Virus and "OEM Restore Disc"

[Duh_Vinci]

I let my little brother take my laptop for few days, well, it came back with crap load of viruses. I'm not very computer smart, so sorry for dumb question:

I don't seem to be able to wipe them out completely with AVG software, internet just starts over and over again every 3-5 minutes and takes me to some random sites...

If I was to insert the factory "Restore Disc" - I understand I will loose all the files, but would I also loose all the infected files and would the laptop be fresh and clean again?

Open and thankful to any other suggestions.

Regards,
D

[Damn Brit]

That sucks D, sorry I can't be of help.
Look on Craigslist or in the local newspaper classifieds, you should be able to find a nerd who charges by the hour advertising his services.
If you just use the restore disk you might get your system back but you will have lost stuff and you still won't necessarily know what might be lurking in your computer.
This is why it's so important to back stuff up. I'm not lecturing, I don't back everything up either (only my pics).

[stevebrot]

You might want to seriously consider a commercial anti-virus software such as McAfee or Kasparski (I am not too keen on Norton in recent years). In any case, archive your photos and other important files off to some sort of backup media before you attempt a rebuild. If possible, make sure that your OS is fully installed and fully patched before attempting to install your office, photo, and other software. Start with the AV software and go from there. You can scan your backup data files for virus before you copy them back on.

The best defense in the future (along with good AV software) is to restrict software install privileges., never let anyone use your computer with an administrative account. Configure so that you have a "dumb dumb" account without software install privileges and use that for the occasional relative or friend that wants to use your box. Most of these viruses come aboard as companions to instant messaging services, cute icons/emoticons, or music/video sharing software and toolbar/browser/desktop add-ins.

It may sound like overkill, but my personal account on my workstation is restricted. I only use the admin account for system maintenance and software installs. This practice has saved my *** on at least two occasions when a payload was dropped on the system, but could not deploy since my account was underprivileged. The nasty was picked up and disposed of on the next routine virus scan.

Steve

(BTW...in regards to Gary's backup advice. I had to do a full system rebuild just a few weeks ago due to a failed hard drive upgrade. The new drive developed surface faults after only about 20 hours of operation. My data was literally turning to dust. Fortunately, I was able to get a good backup before the thing went totally down. As a result, my new policy is weekly backups to disk and monthly archive to DVD.)

[chrisman]

Before you try the restore disk which may or may not preserve your data (depends on the Laptop manufacturer) download SuperAntispyware Fee Edition from here

|MG| SUPERAntiSpyware 4.23.1006 Beta

Choose a download location and click Save when prompted - run the downloaded file and answer yes to all the install questions. Make sure you say yes to downloading the latest definitions.

Choose <Scan your computer> from the main menu and <Next> on the following screen.

Wait for it to scan your PC - normally 10-15 minutes. If AVG reports finding a virus during the scan select the <Quarantine> option.

When the scan is finished, close the Overview window and click <Next> to remove the offending items - most likely a mixture of Trojans and spyware. Let SuperAntispyware re-start your PC.

There is a very good chance this will solve you problem.

[Photo Tramp]

If AVG didn't detect a virus and quarantine it then one of two things are happening here. 1: The AVG software you used didn't scan your files and folders deep enough to find the virus. Or 2: it's not a virus but Mal ware. and this will not be picked up on a normal virus scan. there are Mal ware programs out on the market but I can't say which one is best.
I know when this happened to me I was able to get a backup of my important files on an external hard drive, and then reformatted the hard drive I was having the problem with. Takes care of Mal ware rather easily. (and any virus that is undetectable) I hate to reformat but because other users can't stay out of internet sites, I was finding I had to reformat every three months. (this is where backup really pays off.) That is until I got Microsoft One Care. (Works with Vista and also XP OS) Great program and takes care of the virus and Mal Ware, and spy Ware problems along with doing a complete daily backup and scan.

[Photo Tramp]

There is one other thing to try before you do a system restore. ( A system restore will only put your OS and system back to it's original state from the manufacture. It will not save any files or data that is stored on your system and could also still be infected.) try instead booting into safe mode to the last known good configuration. Pick a date and time right before you lent your laptop out and restore the system back to that time. You will not lose any other data except the data you have put into the system since you got the laptop back. So if you can back up the new data since you had the problem to another hard drive and do a virus and Mal ware scan it would be better than a complete system restore.

[Tom S.]

If you aren't computer savvy, Gary offered the best advice - find a geek.

I spent nearly a day working on a friend's lap top that had both viruses and mal-ware. The viruses were easy, the mal-ware took the bulk of my time. It was very sophisticated and put hooks into a number of files that either had to be replaced or deleted. The problem was finding which ones and where they were.

On the plus side, when I was done, my friend said he never remembered the laptop running so well.

[Nick1946]

I agree with Photo Tramp, if you are using Microsoft(didn't know what laptop or O/S you are using). I seem to be the "crapped up laptop" magnet for my niece's laptop-same thing happened to her when she loaned her laptop to her little brother and I used the Microsoft system restore point on it,just got her to tell me when she loaned it out and chose the day before that as a restore point-it came back and is working great.

