search box.

Atterwards it rename my floopy drive and my second hdd. The hdd was

rename w.0w. My internet browser help box pops up again up to 30

windows, and it types w.0w in the search box. When i activate my

windows defender, it try to shut it off, by poping its helps box

nearly 50 times, and even try to change the scan settings. What kind

of virus is this? My maliciuos software removal scan and AVG anti virus

scans turns out nothing. Please help me kill this virus.

 

 

aida

[Guest smlunatick]

Re: Please help me kill this unknown virus

 

On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:

> Hi

>

> Last night a virus attack my PC while i'm online. First my internet

> browser help box pops up, then it types letters into the search box.

> Atterwards it rename my floopy drive and my second hdd. The hdd was

> rename w.0w. My internet browser help box pops up again up to 30

> windows, and it types w.0w in the search box. When i activate my

> windows defender, it try to shut it off, by poping its helps box

> nearly 50 times, and even try to change the scan settings. What kind

> of virus is this? My maliciuos software removal scan and AVG anti virus

> scans turns out nothing. Please help me kill this virus.

>

> aida

 

This does not describe a virs but some type of spyware / malware. You

should get several spyware removal tools like SuperAnitSpyware and do

a complete scan / clean up.

[Guest Malke]

Re: Please help me kill this unknown virus

 

aida135 wrote:

> Hi

>

> Last night a virus attack my PC while i'm online. First my internet

> browser help box pops up, then it types letters into the search box.

> Atterwards it rename my floopy drive and my second hdd. The hdd was

> rename w.0w. My internet browser help box pops up again up to 30

> windows, and it types w.0w in the search box. When i activate my

> windows defender, it try to shut it off, by poping its helps box

> nearly 50 times, and even try to change the scan settings. What kind

> of virus is this? My maliciuos software removal scan and AVG anti virus

> scans turns out nothing. Please help me kill this virus.

 

This doesn't sound like a virus so much as spyware. However, better to be

thorough in your scanning, especially since you're using AVG which isn't

one of my favorites.

 

Go through these general malware removal steps systematically -

http://www.elephantboycomputers.com/page2.html#Removing_Malware

 

Include scanning with David Lipman's Multi_AV and follow instructions to do

all scans in Safe Mode.

 

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions

http://tinyurl.com/yoeru3 - download link and more instructions

 

You can also check to see if there are targeted removal steps for your

malware here:

Bleeping Computer removal how-to's -

http://www.bleepingcomputer.com/forums/forum55.html

 

When all else fails, get guided help. Choose one of the specialty forums

listed at the first link. Register and read its posting FAQ. You will

generally be asked to:

 

1. Download and execute HiJack This! (HJT) -

http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

 

2. Disable Notepad's word wrap - In Notepad.exe; Format --> uncheck; "Word

wrap"

 

3. Download/run Deckard's System Scanner -

http://www.techsupportforum.com/sectools/Deckard/dss.exe

 

4. Save the scan results (Main.txt and Extra.txt)

 

5. And then post the contents of Main.txt and Extra.txt in your post at the

forum you chose. DO NOT POST LOGS IN THE MS NEWSGROUPS.

 

Standard disclaimer: I can't see and test your computer myself, so these are

just suggestions based on many years of being a professional computer tech;

suggestions based on what you've written. You should not take my

suggestions as a definitive diagnosis. If you can't do the work yourself

(and there is no shame in admitting this isn't your cup of tea), take the

machine to a professional computer repair shop (not your local equivalent

of BigComputerStore/GeekSquad). Please be aware that not all local shops

are skilled at removing malware and even if they are, your computer may be

so infested that Windows will need to be clean-installed. If possible, have

all your data backed up before you take the machine into a shop.

 

Malke

--

MS-MVP

Elephant Boy Computers

http://www.elephantboycomputers.com

Don't Panic!

[Guest Just.some.guy]

Re: Please help me kill this unknown virus

 

 

"smlunatick" <yveslec@gmail.com> wrote in message

news:7c08e77c-9f84-4d1f-9a67-a40e9bd76aee@a70g2000hsh.googlegroups.com...

On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:

> Hi

>

> Last night a virus attack my PC while i'm online. First my internet

> browser help box pops up, then it types letters into the search box.

