HELP! COMPUTER INFECTED

[quintr]

Yesterday I got a notice that my computer was infected with a worm that gathers email addresses from a compromised computer, also a trojan. I started getting a critical warning on the desktop.

I have long been a customer of McAfee and thought that McAfee would keep these kind of vermin off my computer.

However, now it appears that problems are getting through.

Need any suggestions you may have. My field is analytical chemistry, not computer science.

Does anyone have a better source than McAfee. I'm willing to change -- especially if I can get a vendor that provides a tech support telephone number to its customers!

[AppyPappy]

Prove to us that you are infected. Sometimes these are scams.

[Perdogg]

trend micro

[ShadowAce]

You’ve been added. Welcome Aboard!

[printhead]

I had one of those on a friends’ kids’ machine a few weeks back. I usually start out with HiJack This. If that doesn’t work I move on to SmitFraud Fix. With this trojan as soon as it saw SmitFraud Fix it erased it off my USB key. When I burned it to cd it would refuse to open the cd. I removed Norton. As soon as I installed AVG, AVG detected and removed it. Unbelievable.

[mmichaels1970]

IMO McAfee does more to bog your computer down than actually protect it...

That said, here are the step I normally take when cleaning an invected computer.

1. Try a "System Restore" back to the day before you noticed the malware. Start/Programs/Accessories/System Tools. Many viruses will now disable your ability to do this, so it may not work. However, I think it's the first thing you should try.

2. Whether System Restore works or not, hit it with a "one-two punch" of malware cleaning tools. Use these two tools in whichever order your computer permits (sometimes malware will prevent av progs from working, if that's the case, try the other one first).

a. Use Housecall 7.0 from trend micro.
b. Use Malwarebytes from Malwarebytes.org. Do a quick scan first, then a full scan later after you catch your breath and decide to go to lunch or something.

If you have trouble with getting BOTH of these av programs downloaded and installed, you can try to boot your computer into "safe mode with networking". To do this, turn your computer on and after the initial memory tests, press your F8 key a couple of times. You should get a list of startup options. Try Safe Mode with networking and see if you can get the av programs downloaded and installed that way.

On occasion I've had to download malwarebytes on a separate computer and burn it to cd when the infected computer's internet connection was really knocked out of whack.

All is not lost if you are still failing at this point, but it has definitely gotten more difficult.

[Dustoff45]

Try doing a system restore. Try going back a day or two before the attack. You might lose some data, but it might be a faster and cleaner fix.

System Restore Options from Microsoft

[callthemlikeyouseethem]

my husband’s computer was infected by an antivirus virus the other day called “Personal Anti Virus”. We have norton internet security and use Super Ad Blocker. Of course the “unistall” for the unwanted program didn’t work. We were able to remove it from the taskbar and eliminate the annoying alerts by these simple steps:

start, computer, c drive, programs, common, then clicking the unistall there.

Good luck. The people who design such malware should be...(fill in the blank)!

[TomGuy]

I have been getting notices of ‘infected’ web pages recently when I select them from a google search.

Some are just the online scam that warns the user to download a program for a malware/virus scan.

Others, however, actually activate my AVAST with trojan warnings.

I just recently upgraded Firefox to 3.5.2. I think it is supposed to be more sensitive to malware sights.

[mkjessup]

That’s why I bought an Apple computer, no need for anti-virus stuff.

It took you until post # 5 to post that boilerplate response?!?

You iSnobs are slipping.

[mad_as_he$$]

komando.com

[COUNTrecount]

Please add me as well, thanks.

[ShadowAce]

You’ve been added. Welcome Aboard!

[COUNTrecount]

Thanks.

[Cletus.D.Yokel]

Post 26 was meant for quintr but he already got that advice.

My question was looking into the possibility that what quintr got was a false-lead from a malware distributor while surfing.

[paulycy]

I want to second these recommendations:

Avast! Free edition
Spybot (free)
malwarebytes (free)
Ad-Aware (free)

If all else fails then google "HijackThis" or visit this forum and follow the instructions to get a real human volunteer to help you fix this for free.

Viruses, trojans, malware, etc. can be virtually eliminated and virtually always cured using these free precautions and solutions. They work for me.

