# Total Security Computer virus



## Opivy (Sep 13, 2009)

Okay, This virus hit me a little over a week ago - and I decided to not deal with it until the day before yesterday. (Hence why I haven't been here as much recently)

I have tried everything I can think of to get rid of this, and have been to a few pages for help.

I tried manually deleting all the virus related files listed on this website http://www.myantispyware.com/2009/08/31/re...l-instructions/ ( a little ways down )

and tried this guys advice http://www.bluegartrls.com/forum/80919-win...rity-virus.html (second post down) which is booting from a disc, and running some antispyware programs that are on it

But yet, to no avail. Every try, upon reboot the thing is back. Has anyone else been infected with this thing or have any advice?

I can't afford to lose my computer! It has original documents and recordings that will be lost forever =( - plus I love the thing.

Any advice is greatly appreciated!


----------



## sbugir (Sep 13, 2009)

try malwatrebytes antimalware, that stuff kills trojans like a mantis to flies  , also consider purchasing a harddrive to back up your documents.

Anyway, try malwarebytes antimalware, if it doesn't let you load it (the virus might know its antispyware) try renaming it and rebooting in safe mode to load it. Preform a quick scan and it should find stuff in about 10 minutes. It should be gone now. Download AVG free and Adaware for some realtime antispyware/virus stuff. It should keep you covered. If you need a more precise explanation feel free to pm.


----------



## Opivy (Sep 13, 2009)

I already had AVG and Adaware, but after this incident I'm considering something new hehe..

I ran Malaware,and Super Anti Spyware when I booted from the disk (as the virus won't let you run any programs, even in safe mode) and deleted everything that came up from a ful system scan.

I'm seriously at a loss guys =(


----------



## sbugir (Sep 13, 2009)

Uh oh, dude you will have to re-load windows. You should still be able to connect a harddrive and put all your files onto it... but superantispyware deletes literally everything good or bad. Perhaps you could try search and destroy? But malware didn't get rid of it???


----------



## Opivy (Sep 13, 2009)

Nope =( Ran Malaware, Super Anti Spyware, and Killbot(i think that's what it was called) And then rebooted to safe mode, and double checked all the files. (one in the registry came back) Once I was sure that the programs and I had got rid of everything, reboot - and ofcourse it came back.

I really hate to think I will have to put my files onto another harddrive (I'm not too computer savvy, my friend has been helping me) But won't the virus get carried a long?


----------



## sbugir (Sep 13, 2009)

If you're transferring music/docs/art/whatever else, you'll be fine. The virus usually only attacks anything that has to do with the registry and tries to keylog. But, you'll be fine if you put it on another hardrive. even if it does get on there and is in one file, it wont infect the hardrive as it has a very small registry and is usually formated differently. But you will need to definitely reload windows if its not coming off with all that antispyware.


----------



## bassist (Sep 13, 2009)

Too much porn.


----------



## Opivy (Sep 13, 2009)

Yea, I definitely dont want to lose all my man pr0n... So it's pretty much 100% sure I'll have to re-load windows? =( really wanted to avoid that.


----------



## sbugir (Sep 13, 2009)

Opivy said:


> Yea, I definitely dont want to lose all my man pr0n... So it's pretty much 100% sure I'll have to re-load windows? =( really wanted to avoid that.


If it's not coming off with all that antispyware, then yeah you will have to reload windows. I hope you weren't looking at pr0n  , anyway, your hardrive will be fine just make sure you have enough storage for your files  . The upside to reloading windows is that itll be like a new machine and will run pretty fast  . A windows reload though by the sounds of things is necessary


----------



## hibiscusmile (Sep 13, 2009)

if you cant do nothing else, call one of the geek stores, usually it cost 99 to have them fix something like that, do u have any idea where u got it?


----------



## sbugir (Sep 13, 2009)

yeah you could call a geek store, but 99 bucks is alot and theyll probably tell you to just reboot windows anyway :S


----------



## Orin (Sep 13, 2009)

It takes about two hours to reload your operating system but you don't likely have another choice. Back up your files but don't open them later using an account with admin capabilities or your files may contain code causing it to reload later from the net. I'm guessing you didn't set up a non-admin user to use on the internet?


----------



## Orin (Sep 13, 2009)

You can buy a flash stick (generally from 1-10 GB) if you have some idea how much space you'll need. A hard drive is generally much more expensive and is more likely to transfer your problem over.


----------



## Ian (Sep 15, 2009)

Thought I'd chip in on this if you were still having probs.

As already said, to much porn. Try the pay sites, they are never usally virus"ee".  

As for a problem, I can probably give you an outright solution. However, this will be as a last resort. Also, try your hardest not to give this software to much exposure, becuase one hackers and programmers that create viruses get hold of it, they will simply reverse-engineer it and it will be deemed useless.

Anyway, the program is calld combofix, and it has saved my PC from some horrendous viruses several times. Read the guidelines to use it here: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

I can almost guarantee it will remove your virus. Ignore the stuff they say about not using it before posting on the forums, it won't delete any important system files on your PC. They say that as a way to cover their ###### I suppose.

Good luck!


----------



## sbugir (Sep 15, 2009)

Combo fix never worked for me when I had antivirus 2009... but I guess i used it wrong. By now Opivy probably rebooted windows :S. I'm glad I've got a mac now, but I've been hearing about unix written viruses now -.- Poo.


----------



## Opivy (Sep 15, 2009)

I'm on a very slow and old Emac as we speak =( i very much miss my PC.

I have not rebooted windows yet - as I want to keep the stuff on my harddrive (and am unsure how to as of yet)

I tried booting from the boot disk again yesterday. Ran Kaspersky antivirus, Super Anti Spyware, Kill bot, and Adaware - and the virus is still there.