> Atterwards it rename my floopy drive and my second hdd. The hdd was

> rename w.0w. My internet browser help box pops up again up to 30

> windows, and it types w.0w in the search box. When i activate my

> windows defender, it try to shut it off, by poping its helps box

> nearly 50 times, and even try to change the scan settings. What kind

> of virus is this? My maliciuos software removal scan and AVG anti virus

> scans turns out nothing. Please help me kill this virus.

>

> aida

 

This does not describe a virs but some type of spyware / malware. You

should get several spyware removal tools like SuperAnitSpyware and do

a complete scan / clean up.

 

The poster might also want to try Spybot search & destroy...it's good and

it's free...they can get it from here:

http://www.download.com/3120-20_4.html?qt=spybot&tag=srch&tg=dl-20

[Guest dizzyd]

Re: Please help me kill this unknown virus

 

spybot search and detroy is another program you can try and i think microsoft

have their own anti spyware.

 

"smlunatick" wrote:

> On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:

> > Hi

> >

> > Last night a virus attack my PC while i'm online. First my internet

> > browser help box pops up, then it types letters into the search box.

> > Atterwards it rename my floopy drive and my second hdd. The hdd was

> > rename w.0w. My internet browser help box pops up again up to 30

> > windows, and it types w.0w in the search box. When i activate my

> > windows defender, it try to shut it off, by poping its helps box

> > nearly 50 times, and even try to change the scan settings. What kind

> > of virus is this? My maliciuos software removal scan and AVG anti virus

> > scans turns out nothing. Please help me kill this virus.

> >

> > aida

>

> This does not describe a virs but some type of spyware / malware. You

> should get several spyware removal tools like SuperAnitSpyware and do

> a complete scan / clean up.

>

[Guest Ken Blake, MVP]

Re: Please help me kill this unknown virus

 

On Sun, 1 Jun 2008 08:26:00 -0700, dizzyd

<dizzyd@discussions.microsoft.com> wrote:

> spybot search and detroy is another program you can try and i think microsoft

> have their own anti spyware.

 

 

Microsoft's anti-spyware product is Windows Defender, which aida has

already said didn't solve the problem.

 

> "smlunatick" wrote:

>

> > On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:

> > > Hi

> > >

> > > Last night a virus attack my PC while i'm online. First my internet

> > > browser help box pops up, then it types letters into the search box.

> > > Atterwards it rename my floopy drive and my second hdd. The hdd was

> > > rename w.0w. My internet browser help box pops up again up to 30

> > > windows, and it types w.0w in the search box. When i activate my

> > > windows defender, it try to shut it off, by poping its helps box

> > > nearly 50 times, and even try to change the scan settings. What kind

> > > of virus is this? My maliciuos software removal scan and AVG anti virus

> > > scans turns out nothing. Please help me kill this virus.

> > >

> > > aida

> >

> > This does not describe a virs but some type of spyware / malware. You

> > should get several spyware removal tools like SuperAnitSpyware and do

> > a complete scan / clean up.

> >

 

--

Ken Blake, Microsoft MVP - Windows Desktop Experience

Please Reply to the Newsgroup

[Guest Just.some.guy]

Re: Please help me kill this unknown virus

 

 

"Ken Blake, MVP" <kblake@this.is.an.invalid.domain> wrote in message

news:7mh544lvmn5oi8k99ue2t8k8t4m33e8mnh@4ax.com...

> On Sun, 1 Jun 2008 08:26:00 -0700, dizzyd

> <dizzyd@discussions.microsoft.com> wrote:

>

>> spybot search and detroy is another program you can try and i think

>> microsoft

>> have their own anti spyware.

>

>

> Microsoft's anti-spyware product is Windows Defender, which aida has

> already said didn't solve the problem.

 

Which could mean Defender is not as good as Spybot and Spybot *would* solve

it.

>

>

>> "smlunatick" wrote:

>>

>> > On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:

>> > > Hi

>> > >

>> > > Last night a virus attack my PC while i'm online. First my internet

>> > > browser help box pops up, then it types letters into the search box.

>> > > Atterwards it rename my floopy drive and my second hdd. The hdd was

>> > > rename w.0w. My internet browser help box pops up again up to 30

>> > > windows, and it types w.0w in the search box. When i activate my

>> > > windows defender, it try to shut it off, by poping its helps box

>> > > nearly 50 times, and even try to change the scan settings. What kind

>> > > of virus is this? My maliciuos software removal scan and AVG anti

>> > > virus

>> > > scans turns out nothing. Please help me kill this virus.

