HELP! my computer is STILL screwed up/infected

[nostamj]

my ongoing computer problems...

my laptop (Compaq Presario 900) had a serious of massive virus attacks.

installed and am running ZoneAlarm, SpyHunter, Norton...

today, several of the, re-appeared: ClientMan, SideSearch, nCase

cleaned them out with SpyHunter.

am currently downloading an XP ServicePack update.

but, my IE (which is independent of AOL which I use for connection) has become locked. I cannot access "Internet Options" and get an error message telling me to contact my "system administration" (???)

the homepage has been set to some piece of filth that fires porn pop-ups, etc.

also, since last night, Windows Media Player is launched after a reboot--that never happened before.

also, some disabled my cookies and I had to specifically allow DU to download cookies in order to login and post today

what would happen if I just deleted the entire Microsoft IE folder?

would I be able to download a 'clean' copy?

I'm at my wit's end here.

why did ZoneAlarm, which many here recommended, fail to stop this latest re-infection?

does today's scenerio sound like the sassar virus?

sorry for the long post but, I'm at my wit's end here!

TIA for any assistance!

[ps1074]

1. sound like a nasty adware

I think it's not a virus. Go download this program. It is free. It scans your computer in seconds for adware and spyware and hen tells you how to remove it. Very useful.

I am sure everything will be okay after you run it once.

[nostamj]

2. but, I've already run

SpyHunter and SpyBot Search&Destroy

how many separate programs do I need?

and, what was the point in adding ZoneAlarm if this shit is continuing?

ok, i'll try that one when the XP update download is finished....

<SIGH>

[toddzilla]

3. /format mbr

reinstall..


it will be faster in the long run.

[nostamj]

6. sorry, I have no idea what your subj means

can you elaborate?

are you saying I *should* delete the IE folder?

(i am NOT a hardware guy) thanks!

[toddzilla]

18. i am suggesting a clean wipe of the hard drive..

i do it every couple months regardless.. keeps the system running smoothly.

i wouldn't recommend it if you don't know someone who is tech-savvy.

sadly, some virus infestations are bad enough that it is the only choice.

[ps1074]

4. trust me

It is better than the ones you mentioned. :) I've had them all.

Once you run this program it finds the spyware and instructs you how to manually remove them from the registry. Don't worry, there is nothing to be affraid of. Just follow the instructions very carefully and you'll be safe.

[notadmblnd]

11. If adware is running when you run

spyhunter spybot and search and destroy, they will not be removed.
the adware is probably running a hidden process.
you can go to start menu, run, type in msconfig. when the window comes up hit the last tab called startup. This has a list of all processes that run upon startup. unclick anything that you do not recognise, click apply and reboot. then run spybot etc and see if this helps.

[nostamj]

13. thanks

lots of weird stuff was listed.

hope this helps!

again, thanks!

[Mistress Quickly]

5. The reboot

sounds like sasser.

Download the Stinger ( http://es.mcafee.com/virusInfo/default.asp?id=description&virus_k=125007 ) and use it to clean your computer, but make sure you turn off your system restore before you run it (its in your control panel>>system area) and turn it back on afterwards.

Then, if you are on XP, this is the patch that will block the sasser:
http://www.microsoft.com/downloads/details.aspx?FamilyId=3549EA9E-DA3F-43B9-A4F1-AF243B6168F3&displaylang=en

If not, check this page for updates in ref to sasser:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Install and run Spybot and AdAware afterwards. Then you should be able to change your homepage (that's caused by spy/ad ware)

Spybot: http://www.safer-networking.org/index.php?page=download

AdAware: http://download.com.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

Hope some of this helps.

Its a bitch, I know.

[workforpower]

7. Get rid of AOL!

It is the biggest target for everything nasty. I used it for awhile and it is a bloated program that has nothing to offer. I have a local ISP and have had great service and no problems. Its $20/mon.

[nostamj]

8. i wish i could

but, right now, i can't.

[madmax]

9. ME TOO!!

I'm at my wit's end, also. I'm a computer dummy and my son is yelling at me for d/l programs. I HAVEN'T d/l anything! I'm waiting for him to connect via pc anywhere to see what he can do.

I emailed him this page because so many responded with programs other than Norton's which is the only anit-virus program I have.

Thanks for potsing this nostamj and all of you who replied.


:cry:

[Misinformed01]

10. Try downloading Mozilla

for your browser, and then AVG to get rid of the viruses. Should take about 15 minutes if you are on DSL or cable....I am not sure about Dial up-

Stephanie

[madmax]

12. Wireless Network Connection 4 Station

Activity

Sent 1,482,180,739

Received 2,649,665,766


My son said he never saw anything like this...so what does it mean?

I need to go to computer school :(

[curse10]

14. Zone Alarm is not a virus protector

unless you have the full version. It's just a firewall. It helps, but the computer can still get viruses.

[nostamj]

15. i have ZoneAlarm Pro

cost $40

didn't see anything about a 'full' version. it sure blocks a LOT of crap though... I was sickened to see 1-3 hits per minute once I started running it!

[toddzilla]

19. many of these firewalls intentionally flag things..

to make it look like they are doing their job.

[x-g.o.p.er]

16. Save all of your important files to disk...

and reformat your hard drive with your boot disk.

[Bossy Monkey]

17. Like I said last time, HijackThis

Website here: http://www.spywareinfo.com/ If you don't feel like reading up on it first, you can just download here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
It's a little program that will show you all the items that might be hijacking your browser. Unfortunately, you have to investigate each, but this is pretty simple because of the proliferation of Help Desks on the Internet. Just Google name of whatever item you have questions about plus the phrase "HijackThis log" and you'll see a zillion results for folks who've had the same problem. Or save your HijackThis log and submit it to one of these Help Desks.

No, it isn't surprising that if your browser is already hijacked that the firewall isn't going to stop it from being already hijacked. Think about it.