Garda virus removal

Dante79

Hi,
My computer has been infected with the Garda Virus. I have successfully removed this virus in the past on a friends computer but i am having no luck with it this time.
Here is what i have tried...

1. Access msconfig to stop the screen loading at start up...no good i cant access my command prompt or search button

2. Start up in safe mode, networking, command prompt...... no good,computer restarts after i try to select any safe mode option. It runs to password screen and when i go to log in the laptop just restarts again.

3. I have created a boot disk and selected 'boot from cd' on the boot menu but its not working, laptop wont boot from cd, and i dont have a boot from usb option!!:mad:

If anyone has any ideas i would greatly appreciate any help!!
I read online that i should wipe my computer after i remove files i need and transfer them back again when i instal the OS? how do i remove files from a laptop i cant access? can i remove the hard drive and hook it up to another computer with a special cable? making it into a portable drive??

Thanks

Torqay

Dante79 wrote: »

can i remove the hard drive and hook it up to another computer with a special cable? making it into a portable drive??

You can do that alright but that doesn't solve the problem that the laptop won't boot from CD or USB. How do you intend to reinstall the operating system? ^^

Is it a Windows 8 laptop? In this case you'll have to disable UEFI secure boot and enable legacy boot if you want to boot from CD or USB.

Dante79

Its a windows 7 laptop. Yeah good point about reinstalling the operating system...not sure what to do next

petes

That's a bit of a balls not being able to boot from CD.

Does this happen with all bootable cds?

You could put the hard drive in a 'caddy' and hook it up to another computer to transfer the files off.

Do you know if the laptop has a factory setting restore option?

mordeith

petes wrote: »

That's a bit of a balls not being able to boot from CD.

You could put the hard drive in a 'caddy' and hook it up to another computer to transfer the files off.

Would that not transfer the virus as well no? Sorry if that's a stupid question

demanufactured

http://stephensheil.com/GardaBlog.html

yoyo

Moved from Comp & Tech

OcRobbie

demanufactured wrote: »

http://stephensheil.com/GardaBlog.html

Had this bloody virus last week . Found it very easy to remove. Like you said safe mode restart doesn't help.
I pressed F8 on my system to get to repair pc (win 7)
Selected a restore point before I was infected . This goes through the process of restoring . Once restored your system will start up normally & then do a full system scan with malwarebites / avast & spybot search & destroy & delete all the **** it found. Back up after a couple of hours .
I hope this helps . It's a terrible virus .

heroics

You could try try putting the hard drive into a caddy and scan with malwarebytes from another PC. This should find the files associated with the virus and delete them. You can then boot to the drive and run a full scan to remove the registry entries.

I had the problem before and I think he files I had to remove were

%AppData%\NPSWF32.dll
%AppData%\Protector-.exe
%AppData%\result.db
%CommonStartMenu%\Programs\ rnd.lnk

johnnybmac

I have created a boot disk and selected 'boot from cd' on the boot menu but its not working, laptop wont boot from cd, and i dont have a boot from usb option!!:mad:

This could be a problem with the CD/DVD drive.

Can you get into the BIOS or "SETUP" menu and see if the laptop is recognising the CD/DVD Drive in the list of bootable devices?

Usually, this type of infection shouldn't affect your boot options as they're loaded in BIOS, before your OS "windows in this case," is allowed to boot...

afro man

got the garda message Friday night and after a bit of checking onboards found a few solutions to remove it,,



I went with system restore to earlier date , scanned with malwarebytes which showed a couple of infected items deleted them and everything seems ok .. but keep getting a message popping up from malwarebytes saying " malwarebytes anti malware successfully blocked access to a potent
ially malicious website 220.248.183.159 type outgoing port 32677 process utorrent.exe "


scanned tonight again and got the following below

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.15.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
brendan :: BRENDAN-PC [administrator]

Protection: Enabled

16/09/2013 23:05:03
mbam-log-2013-09-16 (23-05-03).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System |Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 236580
Time elapsed: 14 minute(s), 11 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)



anybody any ideas is computer still infected with virus or is utorrrent the cause of it