New Personal Record

[Geek King]

First thing this morning, I got a call on the tech line from a user with the WinAntiVirus 2009 virus. Off to the races I go, porta-drive in my hands to combat the foul beast with Malwarebytes and Smitfraudfix as my sword and shield. I set up Malwarebytes and updated, then began the scan.

Fifteen seconds into the scan, and it has already found 154 trouble files.

I can't wait to see what the final tally is. I think I'll run a couple more scans before I OK the poor machine.

[Akasa]

Thats a rather haigh tally!

[teller]

my unkle once fixed my computer over 3 thouasand vriuses he worked for mirosoft and he didn't even know they could have that many viruses.

[Geek King]

Final tally ended up being around 500*, after running a couple different scanners. The worst part? I know where this is coming from. We have a group of ladies in the organization who are Obama-philes, and pass around every little thing that has the president's name on it.

Guess where some malware coders are putting their new virus code?

Users: Can't kill `em, can't cut their access completely.



* Infected files, not seperate viruses. Yeah, not as much as I feared, but pretty high for one of our organization's computers.

[Racket_Man]

Final tally ended up being around 500*, after running a couple different scanners. The worst part? I know where this is coming from. We have a group of ladies in the organization who are Obama-philes, and pass around every little thing that has the president's name on it.

Guess where some malware coders are putting their new virus code?

Users: Can't kill `em, can't cut their access completely.



* Infected files, not seperate viruses. Yeah, not as much as I feared, but pretty high for one of our organization's computers.

back in 2001 in Sept there was a virus running that like to sit in the restore point folder and random folders. being a small office they did not have much in the way at the time of virus protection. when I started I d/l'ed the free version of Sophos A/V (not the greatest but better than nothing). well when this virst hit everyone but me got wacked. some had upwards of 4000 infected files esp in the restore point folder/directory.

now one of the easyist ways to get rid of most of the infected files was to get to a DOS prompt and manually delete the files contained in the restore point folder. the problem was you could not use the XP DOS box because the virus had marked the files as in use through Windows. so the only way was to make a DOS boot floppy disk with command(.)com and a few vitalcommand files for DOS then reboot the machine from the floppy drive. then you had to sit for at least half an hour while the DEL command deleted all of the infected files via a DEL *.* command line.

[Skeksin]

I think my best tally is a home user who had a PC with over 2000 infections. PC barely booted.

[MrSmiley]

now one of the easyist ways to get rid of most of the infected files was to get to a DOS prompt and manually delete the files contained in the restore point folder. the problem was you could not use the XP DOS box because the virus had marked the files as in use through Windows.

Assuming that it wouldn't get infected during all this, Unlocker is pretty good for dealing with just that situation. Though admin rights are always required to use it, so it's not for every system.

Also, both Safe Mode and the Recovery Console should have let you delete those files. but hey, a boot disk is good in that if you know it's not infected then you're running off of known 'good' files (that little read protection notch in the diskette is nice too).

[Racket_Man]

Assuming that it wouldn't get infected during all this, Unlocker is pretty good for dealing with just that situation. Though admin rights are always required to use it, so it's not for every system.

Also, both Safe Mode and the Recovery Console should have let you delete those files. but hey, a boot disk is good in that if you know it's not infected then you're running off of known 'good' files (that little read protection notch in the diskette is nice too).

I actually made the DOS boot disk from my PC at home and made sure it was write protected. I was not taking chances with even booting in Safe Mode. most of my CW's looked at me funny when I started to type in DOS commands. It was like I was speaking Russian or somthing

[EmiOfBrie]

back in 2001 in Sept there was a virus running that like to sit in the restore point folder and random folders. being a small office they did not have much in the way at the time of virus protection. when I started I d/l'ed the free version of Sophos A/V (not the greatest but better than nothing). well when this virst hit everyone but me got wacked. some had upwards of 4000 infected files esp in the restore point folder/directory.

now one of the easyist ways to get rid of most of the infected files was to get to a DOS prompt and manually delete the files contained in the restore point folder. the problem was you could not use the XP DOS box because the virus had marked the files as in use through Windows. so the only way was to make a DOS boot floppy disk with command(.)com and a few vitalcommand files for DOS then reboot the machine from the floppy drive. then you had to sit for at least half an hour while the DEL command deleted all of the infected files via a DEL *.* command line.

Nimda-D by any chance? Sounds like a similar virus my then-partner had on her machine around the same time. She had to use a DOS-based Nimda cleaner and even then, she had to run it like 50 times before it caught up with the virus' replication algorythms and finally killed it.

[Racket_Man]

Nimda-D by any chance? Sounds like a similar virus my then-partner had on her machine around the same time. She had to use a DOS-based Nimda cleaner and even then, she had to run it like 50 times before it caught up with the virus' replication algorythms and finally killed it.

yeah that was the name. just kept on replicating and replicating everywhere including the desktop. they (not me) finally had to D/L a DOS exe cleaner program and then clean out the restore folder

[MadMike]

I think my best tally is a home user who had a PC with over 2000 infections. PC barely booted.

I worked on two machines that had over 3000 infections. The one I was able to clean, but the other one I ended up having to wipe completely and start over. On the latter, while I was removing some of the infections, there was another one apparently running in the background and reinfecting everything. The owner told me there was nothing important on the machine, so I just said "Fuck it!"

[Eric the Grey]

The owner told me there was nothing important on the machine, so I just said "Fuck it!"

I've had to do that as well, but I hate doing so. Personally, I feel like I failed when I have to resort to re-installing Windows to recover from an infection.

Now if it's a yearly or regular "clean and refresh the system" reinstall, it's a different thing. Windows runs so much better after doing that, that it doesn't bother me as much.

I'm getting ready to do exactly that to my old laptop, to get it ready for whatever I end up doing with it.


Eric the Grey

[nekolin]

that's nothing i got a broke please fix call started a scan within two minutes the tally was up to 400+ and only about 6% done the first scan was 2000+ granted there was a lot of tracking cookie form (insert random adult sites here) the second scan was 800+ and i didn't wait for the 3rd to finish i let the customer finish it

[MadMike]

I've had to do that as well, but I hate doing so. Personally, I feel like I failed when I have to resort to re-installing Windows to recover from an infection.

Same here. I've heard from some people that won't even bother trying to clean it, they'll just reformat and reinstall no matter what. I only do that as a last resort, otherwise how am I going to learn anything?

[lordlundar]

I was hit by a nasty little chron virus called chernobyl. For those of you wondering, this is a two stage virus. The first stage is to infect as many files as possible, often times rendering them unusable. The second stage is a countdown piece, where at a particular date and time, the real damage would be done. This particular nasty one was set to go off on the anniversary of the Chernobyl disaster (hence the name) and would basically corrupt any infected file, effectively causing a kernel meltdown.

What made this one so evil? 2 things:

1. The little bastard infects ANY file on the system that the virus makes contact with when stage one is activated. First one that gets run usually? the virus scanner that failed to pick it up. First scan got ALL executable and key files in one shot by piggy backing on the scan.

2. The little bastard replicates. First act when run is to plant itself in RAM. This copy would be the prime infection source. In the event of a power loss, the RAM copy would put itself into the HDD for safekeeping with a command to copy itself to RAM on windows boot up.

I had found this out before I was going to bed and had 2 days before stage 2 was going to activate, which made for a very loong night cleaning it.