Please Help - Virus infected my laptop...

rsta

Hi I really hope you can help... also, i have posted on the laptop forum about an hour ago but no replies so i hope mods dont mind that i am posting here too... i just really want to fix it.

My laptop has been infected with a virus.

I only noticed it as my background screen picture is just blank white no matter what i set it too.

Also, in the bottom right hand corner there is a red circle with a white ! in it, when i move the cursor over it it says 'your computer is infected'

if I hold the cursor over it and right click it give the options: close, uninstall. Should i click one of these...?

i have mcafee security centre and ran a scan for infected files twice but nothing has come up... is there anything else i can do?

Please help...thank you...

RoyalMarine

run adaware. - http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10399602.html?tag=lst-0-1

run spybot. - http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10401314.html?tag=lst-0-1

run an antivirus program. - http://free.grisoft.com/freeweb.php/doc/2/ ( avg 7 free edition )

make sure you update them all. ( they all have auto update features )

also, the spybot program has whats called a teatimer program.
it basically monitor's all changes to your computer and asks you to "control" them.
such as startup programs, internet access, etc.

i had the same problem you had. basically its spyware and its hijacked your active x desktop. run these programs, and they will find it and remove it.

hope it helps.


if you have an activated copy of windows, try this

http://www.microsoft.com/downloads/details.aspx?FamilyID=435bfce7-da2b-4a6a-afa4-f7f14e605a0d&displaylang=en

greglo23

try this http://tinyurl.com/5lyxe its a link to the Microsoft malware removal tool. if it cant do the job post back and i'll see if i can come up with something else. if it is a virus it may stop you getting to anti virus sites so be warned

Airblazer

i bet you the software it recommends is sheriff spy or something close to this..it's a complete cuunt to remove and in the end i had to reinstall...no matter what i did i couldn't get rid of the pic on the desktop with the big..if i ever meet the cocksucker who wrote this i'm going to shove my laptop up his hole...sideways..:mad:

RoyalMarine

its in the registry if you look for it.

rsta

Thanks Royalmarinecomm, greglo23 and airblazer

Royalmarinecomm, i have tried all those links and ran the software and adaware found and removed about 50 files...
i ran spybot then and it found nothing so thats good i think adaware must have removed everything. thanks very much for that one.

only thing is my desktop still is blank white no matter what i set the desktop too. also before this i used to be able to right click on the desktop and it would bring up the property settings but now it just comes up properties not available. is there anything i can do to get my desktop background back?

also, when using different sites a thing called net transport came up, what is net transport? i ran a search and deleted everything to do with it but still when i right click 'download all by net transport comes up on the pop menu...

many thanks for your help so far

**Timbuk2**

I think I might have had something similar to this a while back, where it kept on advising three anti-spywares... all made by sheriff. It was in the registry but the sneaky little virus wouldn't let you go into the registry :rolleyes:

But luckily I acted as soon as this happened and did a system restore, and it seemed to fix the job for me, because it removed it from the registry. If you know when you got this virus, then restore you computer before you got it, and it might do they job.

Post back here if you need any help

rsta

**Timbuk2** wrote:

I think I might have had something similar to this a while back, where it kept on advising three anti-spywares... all made by sheriff. It was in the registry but the sneaky little virus wouldn't let you go into the registry :rolleyes:

But luckily I acted as soon as this happened and did a system restore, and it seemed to fix the job for me, because it removed it from the registry. If you know when you got this virus, then restore you computer before you got it, and it might do they job.

Post back here if you need any help

hi timbuk2, yeah id be well interested in doing a system restore does that just wipe everything clear?
how do i go about that?

**Timbuk2**

No it doesn't wipe everything clear

It is just a backup of the registry, so you won't lose important documents or anything.

To do this, it is very simple. Go to Start -> All Programs -> Accesories -> System Tools -> System Restore
Then press restore my system to an earlier time
You will get a calender and a listbox interface. Choose a date as close to now before the virus was installed.


Press "Next" and then I think you will need to restart your computer... and wolla.. it will be done

Now this won't solve the problem completely. If the virus put shortcuts to websites and things on your desktop they still might be there, but the virus will be gone from the registry. After you restore, scan your computer with anit-spyware and anti-virus.. and it might be gone

Post back on how you got on here

RoyalMarine

thats only if he has a restore point tho.

at the worst case you could wipe everything clean and re-install windows.

do you have the windows cd?

if you do, then we can help you wipe the computer clean.
basically, its a kick in the nuts to have to do, but its a 100% fix for the problem.

and to think, if you were in america and this happened, you could sue the company for damages and take them to court over it...

stupid irish constitution.

**Timbuk2**

Well, that is true. But it is more than likely he has a restore point somewhere. When you delete a program, a restore point is made. When you do a spyware/virus scan a restore point is made.

If that doesn't work you might have to start backing up all your files and then booting from your Windows XP CD (that is if you have one) and doing a clean install. Hopefully you won't have to do that though

RoyalMarine

:-/ lol. forgot that windows alto makes restore points.

i always turn off restore points when i install windows on a machine here.
never had to use 1.

**Timbuk2**

I used to have them turned off when I was on me crappy computer because my computer would hang every time I make one, but now that I am on the good computer (3.00Ghz, 1GB DDRAM) it doesn't hang so I leave them on. You can also manually create restore points by going to the same place but clicking "Create restore point" instead of "Restore my computer"

That would be useful if you wanted to download something but you are not sure that it isn't spyware free, so you could restore your computer and if it is full of ol junk then you can just restore

HANDY!!

RoyalMarine

i just use an old computer to download files.
if it screws that up, then i delete it.
if it tests out ok with virus scans etc then i transfer it over to my good comp.

**Timbuk2**

that is what I do for songs on LimeWire

I have an old computer (which is on the wireless network). I download music, play it once through (you are downloading them off other people's computers, you never know what could be in them), and if itis fine, just copy it into My Music on my good computer (through the network so it is handy)

RoyalMarine

got a wireless connection myself, but i cant seem to get file transfer or a network going. :-(
so im forced to use a 2gig flash voyager memory stick.

rsta

Well lads i have to say a big thank you to both of you for all that help!

ive now got my desktop pic back and everything seems to be running ok

i did that system restore (never knew about... that brilliant it is)

and another scan with adaware and spybot (so useful.. will use regularly now )

*mucho happio*

Ta!

R

Airblazer

rsta wrote:

Well lads i have to say a big thank you to both of you for all that help!

ive now got my desktop pic back and everything seems to be running ok

i did that system restore (never knew about... that brilliant it is)

and another scan with adaware and spybot (so useful.. will use regularly now )

*mucho happio*

Ta!

R

if you're sure that your pc is running fine switch off restore and reboot...then switch it back on..this makes sure that no dodgy spyware is left within the restore folder..after this create a new restore point...for switching off the system restore right click on my computer and select the tab..

**Timbuk2**

I wrote:

I think I might have had something similar to this a while back, where it kept on advising three anti-spywares... all made by sheriff. It was in the registry but the sneaky little virus wouldn't let you go into the registry

Actually, I just found out that it wasn't sheriff, it was SpyAxe. When I restored my computer, it removed the actualy virus, but I still had adware and stuff left over from it, so just keep scanning reguarly and if you come accross any parts of the virus left over post back here

Shane O' Malley

As people have said it is spywear but has an extra kick.

This one uses a rootkit to hide it's reinfection routine.

So while some of the anti spyware programs might find it you just keep getting it back.

Head over to http://www.f-secure.com/blacklight/rootkit.shtml and download a trial version of their rootkit finder.

After you have run it and cleared the file in normal mode you have to clear the spyware in safe mode.

Good luck