[Screaming_Gerbil]

Sounds like the original poster got one of these e-mails:

http://www.snopes.com/computer/virus/mailserver.asp

Mail Server Report

Virus:   Mail Server Report
--------------------

MIXTURE OF REAL VIRUS WARNING AND HOAX

--------------------
Example:   [Collected via e-mail, October 2006]

Services Alert Notification

Description of Problem. We have identified a new computer virus that arrives in an e-mail with the subject line "Mail Server Report".

Outage Duration. None. Email services and Internet access currently remain available.

Impact. We are working with our anti-virus vendor to obtain more information. The email arrives with an attached .zip file. It claims a worm was detected in an email you sent. You are asked to use the attached file to install updates that will eliminate the virus it has supposedly detected.

Action To Be Taken. Please do NOT open any Emails with attachments from individuals or organizations you are NOT familiar with. Also, since it is possible for viruses to "spoof" or fake the sender's address, do NOT open Emails with attachments from people you know, but from whom you were not expecting an attachment or if the attachment is a file type or file name that you customarily do not receive from this person. We have put filters in place to block future messages and have swept the e-mail system removing all messages that match the above description.

Origins:   The "IT Services Alert Notification" reproduced above was a valid warning from October 2006 that cautioned users of Windows-based PCs about a real mass-mailing worm which arrived via e-mail with a subject line of "Mail server report" and a body containing the following text:

Mail server report.

Our firewall determined the e-mails containing worm copies are being sent from your computer.

Nowadays it happens from many computers, because this is a new virus type (Network Worms).

Using the new bug in the Windows, these viruses infect the computer unnoticeably.
After the penetrating into the computer the virus harvests all the e-mail addresses and sends the copies of itself to these e-mail addresses

Please install updates for worm elimination and your computer restoring.

Best regards,
Customers support service

In the guise of offering users an update to stop their computers from being used to spread mass-mailing worms, the "Mail server report" messages included attachments that when opened actually infected PCs with just such a worm, one known as Warezov.W or W32/Warezov.X.

In March 2008, a new warning began circulating that erroneously linked the name of the 'Mail Server Report' worm with elements of the 'Life is Beautiful' virus hoax and claimed that the resulting amalgam "HAS BEEN CONFIRMED BY SNOPES," thereby creating a combination that fused a real virus warning with aspects of a hoax virus warning:

Anyone-using Internet mail such as Yahoo, Hotmail, AOL and so on.

This information arrived this morning, Direct from both Microsoft and Norton.

Please send it to everybody you know who has access to the Internet.

You may receive an apparently harmless e-mail titled "Mail Server Report"

If you open either file, a message will appear on your screen saying: 'It is too late now, your life is no longer beautiful.'

Subsequently you will LOSE EVERYTHING IN YOUR PC, And the person who sent it to you will gain access to your name, e-mail and password.

This is a new virus which started to circulate on Saturday afternoon. AOL has already confirmed the severity, and the anti virus software's are not capable of destroying it.

The virus has been created by a hacker who calls himself 'life owner'.

PLEASE SEND A COPY OF THIS E-MAIL TO ALL YOUR FRIENDS, And ask them to PASS IT ON IMMEDIATELY!

THIS HAS BEEN CONFIRMED BY SNOPES

http://www.snopes.com/computer/virus/mailserver.asp

Snopes also advises NOT TO OPEN MAIL WITH ATTACHMENTS unless you are expecting it.

This latter version is difficult to classify as either "true" or "false": The virus it references (i.e., the Mail Server Report worm) was a real one, but it's neither new nor currently rampant (as claimed in the warning text), nor does it manifest itself in the fashion described (since the "symptoms" provided in the warning are merely a reworking of the text of an earlier virus hoax). All in all, that message doesn't really merit the dire warning to "SEND A COPY OF THIS TO ALL YOUR FRIENDS, And ask them to PASS IT ON IMMEDIATELY!"

Last updated:   30 November 2008

[Straight Vermonter]

Check to see if the warning say “Personal Anti-Virus” if so it is a scam.

[GOPJ]

Please add me to your ping list. Thanks.

[GOPJ]

What do you think of window’s defender? Is Ad-Aware better?

[ShadowAce]

You’ve been added. Welcome Aboard!