Hey guys,
Got hit by a virus earlier tonight, and now I'm at a public computer looking up solutions. I remember using daniweb many years past for some general computer talk so I thought it'd be a good place to turn to and try to beg for some help...
I looked up the stickies and will be trying the prelim methods outlined there when I get back home later. So hopefully, I'll have some more useful detail for you guys tomorrow. Sorry for breaking protocol, so to speak, but I don't want to run back and forth again before making the post.
Summary: I'm running XP pro. I think the problems started from browsing in Google chrome. Didn't download anything, or install anything, it was completely invisible. (I was installing Visio 2007 in the background, but it's a legal copy - I don't think that can be the source).
An imitation windows security program popped up telling me I had all these infections (and AVG did too). The program had a red circle with an 'x' in it in the taskbar, to mimic the actual Windows Defender icon (which is a shield). It told me I had to install something, and wouldn't let me get out of the dialog box loop if I refused. I also had lost access to task manager (it changed a registry value I'm guessing, that resulted in 'disabled by administrator')
So, I restarted. Found out that safe mode was inaccessible - booting into safe mode flashes a BSOD for a half second before simply restarting again. Uh oh, not cool.
Restarted again. After logging in, couldn't move my mouse or anything (this may be purely coincidental)...
Restarted again. Task Mgr and Regedit were both down. Msconfig is fine, so I unchecked a bunch of shady stuff, although I haven't restarted since. Internet browsing was sort of compromised - i.e, I can do google searches, but clicking on results takes me to trash websites. Google image search seems to be ok, as do most other sites. Some result in redirect. I can't download software - it downloads up to 99% but doesn't finish. Flash appears to be out as well.
I run AVG and Spybot scans. AVG finds everything and its mother. I didn't copy down everything but some recurring names were virut.dropper, Win32/Heur, and Trojan Horse cryptic.cm. (Googling these offered more shady websites than info). MSCONFIG (startup tab) pointed to a bunch of junk too in my Local Settings\Temp\ folder, which I was able to totally empty (not that it made a difference as far as I can tell). A LOT of things that shouldn't be infected turned up as infected, such as system.exe and for example, an .exe file to a previously installed PC game. AVG removed some of this, but a significant number of the hits it turned up were "white listed" and couldn't be touched.
At some point I realize I should try system restore, but no dice. I'm told I have no permission to run it, and then AVG flags what appears to be the executable as infected and removes it. Oops.
Spybot turns up a couple things, including the registry changes that disable regedit and taskmgr (bless you spybot S&D). So after fixing these, I get task manager back, but regedit is still in the stocks. With task manager, I'm able to kill off a number of suspicious looking new processes, which didn't crop back up afterwords...but, there's no behavior changes after that either (not too surprising, I guess).
So that's about where I'm at. I may have left out some stuff, there's quite a bit to remember :( basically, there's my narrative. Apologies that it's long and just storytelling; again, hopefully I'll have more concrete info according to the stickies up for you guys tomorrow - if I haven't given up by then.
Worth mentioning: I've partitioned my drives into C:\ (default) and E:\ (mostly data, although I installed some programs here too when I ran short on space in C:\). The game I mentioned earlier, is in E:\ and had its exe turned up as infected. So I'm thinking of a clean wipe if I need to, but I'm not thrilled at that prospect...I'm not sure if I can salvage files. Should I try? Are my music, text, doc files, exported chrome bookmarks, etc, "dirty" or are they safe to load up onto an external HDD or flash drive and port back in after a clean install?
Thanks for all your help, guys...I'm about at wits' end. But aren't we all, in this unhappiest of forum sections ;)