>> > >

>> > > aida

>> >

>> > This does not describe a virs but some type of spyware / malware. You

>> > should get several spyware removal tools like SuperAnitSpyware and do

>> > a complete scan / clean up.

>> >

>

> --

> Ken Blake, Microsoft MVP - Windows Desktop Experience

> Please Reply to the Newsgroup

[Guest PA Bear [MS MVP]]

Re: Please help me kill this unknown virus

 

Unexplained computer behavior may be caused by deceptive software

http://support.microsoft.com/kb/827315

 

Run a /thorough/ check for hijackware, including posting your hijackthis log

to an appropriate forum.

 

Checking for/Help with Hijackware

http://aumha.org/a/parasite.htm

http://aumha.org/a/quickfix.htm

http://aumha.net/viewtopic.php?t=5878

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

http://mvps.org/winhelp2002/unwanted.htm

http://inetexplorer.mvps.org/data/prevention.htm

http://inetexplorer.mvps.org/tshoot.html

http://www.mvps.org/sramesh2k/Malware_Defence.htm

http://defendingyourmachine2.blogspot.com/

http://www.elephantboycomputers.com/page2.html#Removing_Malware

 

When all else fails, HijackThis v2.0.2

(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.

It will help you to both identify and remove any hijackware/spyware with

assistance from an expert. **Post your log to

http://forums.spybot.info/forumdisplay.php?f=22,

http://castlecops.com/forum67.html,

http://forums.subratam.org/index.php?showforum=7,

http://aumha.net/viewforum.php?f=30, or other appropriate forums for review

by an expert in such matters, not here.**

 

If the procedures look too complex - and there is no shame in admitting this

isn't your cup of tea - take the machine to a local, reputable and

independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

--

~Robear Dyer (PA Bear)

MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

AumHa VSOP & Admin http://aumha.net

DTS-L http://dts-l.net/

 

aida135 wrote:

> Hi

>

> Last night a virus attack my PC while i'm online. First my internet

> browser help box pops up, then it types letters into the search box.

> Atterwards it rename my floopy drive and my second hdd. The hdd was

> rename w.0w. My internet browser help box pops up again up to 30

> windows, and it types w.0w in the search box. When i activate my

> windows defender, it try to shut it off, by poping its helps box

> nearly 50 times, and even try to change the scan settings. What kind

> of virus is this? My maliciuos software removal scan and AVG anti virus

> scans turns out nothing. Please help me kill this virus.

>

>

> aida

[Guest Patrick Keenan]

Re: Please help me kill this unknown virus

 

"aida135" <aida135@discussions.microsoft.com> wrote in message

news:B087052E-C715-43FE-889E-827E61996607@microsoft.com...

> Hi

>

> Last night a virus attack my PC while i'm online. First my internet

> browser help box pops up, then it types letters into the search box.

> Atterwards it rename my floopy drive and my second hdd. The hdd was

> rename w.0w. My internet browser help box pops up again up to 30

> windows, and it types w.0w in the search box. When i activate my

> windows defender, it try to shut it off, by poping its helps box

> nearly 50 times, and even try to change the scan settings. What kind

> of virus is this? My maliciuos software removal scan and AVG anti virus

> scans turns out nothing. Please help me kill this virus.

>

>

> aida

 

What happened when you physically disconnected from the network - unplugged

the cable?

 

-pk

[Guest aida135]

Re: Please help me kill this unknown virus

 

Same thing happens. The help box pop up several times with the typing, in

fact the changes on my defender scan setting heppened after i deisconnected

fom the internet

 

"Patrick Keenan" wrote:

> "aida135" <aida135@discussions.microsoft.com> wrote in message

> news:B087052E-C715-43FE-889E-827E61996607@microsoft.com...

> > Hi

> >

> > Last night a virus attack my PC while i'm online. First my internet

> > browser help box pops up, then it types letters into the search box.

> > Atterwards it rename my floopy drive and my second hdd. The hdd was

> > rename w.0w. My internet browser help box pops up again up to 30

> > windows, and it types w.0w in the search box. When i activate my

> > windows defender, it try to shut it off, by poping its helps box

> > nearly 50 times, and even try to change the scan settings. What kind

> > of virus is this? My maliciuos software removal scan and AVG anti virus

> > scans turns out nothing. Please help me kill this virus.

> >

> >

> > aida

>

> What happened when you physically disconnected from the network - unplugged

> the cable?

>

> -pk

>

>