Laptop Problem

[Guest]

Late last night, I was told (I thought) by my AVG protector that I had accessed a 'distrusted' file. Did I want to quarantine it, or did I want to ignore it? As I was tired and about to go to bed and not inclined to analyse the situation, I decided to quarantine it....then this morning, I was faced with a 'immovable' panel, supposedly from XP, telling me that I urgently needed to 'fix' my hard drive, as it had 'multiple' problems. Now, when I try to log on, I just get the XP warning.....when I attempt to click on Documents, I get a blank screen, likewise there are no options for firefox, or anything else. Fortunately, all my stuff is backed up on a memory stick.


Does this mean that my hard drive has been wiped clean by a virus? If so, what do I do (other than beat my breast)?


Oh - and if it's too late for me, let this be a warning to others.....

Cheers!

[JoeG]

Can you start up in Safe Mode? Press F8 as you boot up and choose Safe Mode without networking. You may be able to run your AV from there - or any Anti Spyware you have (I use Malwarebytes which often helps to get rid of nasties).

[Mandryka]

Can you start up in Safe Mode? Press F8 as you boot up and choose Safe Mode without networking. You may be able to run your AV from there - or any Anti Spyware you have (I use Malwarebytes which often helps to get rid of nasties).

Thanks, Joe. Will try that tomorrow - too tired today!

[JoeG]

Any luck?

[french frank]

Any luck?

Ominously, Mandryka has not returned ...

[Paul N]

There is an infection called Windows FixDisk which starts automatically everytime you start in normal mode and gives you a window that falsely tells you you've got numerous serious-sounding problems. You also get these fake alerts in your Windows taskbar. The program tries to get you to buy something to fix the problem - a scam. It hides various folders and files, can inhibit your AV, makes your computer run slow, and can cause it to restart after a time.

It should be possible to fully recover the situation - the following link gives full details including instructions on how to deal with it, using the RKill, TDSSKiller and Malwarebytes Anti-Malware scanner:

http://www.bleepingcomputer.com/virus-removal/remove-windowsfixdisk

You may find it best to start in safe mode and look for the rogue executable which has a random name ending in .exe in C:\Documents and Settings\All Users\Application Data (for Windows XP) - it should have the date that you got infected. If you delete it, you should then be able to start and run in normal mode, but you should still use the above programs to search for and remove all the associated rogue files/registry values.

If it's not that virus, then try looking at some of the other "Latest Viruses" listed on the right side of the above page.

Good luck!

[JoeG]

Thanks for that link Paul - may come in useful in the future (I hope I don't need it though!) Let's hope Mandryka survives the onslaught!

[Mandryka]

Thanks one and all for your concern - have been away for the past few days so not had time to look at the situation (and probably won't have time before the weekend) and am writing this on a work computer. Rest assured, I will try all the solutions suggested and let you know how I get on! :)

[JoeG]

Nice to hear from you and good luck!

[johnb]

Mandryka,

Good luck with sorting your problem.

Ideally you would have a backup image of the hard drive which you could restore, however, don't forget that most PCs have a hidden partition on the hard drive that enables you to restore the hard drive to its state when it left the factory via a menu called up by interrupting the boot sequence. (Hopefully you also created a set of CDs or DVDs to restore the system when you originally set up the PC.)

If you do have to resort to restoring the hard drive in that way, don't forget to save your data files and e-mails, etc to, say, a USB stick before you take that action.

I recently bought a new HP PC and, interestingly, the accompanying blurb recommended doing such a restore every year in order to clear out the vast amount of rubbish that Windows accumulates as time goes on!

It is a *really* very good idea to periodically create a backup image so you can easily restore the PC. There are quite a few backup programmes around but the ones that are useful are those that create an image of your hard drive (or selected partitions) on an external hard drive. There are two respected programmes: Acronis True Image and Norton Ghost. You will read adverse comments about both from various people but I have used both programmes very successfully. Both these programmes then enable you to restore the image to your PC by using their own boot disk.

Incidentally, I always take an image of the hard drive of a new PC once I have set up the PC and installed the software that I use. That way I can restore back to that image instead of going back to the factory state. I also partition my hard drive (using, say, Acronis Disk Director) so that the operating system and all my software is on one partition, and all my data, emails, etc is on a second partition. That way I can take an image of the system drive and restore it without affecting any data.

[Mandryka]

OK, going to be grasping this particular nettle later on, but just thought I'd ask......somewhat shamefacedly.....how you open your laptop in 'safe mode'?

At the moment, as soon as I switch the thing on, I get the 'Your computer is at risk' notices and I can't do anything else. Do I need to press some special button to get into safe mode, so I can install the malware?


Thanks for your continued support...:)

[Anna]

Mandryka, I believe if you look at #2 from JoeG he tells you to use F8. This may be of help to you (assuming you are on XP)

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx?mfr=true

Also, I had a similar but not so serious 'fake' Windows incident and on installing Malwarebytes it discovered various nasties that I had no idea were lurking on the computer. I run it once a week now (thankfully it shows nothing untoward after that initial cleansing)

[Paul N]

That's right, use F8. On mine, as the computer is starting, I get a screen inviting me to press ESC, F10 or F12 to enter some of the advanced options before Windows loads. At this point I have to keep pressing F8 - it's a matter of catching it at the right point - and then I get the Windows advanced start-up menu (white text on black background). (If you get the Microsoft Windows XP screen with the Windows logo, then you've missed the boat and Windows is already loading). So, once you have got the advanced start-up menu, use the up/down arrow keys as necessary to select the "Safe Mode" option and then proceed from there.

[Anna]

Mandryka, Just wondering. Did you get your laptop sorted and sort out the virus?

[Mandryka]

Mandryka, Just wondering. Did you get your laptop sorted and sort out the virus?

Thank you, Anna. Was about to post about this....

I installed the malware bytes and ran my AVG.....the five viruses/Trojans were detected and quarantined. However, I am still missing all my desktops icons, all my accessories (calculator, etc) and the computer is now insisting that I sign into google every time I log on and isn't remembering my settings for email addresses, etc. I did a search and managed to locate all my pictures, so the things that aren't readily apparent are still there somewhere. I have a functioning laptop, but it just aint like it was before....any advice?