Please help me kill this unknown virus

  • Thread starter Thread starter aida135
  • Start date Start date
A

aida135

Hi

Last night a virus attack my PC while i'm online. First my internet
browser help box pops up, then it types letters into the search box.
Atterwards it rename my floopy drive and my second hdd. The hdd was
rename w.0w. My internet browser help box pops up again up to 30
windows, and it types w.0w in the search box. When i activate my
windows defender, it try to shut it off, by poping its helps box
nearly 50 times, and even try to change the scan settings. What kind
of virus is this? My maliciuos software removal scan and AVG anti virus
scans turns out nothing. Please help me kill this virus.


aida
 
On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:
> Hi
>
> Last night a virus attack my PC while i'm online. First my internet
> browser help box pops up, then it types letters into the search box.
> Atterwards it rename my floopy drive and my second hdd. The hdd was
> rename w.0w. My internet browser help box pops up again up to 30
> windows, and it types w.0w in the search box. When i activate my
> windows defender, it try to shut it off, by poping its helps box
> nearly 50 times, and even try to change the scan settings. What kind
> of virus is this? My maliciuos software removal scan and AVG anti virus
> scans turns out nothing. Please help me kill this virus.
>
> aida


This does not describe a virs but some type of spyware / malware. You
should get several spyware removal tools like SuperAnitSpyware and do
a complete scan / clean up.
 
aida135 wrote:

> Hi
>
> Last night a virus attack my PC while i'm online. First my internet
> browser help box pops up, then it types letters into the search box.
> Atterwards it rename my floopy drive and my second hdd. The hdd was
> rename w.0w. My internet browser help box pops up again up to 30
> windows, and it types w.0w in the search box. When i activate my
> windows defender, it try to shut it off, by poping its helps box
> nearly 50 times, and even try to change the scan settings. What kind
> of virus is this? My maliciuos software removal scan and AVG anti virus
> scans turns out nothing. Please help me kill this virus.


This doesn't sound like a virus so much as spyware. However, better to be
thorough in your scanning, especially since you're using AVG which isn't
one of my favorites.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. You will
generally be asked to:

1. Download and execute HiJack This! (HJT) -
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

2. Disable Notepad's word wrap - In Notepad.exe Format --> uncheck "Word
wrap"

3. Download/run Deckard's System Scanner -
http://www.techsupportforum.com/sectools/Deckard/dss.exe

4. Save the scan results (Main.txt and Extra.txt)

5. And then post the contents of Main.txt and Extra.txt in your post at the
forum you chose. DO NOT POST LOGS IN THE MS NEWSGROUPS.

Standard disclaimer: I can't see and test your computer myself, so these are
just suggestions based on many years of being a professional computer tech
suggestions based on what you've written. You should not take my
suggestions as a definitive diagnosis. If you can't do the work yourself
(and there is no shame in admitting this isn't your cup of tea), take the
machine to a professional computer repair shop (not your local equivalent
of BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may be
so infested that Windows will need to be clean-installed. If possible, have
all your data backed up before you take the machine into a shop.

Malke
--
MS-MVP
Elephant Boy Computers
www.elephantboycomputers.com
Don't Panic!
 
"smlunatick" <yveslec@gmail.com> wrote in message
news:7c08e77c-9f84-4d1f-9a67-a40e9bd76aee@a70g2000hsh.googlegroups.com...
On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:
> Hi
>
> Last night a virus attack my PC while i'm online. First my internet
> browser help box pops up, then it types letters into the search box.
> Atterwards it rename my floopy drive and my second hdd. The hdd was
> rename w.0w. My internet browser help box pops up again up to 30
> windows, and it types w.0w in the search box. When i activate my
> windows defender, it try to shut it off, by poping its helps box
> nearly 50 times, and even try to change the scan settings. What kind
> of virus is this? My maliciuos software removal scan and AVG anti virus
> scans turns out nothing. Please help me kill this virus.
>
> aida


This does not describe a virs but some type of spyware / malware. You
should get several spyware removal tools like SuperAnitSpyware and do
a complete scan / clean up.

The poster might also want to try Spybot search & destroy...it's good and
it's free...they can get it from here:
http://www.download.com/3120-20_4.html?qt=spybot&tag=srch&tg=dl-20
 
spybot search and detroy is another program you can try and i think microsoft
have their own anti spyware.

"smlunatick" wrote:

> On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:
> > Hi
> >
> > Last night a virus attack my PC while i'm online. First my internet
> > browser help box pops up, then it types letters into the search box.
> > Atterwards it rename my floopy drive and my second hdd. The hdd was
> > rename w.0w. My internet browser help box pops up again up to 30
> > windows, and it types w.0w in the search box. When i activate my
> > windows defender, it try to shut it off, by poping its helps box
> > nearly 50 times, and even try to change the scan settings. What kind
> > of virus is this? My maliciuos software removal scan and AVG anti virus
> > scans turns out nothing. Please help me kill this virus.
> >
> > aida

>
> This does not describe a virs but some type of spyware / malware. You
> should get several spyware removal tools like SuperAnitSpyware and do
> a complete scan / clean up.
>
 
On Sun, 1 Jun 2008 08:26:00 -0700, dizzyd
<dizzyd@discussions.microsoft.com> wrote:

> spybot search and detroy is another program you can try and i think microsoft
> have their own anti spyware.



