Virus Problems

[Petrushka]

My computer has just been infected by the infamous Ukash virus. I've no idea where this came from (I wasn't on some dodgy website, honest guv) but it was damned difficult to get rid of. AVG and Malwarebytes did the job between them after a full scan. I also used CCleaner on the registry.

After all that, I am still getting a 'Run DLL' message on start up and find I'm having to log in on here every time and also on to Outlook.

What I want to know is: has any permanent damage been done? And what does the 'Run DLL' mean?

Apart from all this everything now seems fine.

[Dave2002]

My computer has just been infected by the infamous Ukash virus. I've no idea where this came from (I wasn't on some dodgy website, honest guv) but it was damned difficult to get rid of. AVG and Malwarebytes did the job between them after a full scan. I also used CCleaner on the registry.

After all that, I am still getting a 'Run DLL' message on start up and find I'm having to log in on here every time and also on to Outlook.

What I want to know is: has any permanent damage been done? And what does the 'Run DLL' mean?

Apart from all this everything now seems fine.

DLLs are Dynamic Link Library codes. If you've been running System Restore it might be a good idea to rewind until a week or two before you had the problems. Then once you've regained a working system, run evey check and cleaner you've got, and see if the DLL message goes away. it is possible you've got a remnant of something - almost impossible to tell. I don't know about the Ukash virus, and whether it's trickier than most. How you handle it will depend on how concerned you are, and whether you have valuable or sensitive data. Personally I'd probably try to find out more about that virus, and if I thought it was serious enough I'd definitely go for the System Restore option. In the limit you can always reload Windows - I'm assuming that's what you're using - but that's a real pain. If you have backup data drives and you think they're clean keep them well away from your system until you're sure it's OK.

Usually AVG, CCLeaner, Malwarebytes do the job though - but take care.

[Petrushka]

Dave, this is the scam message I got: http://malwaretips.com/blogs/cheshir...thority-virus/

I went into system restore but was unsure whether it had worked or not because the scam message locks the screen. However, I eventually managed to go into AVG and that enabled me to remove the message and return my computer to normal. I then did a full scan on Malwarebytes and it notified me of the removal of this scam.

Once done, I logged back in as normal but keep on getting the 'Run DLL' message on start up. I can close it without problem but am concerned that some remnants of the virus might still be there.

I wasn't on a dodgy website but the virus appears to be infecting 'normal' websites so it's worth bringing it to everyone's attention.

[johnb]

It is always difficult to make suggestions when one doesn't know exactly everything that had happened. However, I would try to use System Restore to go back to an earlier restore point. (The virus/malware might not have allowed the system restore that you tried to do.) I would also follow the suggestion on the MalwareTips link and try 'HitmanPro3'.

[Dave2002]

Petrushka

Ah - THAT problem. I first saw that a month or two back, in a room full of computers. Someone went away and came back and found something similar, though I don't think it was Cheshire police. We wondered how it had done the picture of our room. Hopefully the techie people will have been able to sort it out - as mere users of that kit we couldn't do it ourselves.

The suggestions on the Malware Tips site which you found seem very sensible, and it looks as though the writers of that page have done their homework well. Ideally you should try to make sure that there are no remnants of any problems, which is why I suggested the System Restore method - which is given as Method 2. It'd also be worth trying to find out if there are any tools which can significantly reduce the likelihood of the virus taking hold in the first place, as otherwise it is likely to reappear.

PS: If this turns out to be an ongoing problem, apart from suggestions which have been made in a few places to switch to Linux or Mac OS, another suggestion might be to run Windows virtually, using a system such as Virtual Box (free) or one of the other virtual systems - e.g VM Ware, and I think there's a Windows version. Then you'd make sure you ran inside the virtual environment, and if it became infected "simply" delete the image and start over, which should be a quick thing to do.
To minimise problems perhaps the underlying system to support the virtual system should not be Windows - but really it should be OK. This method is probably too complex for most people, and wouldn't be liked by games enthusiasts since it would slow the machine down, but could provide useful protection. Since the problem would be most likely to arise due to web browsing, such activity could always be done within a virtual environment. It would be important not to use email within that environment though, or to only use it with care, as it would still be possible to propagate problems. Also some such virtual environments have the ability to share files with the host machine, and that could also be a bad idea, useful though it might seem.

[Don Petter]

I had that 'Ransomware' virus a few weeks back (also from a seemingly normal, safe site, as far as I could tell).

In the end I had to start in safe mode, then do a system restore, to even get past that recurring fake screen. Then AVG couldn't get rid of it, but Malwarebites did. After that I ran a full AVG scan and a CCleaner cleanup, including the registry. Since then, touch wood, all seems well.

I do have an automatic System Restore point saved every time the PC starts up, which can be useful. (Though, for other reasons, I now tend to leave the machine on all the time, with just the monitor switched off when I'm not there, which means the automatic points ares less frequent than they used to be.)

[John Wright]

I'm curious why the viruses mentioned on this thread are not detected and dealt with by your anti-virus programs?

[Petrushka]

I'm curious why the viruses mentioned on this thread are not detected and dealt with by your anti-virus programs?

I wondered that as well but imagine that it may be to do with cyber criminals being one step ahead of the game? It certainly gave me a major fright so thanks to all for your comments. Computer now seems to be running better than it was before the virus!

[Resurrection Man]

Petrushka, sorry to hear of your woes but oh how glad I am that I run a Mac.

I had cause to fire up my elderly Sony Vaio the other day and needing to download some utility programs I was flabbergasted by all the other dross that they insist on forcing you to download before you can get to the program you actually want. The PC quagmire is definitely not for me.