[Duh_Vinci]

Thank you all very much for your input and suggestions!

I'll be honest with you, I'm slacking big time when it comes to backing up files and such. But that is largely due to the fact that I've never had anything happen to any of my computers in almost 16 years.

Last night (or should I say early this morning), in a disparate attempts to get that laptop cleaned, I've downloaded trial version of spyware doctor (first hit from google search from PC magazine)... On the highest detection setting, it's been running for about 4 hours now, and found tons of stuff, mostly trojans. AVG on the other hand found NOTHING =(

Remaining time still over an hour. And after that, if it is "deemed clean", I would most definitely invest into professional full suite as you guys suggest.

Many many thanks for all your help, appreciated indeed!

Regards,
D

[germar]

Originally Posted by Duh_Vinci

Last night (or should I say early this morning), in a disparate attempts to get that laptop cleaned, I've downloaded trial version of spyware doctor (first hit from google search from PC magazine)... On the highest detection setting, it's been running for about 4 hours now, and found tons of stuff, mostly trojans. AVG on the other hand found NOTHING =(
D

Not to create more fear and doubt for you, but you've got to be really careful with downloading the first anti virus package that come up on searches. Often these no name software packages come with their own viruses in tow, so when you run them it looks like you've found lots of hidden bugs the others have missed ...and you plunk down your money.

Listen, I still agree with the other poster, do whatever you can to offload your personal data files that you can't replace and find yourself a geek, someone who knows about this sort of thing. Make your little brother pay for it, as he was probably using your laptop to surf for naughty things in naughty places.

If you need to do this yourself and you don't want to start over with resetting your hard drive back to the factory image disk, you need to do the following:

STOP using Internet Explorer for your browser. Go out and download Firefox, Chrome, or Oprah. I say this because it sounds like the malware is hooked into your browser and will most likely NOT allow you to download virus scanners.

Using your non-IE browser, get yourself the following suite of programs from the web:

AVG (I think you have this)
Kaperski AV suite
Zone Alarm Free Version
Spybot Seek and Destroy
Trend Micro PCyllin (I think they have an on-line search as well)

Run ALL OF THEM. Each one may catch something the others won't.

Modern malware is really smart and really nasty. Often the only way to rid yourself of them without wiping your disk is to hunt down single files in weird directories and/or hand update your Windows Reg files, which is not for the faint of heart.

Sorry about this, best of luck to you.

germar

[PeterAM]

Add CCleaner to your list of things to download. This removes all kinds of junk that accumulates over time and slows the machine down.

CCleaner - Home

[stevebrot]

Originally Posted by germar

...Go out and download Firefox, Chrome, or Oprah...

I am particularly fond of the Oprah browser. It has the current bookclub choices in the favorites list.

Steve

(Opera, on the other hand...)

[cpopham]

Originally Posted by Duh_Vinci

AVG on the other hand found NOTHING =(

That is because AVG is a piece of crap, one of the worst free antivirus tools available.

For something better, check out Avast!

[Duh_Vinci]

Thank you all again for such valuable information, suggestions and feedback! I've taken all of it in and here are the latest results:

"Scan type: Full Scan (C:\|)
Objects scanned: 104329
Time elapsed: 47 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0"

I've built few PCs in the early/mid 90's but when cost/benefits of building it myself was less than desirable for me personally (specially considering I've never played a single movie or video game on computer), I purchased all my PCs and laptops after than. So I'm not completely "unfamiliar with the subject, but rather rusty Well, very rusty

So here are some issues I've encountered (just in case if this case would sound familiar)

AVG - did nothing, nothing at all!

Rising Information Technology - waste of time, really (6 hours +, and found/removed 4 objects)

SUPERAntispyware - Thank you Chrisman, this software was first step to resolution. It found 75 objects with in first 7 min of scan! Said it removed all, but each time I restart the notebook, a lovely "Vundo" would still be there, over and over again. Quick search on the net - revealed to me how many people affected by it, and reportedly, very difficult adware to remove.

Vundo_Fix (dedicated site/group that develops software to remove it - detected nothing.

So after reading some feedback and comments, a software was suggested as it worked with a great success in removing this Vundo crap was Malwarebytes. It picked up additional 15 objects on the first quick scan, and additional 4 - the actual Vundo adware on the full scan and removed all.

So as German said, tried various software, glad I did, learned alot!!!

So I rebooted, rescan again - all good!!!

I will indeed invest into paid subscription for antivirus software, last 16 hours of battling with computer - not worth it!

Huge thanks again to all for your help and suggestions!!!

Kind regards,
D

EDIT: Forgot to mention, CCleaner - use it and often! And as for IE - have not touched it since one of the first releases of Firfox - love it!

[cpopham]

Good to hear you've had some success in getting things cleaned up!

Originally Posted by Duh_Vinci

I will indeed invest into paid subscription for antivirus software, last 16 hours of battling with computer - not worth it!

Seriously, there are some perfectly acceptable free AV solutions, there isn't a burning need to buy something. This site has a good comparison.

Personally, I use ESET Nod32 which is not free, but isn't particularly expensive either.