Novice needing help

[catluvr]

This may get long and since I am relatively new to all this,  Here goes,  about 1-1/2 years ago I got a virus and was referred to Avast a my virus protection.  All seemed to be going well, I loaded the free home version and it is in resident,  I was on dial up until a couple of weeks ago when dsl was my choice.  I thought that when I ran the avast resident system it would be my protection.  In trying to setup the SBC Yahoo DSL. the Avast message has alerted me many times that an error occurred  cannot connect to download.  Once I could get online, then the little icon would begin to spin and I assumed that it was again working, and in fact I would get messages that it had updated.  Long story short, my dsl line was "available" to me June 3rd, but I could not get connected, for many reasons, bad modem, etc, until earlier last week.  WEll Sat night I was on line until about 1:30 am when I shut down and at 7am Sunday I could not get back on.  I spent hours with SBC people trying to find a solution, they said my dsl was up and communicating with my modem, and my computer appeared to be communicating, but I can't get on the dsl. I have been given the run around and finally was told I must have a tough spyware or virus.  Well I began my own testing and found I could get on line when I reverted back to my dialup system.(where I am now)  Also I went to the desktop avast icon and ran virus detection and found 4 virus and 1 worm  all currently in virus chest (not sure what to do with them now).  I was surprised to get this since my resident seemed to be working.  Isn't the resident supposed to protect again these or are you also supposed to run the virus program?  Also I have run ad-aware several times to remove any spyware.    Could there still by a virus/worm that would not allow me to communicate on dsl but still get on with my old dialup?   I'm lost and sbc now wants to send out a techie this week to be sure I am set up correctly.  Any help you guys can give would be greatly appreciated.   I am very very frustrated after over 3 hours on the phone with sbc and no answers.
                                                                                                                                                 

[FreewheelinFrank]

Hi Catluvr!

I suggest running through the following procedures to check that your computer is clean. If this doesn't help, there is some information at he end about HijackThis, which you can use to give us more information about your system.

Please ensure you have done a thorough scan with avast!, preferably a boot time scan. (This doesn't work in Win 98: if you have this OS, boot into safe mode before scanning- hit F8 while booting.)

Right click the avast! globe and select Start avast! Antivirus.

avast! will do a memory scan: if it find the worm in memory, it will prompt you to do a boot time scan: accept this and reboot.

If avast! doesn't find anything in memory, schedule a boot time scan. (Click the button at the top left of the avast! silver console and select Schedule boot time scan from the drop-down menu.)

The anti-Trojan program Ewido is also worth installing and running as a double check: it has a free version:

http://www.ewido.net/en/

Please ensure that you have a firewall and that your OS is up to date, otherwise infections will come back. A computer connected to the internet will be attacked by worms, viruses, Trojan horses and spyware within 40 seconds. You can prevent all of this by installing a free firewall.

If you need advice on either of these subjects, please say so.

I also suggest a thorough spyware scan with at least two more of these scanners (Ad-Aware alone will not catch everything):

Ad-Aware: http://www.lavasoft.de/
Spybot Search & Destroy: http://www.safer-networking.org/en/download/
Webroot Spy Sweeper: (Free working trial) http://www.download.com/Webroot-Spy-Sweeper/3000-8022_4-10373771.html
MS AntiSpyware: http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en
Yahoo! Anti-Spy: http://toolbar.yahoo.com/
X-Cleaner Free: http://www.xblock.com/download-freeware.php

If you still experience problems, please run HijackThis and post a log file:

http://www.bleepingcomputer.com/forums/tutorial42.html

[polonus]

Hi Catluvr,

It could well be you have a splitter problem, if you have the wrong type, it malfinctions and it goes bunkers after a short while, and no internet connection. In the case  there is a splitter behind your modem, see to it that it is the right type  that goes with the particular type of modem, depending on the kind of connection. Your ISP people should know this. Everything is fine as to the point of the modem, but behind the modem things get terribly wrong. I had a similar thing at work, and the sys admins had a horror dream abot this, before they finally found that the lady of the house , who is a complete a-technical, bought the wrong splitter type. If this is not the case I leave you in the hands of our malware expert, FreewheelinFrank.

greets,

polonus

[Fast]

Just another of my silly suggestions: please check the cable from your modem to your pc. Is it firmly connected ? Isn't it too long (max 2 m) ?
Do you have another one in the house with wich you can swap it in case of an internal damage in the cable ?

Very stupid things, I know, but I once spent hours and hours reinstalling and reinstalling and etc, until my nabour lent me another cable and whoops, everything went fine.

Just a suggestion.

Good luck,

Fast.

[polonus]

Howdy Fast,

I hope for our friend catluvr that this isn't a hardware problem, but 
on hearing the symptoms  this is what came up first with me too. We shall see. I am anxious what he has to comment.

greets/groetjes,

polonus

[neal62]

catluver,

Have you tried to reset (hard reboot) your DSL modem? Alot of times it will appear to be communicating with the provider but isn't. On some of the DSL modems you have to turn them off and then back on. Some of them MAY have a reset button located somewhere on the modem. Just a thought if you haven't tried that yet. 

[catluvr]

Well guys I'm back with sad news. Unfortunately I have had to work and not been able to get back to this til last night.

 I tried some of the steps you suggested Freewheelin, and I just get stopped.  To update you, I am running win 98se on an IBM laptop.  I have run avast in boot time scan and I come up with a trojan horse, I have run more than once, the first time an error occurred and it was not moved or removed.  My last run(post boot)  it was found in  windows\temp\optimize.exe\[UPX]        win32:DyfucDldr[trj]    this was successfully moved to chest.  The problem is the recap list then showed 1093 (not typo error) additional lines that said "unable to scan:Ar......    (I don't know how to open the rest of the descrip)  and I don't have a clue what that means and what to do. 

Yesterday SBC (southwestern bell) came out, unfortunately I was not here, but I spoke on the tele and he said that I definetly have a virus of some sort since the error while trying to connect, gives a response in the address line with /// as well as %2 .  He tried his laptop and was able to connect.  He said that the protocol was different with a dialup vs dsl and the virus is with the one for the dsl only. 

I cannot run ewido since it doesn't run on win98.   
I tried to load yahoo anti-spy and it won't set up.

Right now I'm very frustrated and am not sure which way to move.   Actually the windows in front of me are looking pretty good, but since I just had them installed, I don't know if I have window breakage warranty, if the laptop ended up outside.
ps   to make things worst,  I have a 2nd laptop - Dell - that apparently also has been attacked and will not work on the dsl. 

What is this poor novice to do?

[polonus]

Hey catlvr,

Go to this thread read it well, and see if this is what could help you. The lady of the posting never gave a reply. Think this scholar lady came in from another forum. But it waited all in its small corner here just for you,
link to: http://forum.avast.com/index.php?topic=13771.0
I wish you loads of success solving your problem.

Yours sincerely,

polonus

I added a picture of a very well trained cat

[FreewheelinFrank]

Hello again!

Can I suggest you try Trend Micro Sysclean: it will run under Windows 9x: download the Damage Cleanup Engine and virus pattern files. Boot into safe mode and run. Run again after a normal boot.

http://uk.trendmicro-europe.com/enterprise/support/tsc.php
http://uk.trendmicro-europe.com/enterprise/support/pattern.php

Update avast! and run a scan in safe mode.

Then update and run Spybot S&D and Ad-Aware in safe mode. (They work under Win 98.)

If you still experience problems, please run HijackThis and post a log file:

http://www.bleepingcomputer.com/forums/tutorial42.html

[catluvr]

Hi Guys, 
A couple of notes to you regarding what's happening from this lady catluvr.  Thank you for all the suggestions and help.  I've done the following:

To polonus:  First thank you for the pic.  I wish I could get my 3 cats to do that, sure would save on the litter.  lol

Generally I am full speed ahead when given good directions, but in reading the link you gave, I am very nervous that I could make an error since I don't fully understand what would be done.  ie: what DOS disk.  Actually I don't have many of the disks for this unit since I purchased it from a reseller 3 years ago and I only received the windows98se disks.  They installed a miscrosoft version of office, etc.  I think this may put me at a disadvantage.

To   freewheelin   I went to Trend Micro Sysclean.  I was able to download all the files  you suggested, except they also had a sysclean package for non members which I also tried to download and received the message from avast  that sysclean.exe had a VBS Redlof virus/worm and I moved it to chest not sure what else to do with it.  I was pretty surprised when that came up. 

Also when I tried to run the tsc program I got the msg   "if run a text based program in safe mode you risk corruption of video display or other...."   I stopped and here I now am.  should I have continued or what?

Any other suggestions?  Can I or should I run tsc in safe mode?   

 I am now also having a problem when booting that scandisk has found errors and I can't seem to clear them all.  Everytime I manually run scandisk it goes ok and I clean up or fix the size discrepancies except I didn't know how to answer:    36192256 bytes in 119 lost file fragments.   Should I  discard   ignore   or  convert   ?   

scandisk also has to restart several times since it says that another program has written to disk even though I don't have anything else running to my knowledge  (ie I didn't start anything.)   

Do you think it is worth for me to forge ahead or breakdown and find someone locally (know anyone in ST.Louis, MO) to help.   Maybe wipe it all out and start again.     

Thanks again for all your help.   

Lady Catluvr

[FreewheelinFrank]

Hello Catluvr,

The identification of Sysclean by avast! is a well known false positive. It is safe to disable avast! while downloading and running if necessary.

The version of Sysclean is the one that you want.

It should run ok in safe mode in Win98:

[url]http://www.computing.net/security/wwwboard/forum/14876.html[/url]

(The Stinger tool mentioned here is also good.)

You can set Scandisk to 'automatically fix errors'. This is probably the best option.

Good luck.

[FreewheelinFrank]

See also:

http://forum.avast.com/index.php?topic=14548.from1119610955;topicseen#msg122841

[Fast]

Hello catluvr, if you run windows 98 you can use A2 trojanscanner.
See here: http://www.emsisoft.com/en/software/free/

Fast