Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Ricky]

Spoiler:  old first post (click to show/hide)

So from what I've seen, my computer is about to become FUBAR if we don't do something fast. it's currently in the FU stage and i don't want that to progress.

So the situation. Lately we've been experiencing  funny popups that we've been ignoring. We as in pops and me, but I believe my mom just started clicking shit and we eventually led to bad problems. currently, there are no programs in the Start> all programs (xp) and all personal files have been deleted. I checked installed programs and a few are still there. various items in the recycle bin are still there, various files floating around the C: hardrive are there for the most part, most are empty. all favorite information is deleted, although search history is intact.

before opening any page on google, it redirects to some random site.
major thing here, while just sitting here, the search history is filling up with useless sites leading to random shit, it seems like we have some sort of bad virus, but we have no virus software due to all programs being looted. please help.

 
So i thought we had it all cleaned up and fixed, but, we don't. Figures.

So, the next day has come, and we've managed to restore our settings to about a week ago. The programs are back in the program menu, but there are still no folders in our names, they're just buried, and the obscure websites are still showing up, and now, for the topper, random audio blips about colgate and snickers and other random shit are coming over our speakers without us opening anything.

[MetalSlimeHunt]

Step One:

Open Task Manager, end every process that looks even slightly suspicious, and report back.

[Bdthemag]

Well if it goes beyond revival, i'll tell you what I tell everyone who has computer problems. Put your computer on a boat, light it on fire, kick it out to sea. Your computer shall dine in Valhalla.

[Ricky]

okay, big list of processes, right now, almost everything is suspicious

jucheck.exe
hpsysdrv.exe
ehmsas.ect
kbd
alg                 user name LOCAL SERVICE
wscntfy
dllhost
MediaMallServer...(cut off & very ominious)
wmiprvse
mcrdsvc
YahooAUService...(cut off)
MsPMSPS
svchost (several of these)
ati2evxx
those are a few


several disturbing sites are popping up in the search history all on their own, as if some virus was going about its business on my computer

Edit: is it possible for all the folders to still be in the computer, just not up front?

[MetalSlimeHunt]

jucheck.exe-Checks for Java updates. Should be legit as long as its file location is in your Java files.
hpsysdrv.exe-Preforms several HP specific jobs. I'd be wary in the event you don't acutally have a HP computer.
ehmsas.ect-I can find nothing on this but a site that is clearly offering a fake antivirus program to determine if it's a virus or not. I say kill this one.
kbd-Configures Logitech keyboard settings. Probably safe.
alg                 user name LOCAL SERVICE -Windows OS component that allows connection to the internet. It should be inside System32. If it isn't, kill the process and see if you can connect to the web. You'll have to restart your computer to connect again if it turns out to be the real deal.
wscntfy-Windows Security Center Notify Application. Does not exist in Windows Vista or Windows 7, and is a trojan if you have either of those operating systems. Should be inside System32 otherwise.
dllhost-Controls processes in the Internet Information Services, used in a boatload of programs. Should be inside System32 if legit. A virus by the name of Nachi.A.1 masqurades as it.
MediaMallServer...(cut off & very ominious) -Believe it or not, this one might actually be legit. It seems to be involved with content streaming or somthing, but I can find no accusations of it being a virus.
wmiprvse -Part of windows, I don't particuarly understand the explanation of what it does. It should have System32 in its file chain if legit, like the others. A virus by the name of Sonebot-B masqurades as it.
mcrdsvc -Part of Windows Media Center. Likely not our culprit.
YahooAUService...(cut off) -Yahoo's auto updater. Ignore.
MsPMSPS-Jackpot. This, if legit, is Microsoft's DRM for their media player that enables it to download files to an MP3 player. If you are running XP I am told it's most certainly a virus. Otherwise, there are people reporting it as a virus as well. It doesn't do anything vital even if it is real, so record the file location and kill the process.
svchost (several of these) -Generic host processes. Unlikely to be involved in this.
ati2evxx -Component of ATI drivers. If you don't have anything from ATI, beware. Even so, I'm seeing virus reports on this one. Check the file location for anything suspicious.

[Ricky]

Thanks a million, I was farting around with the file search function and managed to open up a virus scanner, so far it's found 6 threats, but i'll do away with the rest.

thanks

edit: question:

If i start going trigger happy and terminate several processes, will it cripple my computer? do they come back if you open them up again, or should i do my own independant research on each one?

[Cassicotca]

Worst thing to happen from killing random processes is that you would have to restart the computer

[Ricky]

Well, deleteing those prcoesses and the virus scan might've done something, but i still have to programs or files, the obscure searches are still sppearing, and it's 11:00 and i'm going to bed I'm expecting a shit storm from father in the morning, and i probably will not be able to even think about messing with it because "he's the smart guy when it comes to this stuff" so i'll check back here tomorrow or the next day!

[ed boy]

It sounds like your computer is in a bad way. The most effective virus scan is one that is done from a source you know is uninfected. Since the computer is infected, you need to create a boot disk.

-Get access to a computer that can burn CDs/DVDs, and that you know is clean
-Download a boot disk program. There are loads to choose from. Kaspersky seems to be a good one.
-Burn the disk
-Boot the infected computer from the disk, and run the scan.

[Satarus]

You may be better off formatting your drive and reinstalling everything from scratch.  Rootkits and several viruses can lead to instability even after you clean them off.  My advice, back up all yoru documents onto a disk and then start over again.  Be sure you have a virus scanner up to date and running before you even think about restoring your documents. 

[lordnincompoop]

Spoiler: Method 1 (click to show/hide)

• Download MBAM and MSE on a USB from another computer
• Start in safe mode on the infected computer
• Scan and delete with MBAM
• Restart, check for viruses
• Repeat until they're all gone
• Rejoice!

Spoiler: Method 2 (click to show/hide)

• Procure OS install disc
• Reformat
• Reinstall
• Rejoice!

Spoiler: Method 3 (click to show/hide)

• Call an IT technician
• Rejoice!

Spoiler: Method 4 (click to show/hide)

• Buy new comp
• Rejoice!

Spoiler: Method 5 (click to show/hide)

• Cry your heart out.

[Ricky]

Like I said in the new OP, one step is complete, but more are there to conquer. Like LNCP and various other sources mentions, we might be able to download a clean antivirus software from a friend, and use that to out own advantage.

[Zrk2]

Spoiler: Method 1 (click to show/hide)

• Download MBAM and MSE on a USB from another computer
• Start in safe mode on the infected computer
• Scan and delete with MBAM
• Restart, check for viruses
• Repeat until they're all gone
• Rejoice!

Spoiler: Method 2 (click to show/hide)

• Procure OS install disc
• Reformat
• Reinstall
• Rejoice!

Spoiler: Method 3 (click to show/hide)

• Call an IT technician
• Rejoice!

Spoiler: Method 4 (click to show/hide)

• Buy new comp
• Rejoice!

Spoiler: Method 5 (click to show/hide)

• Cry your heart out.

Spoiler: Method 6 (click to show/hide)

• Collect hammer
• Apply hammer
• Rejoice!

[/list]