One Nasty Virus/Trojan - Kills all virus scanners

[Lynn210]

Spybot found tons of stuff and got rid of it.. ran it again and it came back clean.

Running Adaware now..

Still cannot do any downloads of any kind on the sick machine..
have to download on this computer and move it over to the other.

Ran Vundo.. came back clean

[Lynn210]

Adaware was pretty clean.. usual cookies from those constant ads

Bitdefender has an online quick scan for Firefox.. dont know how good
it is but it came back with nothing..

Still cannot download anything on that computer.. which is basically what
the virus did.. blocked all downloads.. so as you say.. something must be
broken somewhere..

Could not uninstall .NET frame.. it is looking for an original installation disk
and would not accept the OS disk I have.. or at least I have no idea where
the file must be.. the window shows a file name of letters and numbers that
are about 20 or so characters long.

[edifyguy]

Letters and numbers 20 characters long.....that's the temporary folder it used to install it through Windows Update. Try downloading the redistributable (sometimes called "for network administrators") version and going with that. It might do a repair install, or at least an uninstall and reinstall.

[Lynn210]

Here is the link to the Microsoft site for .net framework

http://www.microsoft.com/downloads/details.aspx?familyid=333325FD-AE52-4E35-B531-508D977D32A6&displaylang=en#Instructions

According to instructions.. I am supposed to uninstall all previous versions through
add/remove (my system will not uninstall)

I just read some more and it says I must have all updates to use this version...
so I am thinking that maybe that is what is wrong with it and that is why I am
getting the .NET framework error message.

The version that was on my computer when it got "sick" was this version ..
3.5 .. and I no longer have all the updates so....

We are back where we started from.. I cannot get Windows to update
There are an awful lot of files that are needed to update.. to do them manually
will take forever... plus I think you have to do them in the correct order.

I was missing that one file you mentioned earlier.. maybe that has something to do
with Microsoft not updating.??

************************
I have been re-attaching my external drives .. scanning them as I go..
I tried to use avast to do the scanning but these drives are 1TB and it
took avast nearly an hour to do 1% .. it was moving very slow..

I am wondering if it is damaged.. avast on this computer (not the sick one) updates
3-4 times a day and announces it with a nice sexy guy voice.. I haven't heard a word on the "sick" computer.

Even though it is set to automatic .. I had to manually update it.

[Lynn210]

I was thinking I might try installing SP3
and then .NET Framework without uninstalling..

See what happens..

[edifyguy]

You may need to uninstall and reinstall a number of programs to fix the damage that the virus did to the registry and system files.

About the .NET stuff......try this:

1. Reboot into Puppy and delete all the .NET folders. There will be .NET folders in Windows, Program Files, and Documents and Settings. In most cases these will be under folders like Microsoft, and look in Common Files, Application Data, and Local Settings > Application Data. And "they" say Linux is messy about where it puts stuff.....

2. Restart Windows and run Eusing Free Registry Cleaner. CCleaner is not a very good registry cleaner, and sometimes flat out causes problems. Eusing will clean out the registry settings that pointed to files you've now deleted.

3. Use the registry editor (regedit) to find and remove all remaining references to .NET in the registry.

4. Reinstall the .NET stuff. You've now done a manual uninstall on the old stuff.

-----------------------------------

As for updates, here's an update for you:

http://www.silverdollarsolutions.com/files/xpsp3.EXE

It's the redistributable XP SP3 for x86. That should solve most of your update issues.

[Lynn210]

What is your input on Avast .. reinstalling or repairing.

[edifyguy]

Personally, I'd suggest uninstalling, running Eusing, then reinstalling, but be aware that you will have to re-enter the key when you do that. It will forget it. I'd also suggest disconnecting it from the Internet while you do. Download both the installer and the offline update, run them both with no internet connection, then reboot. We don't need to take any chances with chinks in armor right now.........

[Lynn210]

I'll give Eusing a shot..

How safe is it for non-gurus

I have been using CCleaner regularly .. I thought it was pretty good..
and it is probably safer because it doesn't get into areas that may be
dangerous for amateurs 

[Lynn210]

I will work on the suggestions you made tomorrow..

Here is something else you can help me fix

Anytime I try to run a program I get the following error message

Entry Point Not Found
The procedure entry point GetRequestedRuntimeInfo could not be located in the
dynamic link library mscoree.dll

Then after I click ok .. up pops the net framework error message
with the version of net framework and mscorwks.dll could not be loaded

Hopefully fixing .net framework will get rid of that.

*-------------------------

8AM .. JUST CHECKING IN...

[Zyndstoff (aka Steven Gail)]

Here we are on top of the 3rd, the game is tied and tight - the teams are back on the field! 
Kick off is about to happen any second now...

[Lynn210]

You may need to uninstall and reinstall a number of programs to fix the damage that the virus did to the registry and system files.

About the .NET stuff......try this:

1. Reboot into Puppy and delete all the .NET folders. There will be .NET folders in Windows, Program Files, and Documents and Settings. In most cases these will be under folders like Microsoft, and look in Common Files, Application Data, and Local Settings > Application Data. And "they" say Linux is messy about where it puts stuff.....

2. Restart Windows and run Eusing Free Registry Cleaner. CCleaner is not a very good registry cleaner, and sometimes flat out causes problems. Eusing will clean out the registry settings that pointed to files you've now deleted.

3. Use the registry editor (regedit) to find and remove all remaining references to .NET in the registry.

4. Reinstall the .NET stuff. You've now done a manual uninstall on the old stuff.

-----------------------------------
.

I was wondering why I needed to boot up in puppy to remove the files then it
occurred to me that I would not be able to do this in Windows cause windows would be using the files.. correct??

I suppose Windows will boot up without the files or you would not tell me to delete them would you 

[edifyguy]

You're correct. I'm not going to encourage you to do anything that will make it not boot. You've had enough trouble with that already.

You are correct as to why I say to use Puppy to delete the .NET files; they will be in use otherwise. Not all of them, but enough of them that it could cause problems. The file error you keep getting is part of a .NET package, so removing the .NET stuff should resolve that. I wouldn't be surprised if the virus attempted to hook that file, causing Avast to remove it. Avast works on the philosophy that a missing file is less dangerous than a virused file. I concur. A missing file can keep a program from running, and sometimes even keep Windows from loading. A virused one can steal passwords, banking info, identities, and generally make your whole life miserable, not just your computer.

Eusing is very safe, and actually causes far less collateral damage than CCleaner's registry cleaner. I've had far more trouble with CCleaner's registry cleaner, which doesn't even work as well.

You will get some warnings after deleting the .NET files, but should be alleviated by Eusing and the subsequent manual removal of .NET registry keys. You could try this tool first, and see if it nukes it for you: http://blogs.msdn.com/astebner/pages/8904493.aspx I can't promise you that it will work at all, as I'm NOT going to test it right now!   It looks like it automates the process we described earlier. I'd recommend trying it first.

I do think that fixing the .NET framework will resolve a lot of the weirdness you're experiencing, as right now anything that hooks it is getting bad vibes. Keep us posted!

Did you get SP3 on yet?

[Lynn210]

 You could try this tool first, and see if it nukes it for you: http://blogs.msdn.com/astebner/pages/8904493.aspx I can't promise you that it will work at all, as I'm NOT going to test it right now!   It looks like it automates the process we described earlier. I'd recommend trying it first.

I do think that fixing the .NET framework will resolve a lot of the weirdness you're experiencing, as right now anything that hooks it is getting bad vibes. Keep us posted!

Did you get SP3 on yet?

Should I run that tool in Windows or in Puppy?
Sounds like it is designed to work in Windows

No to SP3 .. I will do that in a little while.. working right
now..

[edifyguy]

From within Windows. Puppy wouldn't know what to do with most of it.

I hope that tonight will be the night of your victory dance 'cuz it's all fixed up.