I'm going to try Ians link later tonight =) You will be my hero if this works!

Edit - Quick question Ian, will this program work in safe mode? Also, for some reason I can't go online while in safe mode, and it says something about downloading Windows Recovery Console - Is there any way to do that part with a flash drive?

(I plan on d/ling combo fix on this mac and putting it on a flash drive)


----------



## sbugir (Sep 15, 2009)

Emac  , That stinks dude. But yeah let me know too if combo fix works, I'll be amazed!


----------



## Opivy (Sep 15, 2009)

Another update, I just realized combofix was on that startup disk I d/led from one of the links above.

Hmm, guess I'll give it a shot - I'll keep you guys updated.


----------



## sbugir (Sep 15, 2009)

Good luck.


----------



## Ian (Sep 16, 2009)

Also, another tip. Disable system restore, and then restart your PC. Often a virus will get backed up in system restore, so when you switch back on your PC, it will regenerate from the restored files.

This is another thing that a lot of people bypass, that actually causes a lot of problems.

Kind of opposite to this, what you could try, is just a system restore, as this often restores your PC back to a state when you didn't have the virus. Try this first, if it doesn't work, then give the disabling system restore a go.

I believe combofix will work in safemode, yes.


----------



## Orin (Sep 16, 2009)

Ian said:


> Kind of opposite to this, what you could try, is just a system restore, as this often restores your PC back to a state when you didn't have the virus.


The first thing this type of virus program does is delete all your old restore points.


----------



## revmdn (Sep 16, 2009)

This is why I have a Mac and not a Pc(not that I can work any computer well).


----------



## sbugir (Sep 16, 2009)

revmdn said:


> This is why I have a Mac and not a Pc(not that I can work any computer well).


High five


----------



## Ian (Sep 16, 2009)

Don't know of any antivirus that delete restore points...


----------



## PhilinYuma (Sep 16, 2009)

Ian said:


> Also, another tip. Disable system restore, and then restart your PC. Often a virus will get backed up in system restore, so when you switch back on your PC, it will regenerate from the restored files.This is another thing that a lot of people bypass, that actually causes a lot of problems.
> 
> Kind of opposite to this, what you could try, is just a system restore, as this often restores your PC back to a state when you didn't have the virus. Try this first, if it doesn't work, then give the disabling system restore a go.
> 
> I believe combofix will work in safemode, yes.


There are a number of viruses, particularly those used with the popup programs offering to sell you "anti spyware" to clean out the virus that they have just loaded on your computer, that live in "system restore." By using that program, you are just spreading the virus.


----------



## sbugir (Sep 16, 2009)

PhilinYuma said:


> There are a number of viruses, particularly those used with the popup programs offering to sell you "anti spyware" to clean out the virus that they have just loaded on your computer, that live in "system restore." By using that program, you are just spreading the virus.


Yep, and the majority of a lot of those rogue spywares are actually further enhanced by rebooting/restarting your computer. What happens when you reload a computer as it restarts the whole registry begins to process which is usually where the virus is. Usually if you get a virus, you should never shut the computer off... In other words system restore will not work. The easiest way to get rid of a virus on PC is either A. have some pretty darn good antivirus stuff (ie paid for it...) or reboot windows. Rebooting windows is a heck of a lot easier...just time consuming.


----------



## Ian (Sep 16, 2009)

Also, consider posting a hijackthis log over at bleepingcomputer.com. They are a brilliant bunch of techies, and will prob be able to find you a solution.


----------



## bassist (Sep 16, 2009)

lemmiwinks said:


> have some pretty darn good antivirus stuff (ie paid for it...)


I disagree with this to be honest I don't even use antivirus most I use is programs to get rid of spyware etc. The few times I actually do a scan with antivirus I've never had a problem imo you actually have to TRY to get a virus.


----------



## Opivy (Sep 16, 2009)

Hmm, Tried using combofix last night from the boot disk and it wouldn't work for some reason.

How do I disable system restore? I think it may already be disabled, as my friend tried to restore my comp a couple weeks prior to the virus, and he couldn't get it to work.

I was thinking abou the hijack this log, but I can't access the internet with my infected PC. Maybe I can store the log on a flash drive and put it onto my mac?


----------



## Opivy (Sep 17, 2009)

Okay guys - I'm now here happy and back on my PC. My Friend came over, and we booted from safe mode and decided to try deleting the virus files from the registry again. Turns out every other time we had done this, we were leaving out one file. (decided to look at a new website listing the registry files)

Sure enough, fixed =)

for anyone else that becomes infected with this virus, you have my greatest sympathy - here is the list we used to get rid of it.

http://www.symantec.com/norton/security_re...-99&amp;tabid=3

Thanks everyone for all your input! This was a nightmare for me, and I'm just glad to have my PC back. Next paycheck I'm going to buy an external harddrive and back up my stuff just incase i ever run across a situation like this again.


----------



## sbugir (Sep 19, 2009)

Nice to here. Those pesky registry files suck. Definitely get an external harddrive, it's always great to have a backup  

Oh, and don't look at anymore porn


----------



## PhilinYuma (Sep 19, 2009)

Opivy said:


> Hmm, Tried using combofix last night from the boot disk and it wouldn't work for some reason.How do I disable system restore? I think it may already be disabled, as my friend tried to restore my comp a couple weeks prior to the virus, and he couldn't get it to work.


Congratulations on your victory! Just in case you ever have to mess around with System Restore again, you can switch it off by going to Accessories, Security, System Restore, and click on "open system protection." This will give you System Properties. Click on any box with a check mark(tick) on it until they are all blank and the computer is getting very excited about your losing all your "protection".

As you suggested, some anti malware programs will disable System Restore to prevent nasties from invading it.


----------

