- Damage after virus
- Posted by Michael on May 6th, 2006
After having had virus on my computer, which now has been removed, XP have
been damaged. I have Service Pack 2 installed.
Problems and symptoms: Several functions are missing from the process line
and the computer does often not respond in several minutes and the function
‘Alt-Ctrl-Del’ does not work and if it comes up it can only be seen on the
process line but no actually accessed. Also Internet Explorer creates a lot
of problems. The computer can often not shot down and the power has to be
switch off.
I have tried to regenerate the system from a time where it worked but no
changes could be done. I have tried to reinstall SP2 again which also helps
for a while until the computer has been shot down/restarted a couple of
times, then the problems reoccur.
I ran a diagnosis program online which came up with 734 minor errors and 2
severe errors.
Any suggestions what to do? I feel I have to reinstall XP but how do I go
about it and would it be advisable to format the HD at the same time?
- Posted by Carey Frisch [MVP] on May 6th, 2006
A virus attack mandates a complete "clean install".
Why? Read the following:
Viruses - I feel your pain
http://blogs.msdn.com/larryosterman/...18/159482.aspx
Clean Install Windows XP
http://www.michaelstevenstech.com/cleanxpinstall.html
--
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/
---------------------------------------------------------------------------Â*----------------
"Michael" wrote:
| After having had virus on my computer, which now has been removed, XP have
| been damaged. I have Service Pack 2 installed.
| Problems and symptoms: Several functions are missing from the process line
| and the computer does often not respond in several minutes and the function
| ‘Alt-Ctrl-Del’ does not work and if it comes up it can only be seen on the
| process line but no actually accessed. Also Internet Explorer creates a lot
| of problems. The computer can often not shot down and the power has to be
| switch off.
| I have tried to regenerate the system from a time where it worked but no
| changes could be done. I have tried to reinstall SP2 again which also helps
| for a while until the computer has been shot down/restarted a couple of
| times, then the problems reoccur.
| I ran a diagnosis program online which came up with 734 minor errors and 2
| severe errors.
| Any suggestions what to do? I feel I have to reinstall XP but how do I go
| about it and would it be advisable to format the HD at the same time?
- Posted by Plato on May 6th, 2006
=?Utf-8?B?TWljaGFlbA==?= wrote:
Best bet in the future is to NOT download a virus. Second best bet that
if you do download one, is choose NOT to install it. It's all up to you.
That's why the best bet is to avoid downloading/installing viruses in
the first place, rather then deal with the damage they leave behind
after you remove them.
It's all up to you.
--
http://www.bootdisk.com/
- Posted by DanS on May 6th, 2006
=?Utf-8?B?TWljaGFlbA==?= <Michael@discussions.microsoft.com> wrote in
news:192007E4-C2FA-4971-B1DB-6DE4350786B6@microsoft.com:
Internet Explorer creates a lot of problems for everyone.
Are you sure it was a virus and not some Spyware/Adware ?
- Posted by cquirke (MVP Windows shell/user) on May 7th, 2006
On Sat, 6 May 2006 11:14:01 -0700, Michael
Which virus or malware?
How was this done; what OS boot, what tool(s)?
Did the cleaning process have to disinfect any existing files, and if
so, what files were they? Disinfected code files may be clean, but
they may not always work properly.
Define "process line"?
Malware can nuke maintenance tools such as Task Manager, Regedit,
MSConfig, av scanners and firewall software - and the damage may
persist after the malware is killed. Three methods & results:
- malware active interceptions; fixed when malware's deactivated
- malware integrations; fixed when malware's properly cleaned
- malware changes settings; changes may persist <- you are here?
IE, Tools, Options:
- clear Internet temp files, [x] All downloaded content
- Advanced tab; [x] Allow 3rd-party browser enhancements
Does that help? IE offers a feast of opportunities for malware to
patch in; the above should at least de-bulk the tumour load.
OK
Do you mean System Restore? If so, let's hope you didn't restore the
malware from SR's hidden store of backed-up material :-(
Does this regress even if you have not been on the Internet?
URL? Many online sites are themselves malware, so it matters which.
"Just" re-installing Windows may not fix this, and may leave you with
a considerably more exploitable code base as patches are lost. Do NOT
connect pre-SP2 XP to the 'net without enabling the firewall !!
http://cquirke.mvps.org/reinst.htm refers.
You need to exlude malware - a process that is made considerably more
difficult because MS defaults to using NTFS that can't be scanned or
managed from a DOS diskette boot, and provides no maintenance OS that
can be booted independently of the infected HD installation.
Google( Bart PE) and good luck!
- Posted by cquirke (MVP Windows shell/user) on May 7th, 2006
On Sat, 6 May 2006 13:18:54 -0500, "Carey Frisch [MVP]"
Are you saying that the Windows platform has abandoned the fight for
recoverability after malware infection? Given the infection load that
the OS has to contend with, this is disasterous news if so.
This is a rather pathetic case of "it's so difficult, let's give up"
that started from a somewhat unique situation (running a pre-release
version of a new upcoming Service Pack).
If you haven't a clue how to determine whether your PC is clean, how
will you be sure it stays clean after it is "just" re-installed?
That's about installing XP as an upgrade of an older OS.
You may be clean after "just" wiping and rebuilding the system, but
that may last only until you:
- restore backed-up "data"
- infectable code stored inappropriately in "My Documents" etc.
- infected incoming material e.g. "My Recieved Files"
- hidden infected incoming material e.g. mail stores
- exploitable internal risk surfaces
- go online
- unpatched fresh install code base is exploitable
- firewall off by default if < SP2
- no av, or outdated av from installation CD
- can't patch or update av until exposed to re-infection
See http://cquirke.mvps.org/reinst.htm
- Posted by cquirke (MVP Windows shell/user) on May 7th, 2006
On 6 May 2006 14:05:03 -0500, Plato <|@|.|> wrote:
Not really, no - as your software may act without your permission:
- by design, e.g.
- autorunning inserted CDs
- autorunning material dropped into Startup via admin shares
- autorunning macros in "document" files
- arbitrary software that pulls down "updates"
- runing active content in web pages or HTML "message text"
- by code defect, e.g.
- edge-facing exploitable surfaces, e.g. RPC, LSASS etc.
- defects in IE's HTML renderer, used by OE/Outlook etc.
- internal exploitable risk surfaces, e.g. WMF, JPG, icons etc.
It should all be within your control, but it is not.
- Posted by Michael on May 12th, 2006
Thanks for the links that really helped me in a difficult time. I have now
made a 'clean install' and the computer is stable.
However I now have problems with my sound divce (C-Media AC97 Audio Device)
and Media Player can't play either DVC or CD. Also the graphic card (No name)
is playing up. I have tryed to upgrade them both but it can't be done for
some reason. I have tried to reinstall both devices both nothing help. I
guess I have to contact the manufactures.
"Carey Frisch [MVP]" wrote: