# Make yourself a coffee first.. You'll need one..



## Kymberly_S (May 18, 2009)

Where do I begin...

Recently I took my personal data off of an old laptop of mine so I could give it to my son.  He had it for one afternoon/evening.. the internet became increasingly slow then cut out.

He did nothing wrong though.  I think I picked up a virus either from software updates OR AVG.. 

So I couldn't get into the computer normally from the user area as there was something loading in the processor area.  I managed to see it once and went 'end process'  .... then it duplicated itself to the point that the virtual memory was used up in a matter of 40 secs or so.

After that I could no longer access task manager and a message would appear that said the Administrator had disabled task manager.. although the USER is the Administrator..

(one thing you should know is that there was a " Warning! you have a virus" window flashing on the desktop of the _user_ area.  I checked the desktop settings to check out what was happening and there was an internet explorer icon in the area where you can click on anything to change the desktop appearance, BUT I couldn't click on any of the other background options as they had been grayed out.. so to say... unclickable.. This is where the interned explorer icon was. There was no option to 'unclick' the 'web' function either.. I don't know how that got there.  It was planted and wasn't going to be removed)

Soooo, I went in through safe mode.  Tried to run AVG but it wouldn't.
I deleted AVG (removed program through control panel).  Then I downloaded the latest version of AVG from the official site, onto a memory stick (from another computer) and then put it in the laptop,  loaded it and ran it through command prompt, from safe mode, as this is the only way it would run. 

It picked up a lot.. a lot of exe files.. etc..... (can you see where this is headed)

When it finished running, it closed down.  

I assumed, _yes I know_   , that everything would be hunky dorey and I had in fact conquered the situation.

However... when I shut the computer down and started it up normally so I could get into the normal user area a white screen came up.  This white screen remained up.  Nothing else appeared except a log in window.  When I logged in.. by clicking on ok because there is no password.. the screen was white, and bleak and nothing else appeared, which made my mood go from   to   and then to  grrrrrrr  and now I am just a little ?

I have no idea what is going on and if someone does and fixes this for me.. I will be Forever Grateful and send you a present!   Seriously.. if someone could help me out.. I am sooooooooo sick of fixing computers.. lol.. I really fixed this one didn't I?

The virus is one that adds onto exe's??


----------



## Mussels (May 18, 2009)

download the 30 day trial of kaspersky from here.

avira, AVG etc - despite what some say, all those free antivirus are crap. 2/3 of what they find isnt even a virus at all, they find 'more' than other antiviruses because they find harmless things and make them out to be massive threats.

kaspersky will solve your problem - you may need to do a clean boot however. Start windows in safe mode, and open up the start menu. Go to run and type MSconfig then click ok. on the startup tab, untick EVERYTHING.

reboot the machine, install kaspersky. let it update online when asked. Once its up and running make it do an entire scan of the PC (right click the C: drive in my computer, and get it to scan there).

That should clear things up.

Oh and in my experience, when a male under 18 gets on a PC and it gets a virus moments later... they nearly always clicked something they shouldnt have, and lied about it. its not so much commonplace as its a law of nature.


----------



## infrared (May 18, 2009)

In your situation it would probably be best to format it and re-install the OS. Usually takes a couple of hours tops, probably a lot less time than you will spend trying to fix what's happened.

You were lucky you backed up all your stuff before this happened!


----------



## Kymberly_S (May 18, 2009)

*hrmmmmm ...*

ok.. Will give that a go. Right now.. And run it from safe mode of course? because nothing else is working.

be back to let you know..


----------



## Mussels (May 18, 2009)

Kymberly_S said:


> ok.. Will give that a go. Right now.. And run it from safe mode of course? because nothing else is working.
> 
> be back to let you know..



safe mode blocks everything from starting with windows that isnt windows. so you cant really run an antivirus from it. some work, some dont.

MSconfig will prevent the virus starting with windows, allowing kaspersky to get its updates online and delete them. I suggest that the second kaspersky starts its scan, you disconnect the laptop from the internet.


----------



## Kymberly_S (May 18, 2009)

I can't access the internet from the laptop in question because it just wont let me.. So, if I can't register this Kaspersky.. will it work if it can't register?

Also, if I re format?  I have done this once before .. about a year ago now with another laptop (yeah, real hot at this aren't I) and the disks would only go so far (yes, original) and then nothing but a black screen.  (still haven't fixed that.  Was going to go into a shop and get them to do it for me because I am so done with all this.. !)

I am somewhat dubious about putting in the original disks now.. sorry, please don't get offended because I do appreciate your help.. just don't want to wreck the computer ...


----------



## Mussels (May 18, 2009)

i'm not too sure how kaspersky handles without activation, as i own a licence i can activate it offline. I still suggest using MSconfig and removing all the entries, it will stop the virus running at startup and may allow you to get back online.

Yes, you could use the disks and format it. That would solve the problem, i doubt you'll have the same black screen issue. You did get lucky this time, by having your data backed up right before the crap hit the fan.


----------



## KainXS (May 18, 2009)

I have had this prob, but I forgot the app i used to fix it 

its a little app where you reset the network keys, anyone remember the name of it, 

and I had to use a pendrive to send the app from another pc

but the virus has to be removed first, got any old norton cd's laying around that are usually bundled with alot of pc stuff


----------



## Kymberly_S (May 18, 2009)

*lucky .. yes ...*

Yes.. I was very lucky to have taken all my data off before I gave it up... BUT... I saved it to my external memory and just tonight realised that ....

I SAVED IT TOOOO MYYYY EXTERNALLL MEMORY!!!!!!

I haven't started up the external memory since I did this as I thought it was best to make sure I haven't transferred the virus to all of my important documents and family photos from the past 7 years or so.!!!



I will do the config thing and the download and if that doesn't work.. I will be back and see if there are any other suggestions before I run the disks.. (save me)


----------



## Mussels (May 18, 2009)

external memory?

Not a term i'm familiar with.


----------



## Kymberly_S (May 18, 2009)

*ext mem*

silver box that plug into the computer with memory.. 380GB I think.. like a massive memory stick/ flash drive..


----------



## Pinchy (May 18, 2009)

http://beta.eset.com/eos

I use that to get rid of viruses lol.


----------



## Mussels (May 18, 2009)

Kymberly_S said:


> silver box that plug into the computer with memory.. 380GB I think.. like a massive memory stick/ flash drive..



external hard drive.

It may work the same as a flash drive as far as you can tell, but its a very different thing on the inside.
You should be ok with the data on there, as it sounds like the virus infected the machine after you finished backing up the data.

In all honesty, i suggest you hop on to ebay and buy a kaspersky key (they're about $15au for a year) and protect your other machine, just so that they dont both go down on you if the virus manages to spread somehow.


----------



## Kymberly_S (May 18, 2009)

*kaspersky key ?*

Just went on ebay and put it in search but nothing came up?


----------



## oily_17 (May 18, 2009)

You can download Malwarebytes on the PC your are on at the moment.Then transfer it to a CD/USB stick and put it on the other PC.Then install it.

When it has finished installing, then place the attached rules.ref file(unzip it first) in -

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

You may have to unhide system files to see these folders.Then run a scan with it and see if it helps.


----------



## Mussels (May 18, 2009)

Kymberly_S said:


> Just went on ebay and put it in search but nothing came up?



Enjoy

Its a 3 PC licence so you can install it to both PC's.


----------



## Kymberly_S (May 18, 2009)

*paranoid much?*

Ok.. now I may be being paranoid.. but.. 

when I plugged in the mem stick 1GB.. there is avg. the latest one I downloaded that I mentioned in my first 'question/explanation' and .. adaware.. AND EXPLORER.EXE Run as DLL as an app Microsoft Cooperation and another thing that says RUNDLL32.EXE Run as DLL as an app Microsoft Cooperation is this a part of the adaware and avg thing or is it a bad virus, like in disguise..?

This is the memory stick I would be downloading your good suggestions onto to put into the laptop and try to save it..


----------



## Mussels (May 18, 2009)

if you're worried about the flash drive, format it on the good PC before placing any files on it.


----------



## Kymberly_S (May 18, 2009)

It has some of my daughters work on it.. should I scan it with avg and then delete the avg.exe and adaware.exe and copy her work to the computer??? then reformat it.. 

sorry if this sounds stupid but I don't want to be fixing another computer if I can get out of it..


----------



## Mussels (May 18, 2009)

Kymberly_S said:


> It has some of my daughters work on it.. should I scan it with avg and then delete the avg.exe and adaware.exe and copy her work to the computer??? then reformat it..
> 
> sorry if this sounds stupid but I don't want to be fixing another computer if I can get out of it..



That sounds like a good plan of action.
heres a good idea: put her work in a zip file. viruses rarely corrupt files they cant identify, if its in a password protected zip file they cant infect it.


----------



## Kymberly_S (May 18, 2009)

*sorry to bug you.. pardon the pun ...*

How do you password protect a zip file?


----------



## oily_17 (May 18, 2009)

Flash_Disinfector          

http://download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe

Run it and follow any prompts that may appear.
It may ask you to insert your flash drive and/or other removable drives including your mobile phone etc.
You can allow the utility to clean up those drives as well.
Wait until it has finished scanning and then reboot.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.


----------



## Kymberly_S (May 18, 2009)

I have to go and try some of these things.. Thank you soooo much to you all for helping me out.  

I have to say that out of all the forums I have been in I have never got such quick responses, not to mention so many, and VERY helpful all round, as I have from here.

Thank you again and will let you know how it all goes.. Fingers Crossed.. 

Crumbs... one more thing.. Obviously I would be running these from safe mode right???

Because I can't get anything else to load..


----------



## Mussels (May 18, 2009)

i just had a moment of inspiration. There is a particular website of a... well its nature fits under about every negative word you can think of, to moral people. To immoral people, its got everything from porn to pictures of cats with funny hats.
 Point is an infection has spread to many from an attack on that website called vundo. After looking into it, it spreads and downloads many other programs and sounded similar to what you described.

http://vundofix.atribune.org/

It cant hurt to try, and if it turns out the PC did have vundo, i'll PM (private message) you the site of the website so you can block it.


----------



## Kymberly_S (May 18, 2009)

Thanks soo much..


----------



## oily_17 (May 18, 2009)

Kymberly_S said:


> Because I can't get anything else to load..



When you get the blank screen after startup have you tried -

Ctrl + Alt + Delete (XP) or 
Ctrl + Shift + Esc (Vista)

to bring up Task Manager, then go to Applications tab and click New Task and then enter explorer.exe in the window that pops up.


----------



## Kymberly_S (May 18, 2009)

*Ctrl+Alt+Delete*

Hi, yes I have.. A window pops up saying that the administrator has locked access to this function, even though there is no administrator.. 

Whilst in Safe Mode, one thing that came up was that only 'Mummy' (my old user name and yes I know, highly original), Administrator (never made this. Just came up) and 'D Roller' (the user name I put there for my son) have the rights to change .... I can't remember what it was I was trying to do.. But that was odd due to the fact that I changed the user name 'Mummy' to 'D Roller' but 'Mummy' was still there and in action it seemed.


----------



## Kymberly_S (May 18, 2009)

*more help please*

Ok.. This time when I went in through safe mode, the icons that were coming up giving me the option to go in as Administrator or 'user' didn't come up.

Another window came up with 'Mummy' in it (my old user name) but, giving me the option to put in another name if I wanted.  So I put in Administrator and through this ONLY a black screen loaded.. no menu bar, icons on desktop etc.. BUT I am able to get the task manager up.

How do I get the file on the memory stick to run through task manager please??

I did go... Task Manager, then go to Applications tab and click New Task and then enter explorer.exe in the window that pops up. and a window came up with a red circle with a cross in it which said, Can not find explorer.exe.  Make sure you typed the name correctly and then try again....etc. etc...

>>>>>

I ran the scan and it didn't work.. is this because I was trying from safe mode.. the only area I can access..?


----------



## Namslas90 (May 18, 2009)

KainXS said:


> I have had this prob, but I forgot the app i used to fix it
> 
> its a little app where you reset the network keys, anyone remember the name of it,
> 
> ...



Winsockfix -http://www.softpedia.com/progDownload/WinSockFix-Download-15337.html

Free download, restores internet settings to windows default, allows you to get online and download the tools needed to scan and remove the viri.


----------



## Kymberly_S (May 18, 2009)

*Thanks for that.. But...*

The thing is.. Even in Safe Mode now I am getting a black screen.

I can access task manager BUT ... My understanding is that you can't run anything through safe mode??

Is this correct?

I can't get on the net with the laptop.

I can't get into the normal user area.

I can't get anything up on any desktop apart from a black screen.


I CAN get task manager up in Safe Mode, but I don't know what to do with it..


----------



## Namslas90 (May 18, 2009)

If you can get it to start up and into safe mode; goto START > RUN - type in MRT and click enter.

MRT is the built in Malicious Software Removal Tool.  If the virus has not progressed far enough you should still be able to run it. 

The virus you picked up is probably a VUNDO.  There is also a utility for removing that.

Vundofix -http://www.softpedia.com/progDownload/VundoFix-Download-33165.html

Use a second computer and a flash drive (mem stick) to transfer programs to the infected computer and unplug the infected from the internet untill after cleaning it up.  Vundo's like to connect to the virus server and reload the virus during and after your attempts to remove it.
Thus reloading the virus and others to keep the computer infected until you "pay the ransome".


----------



## Sir_Real (May 18, 2009)

Kymberly_S said:


> The thing is.. Even in Safe Mode now I am getting a black screen.
> 
> I can access task manager BUT ... My understanding is that you can't run anything through safe mode??
> 
> ...




I dought you will ever sort out that installation of windows. I repair many pc's infected with viruses like the one your laptop had. Trying to remove them often corrupts or deletes important system files thus rendering the operating system full of bugs & unusable. 
I'd just format the hard drive & reinstall the os & all updates.


----------



## Kymberly_S (May 18, 2009)

*I reckon it's going to just be that...*

Well. I was told to do that about 2 hrs ago?  I think this is going to be the only course of action.. 

I just browsed (through the task manager) the files in the other area of the computer only to see that even the system tools are missing.. goodness knows what else.

I have the original disks to the laptop.. my mums disks are here too.. same model laptop.. mine are blue and hers are black I think.. 

If I put hers in it will just come up with a window saying that these are not the right disks for the computer and then I will just have to put the other in .. I mean it won't blow up or grow arms and slap me or anything right?


----------



## oily_17 (May 18, 2009)

Kymberly_S said:


> Hi, yes I have.. A window pops up saying that the administrator has locked access to this function, even though there is no administrator..



To restore security settings to default read here -

http://support.microsoft.com/kb/313222

EDIT:If it was me and you have all your data removed from the laptop...then I would do a fresh install again.It may well save time and alot of frustration.


----------



## Kymberly_S (May 18, 2009)

*you know what?*

Think I going to have to ... But it's all cool.. I do have all my stuff off there.. And maybe it has been a lot of mucking around when I should have reformatted right away.. 

BUT.. I did learn some new things here, helpful too.  I am always fixing things up so I am sure this will come in handy .. not just for me but for the 'thread dwellers' too.

Thank you so much to everyone that has imparted their pearls of wisdom.

Very much appreciated.  I hope I haven't made anyone feel I have wasted their time.

Warm Regards to all.


----------



## oily_17 (May 18, 2009)

At least with the fresh install you can be sure all is fixed and not worry if you got all the virus/problems removed.


----------



## Kymberly_S (May 18, 2009)

*Precisely *

Yes.. As I realised that the virus had beat me (apart from me not losing any of my stuff nar, nar).. I thought I would run the other things anyway, as there is no harm now the decision has been made.. 

Nothing is working though and I am running it all through safe mode.  

Thank you.. All...  It's 2am here so I am hitting the hay.. Night!


----------



## Mussels (May 19, 2009)

even if you didnt succeed in removing the virus this time, you've learned some preventative measures as well as possible removal techniques for future infections.

Let us know if you have any trouble with the format and reinstall.


----------



## Kymberly_S (May 19, 2009)

Hi again,
Just wanted to say that I really appreciate your help and I also have to say that it is very comforting to know that when I do put the disks in to reformat I am going to have help.
Last time with the other computer, where the screen went black and with the re formatting only going so far.. and after me having soooo many computers (family) to look at.. I was soooooo cranky... It really sucked big time 
It (the computer) is still sitting there waiting and that was last July.

Thanks again will find the disks probably tonight and have another go. Now I am going for a walk with my pooch..



________________________________

Came back from walk.. Gathered the strength to face this.... annnndddd (drum roll please)

It worked!!!  THANKS for all the help..

Now I am inspired to have a go at the other one that black screened me.. 

I LOVE it when things work!!
________________________________

Now that I am going to tackle the other laptop that black screened me.. should I go on and on and on in this thread or should I start another one.. ?


----------