Microsoft's anti-spyware product is Windows Defender, which aida has
already said didn't solve the problem.


> "smlunatick" wrote:
>
> > On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:
> > > Hi
> > >
> > > Last night a virus attack my PC while i'm online. First my internet
> > > browser help box pops up, then it types letters into the search box.
> > > Atterwards it rename my floopy drive and my second hdd. The hdd was
> > > rename w.0w. My internet browser help box pops up again up to 30
> > > windows, and it types w.0w in the search box. When i activate my
> > > windows defender, it try to shut it off, by poping its helps box
> > > nearly 50 times, and even try to change the scan settings. What kind
> > > of virus is this? My maliciuos software removal scan and AVG anti virus
> > > scans turns out nothing. Please help me kill this virus.
> > >
> > > aida

> >
> > This does not describe a virs but some type of spyware / malware. You
> > should get several spyware removal tools like SuperAnitSpyware and do
> > a complete scan / clean up.
> >


--
Ken Blake, Microsoft MVP - Windows Desktop Experience
Please Reply to the Newsgroup
 
"Ken Blake, MVP" <kblake@this.is.an.invalid.domain> wrote in message
news:7mh544lvmn5oi8k99ue2t8k8t4m33e8mnh@4ax.com...
> On Sun, 1 Jun 2008 08:26:00 -0700, dizzyd
> <dizzyd@discussions.microsoft.com> wrote:
>
>> spybot search and detroy is another program you can try and i think
>> microsoft
>> have their own anti spyware.

>
>
> Microsoft's anti-spyware product is Windows Defender, which aida has
> already said didn't solve the problem.


Which could mean Defender is not as good as Spybot and Spybot *would* solve
it.

>
>
>> "smlunatick" wrote:
>>
>> > On Jun 1, 10:57 am, aida135 <aida...@discussions.microsoft.com> wrote:
>> > > Hi
>> > >
>> > > Last night a virus attack my PC while i'm online. First my internet
>> > > browser help box pops up, then it types letters into the search box.
>> > > Atterwards it rename my floopy drive and my second hdd. The hdd was
>> > > rename w.0w. My internet browser help box pops up again up to 30
>> > > windows, and it types w.0w in the search box. When i activate my
>> > > windows defender, it try to shut it off, by poping its helps box
>> > > nearly 50 times, and even try to change the scan settings. What kind
>> > > of virus is this? My maliciuos software removal scan and AVG anti
>> > > virus
>> > > scans turns out nothing. Please help me kill this virus.
>> > >
>> > > aida
>> >
>> > This does not describe a virs but some type of spyware / malware. You
>> > should get several spyware removal tools like SuperAnitSpyware and do
>> > a complete scan / clean up.
>> >

>
> --
> Ken Blake, Microsoft MVP - Windows Desktop Experience
> Please Reply to the Newsgroup
 
Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

aida135 wrote:
> Hi
>
> Last night a virus attack my PC while i'm online. First my internet
> browser help box pops up, then it types letters into the search box.
> Atterwards it rename my floopy drive and my second hdd. The hdd was
> rename w.0w. My internet browser help box pops up again up to 30
> windows, and it types w.0w in the search box. When i activate my
> windows defender, it try to shut it off, by poping its helps box
> nearly 50 times, and even try to change the scan settings. What kind
> of virus is this? My maliciuos software removal scan and AVG anti virus
> scans turns out nothing. Please help me kill this virus.
>
>
> aida
 
"aida135" <aida135@discussions.microsoft.com> wrote in message
news:B087052E-C715-43FE-889E-827E61996607@microsoft.com...
> Hi
>
> Last night a virus attack my PC while i'm online. First my internet
> browser help box pops up, then it types letters into the search box.
> Atterwards it rename my floopy drive and my second hdd. The hdd was
> rename w.0w. My internet browser help box pops up again up to 30
> windows, and it types w.0w in the search box. When i activate my
> windows defender, it try to shut it off, by poping its helps box
> nearly 50 times, and even try to change the scan settings. What kind
> of virus is this? My maliciuos software removal scan and AVG anti virus
> scans turns out nothing. Please help me kill this virus.
>
>
> aida


What happened when you physically disconnected from the network - unplugged
the cable?

-pk
 
Same thing happens. The help box pop up several times with the typing, in
fact the changes on my defender scan setting heppened after i deisconnected
fom the internet

"Patrick Keenan" wrote:

> "aida135" <aida135@discussions.microsoft.com> wrote in message
> news:B087052E-C715-43FE-889E-827E61996607@microsoft.com...
> > Hi
> >
> > Last night a virus attack my PC while i'm online. First my internet
> > browser help box pops up, then it types letters into the search box.
> > Atterwards it rename my floopy drive and my second hdd. The hdd was
> > rename w.0w. My internet browser help box pops up again up to 30
> > windows, and it types w.0w in the search box. When i activate my
> > windows defender, it try to shut it off, by poping its helps box
> > nearly 50 times, and even try to change the scan settings. What kind
> > of virus is this? My maliciuos software removal scan and AVG anti virus
> > scans turns out nothing. Please help me kill this virus.
> >
> >
> > aida

>
> What happened when you physically disconnected from the network - unplugged
> the cable?
>
> -pk
>
>
 
Back
Top