I have a virus I cant get rid of :(

[.jrauck]

I dont remember what I downloaded(I think it was a codec of some kind) and I got a virus soon after I downloaded. Its like a spyware thing that was downloaded and it says VIRUS FOUND even though its the thing that was added by the program I downloaded.

It also put popups so when im playing a game it will kick me off and a popup will come up or the coloring in the game will completly change colors.Anyone know how to fix this problem?

[AKA_RA]

first try uninstalling the program, if its even listed, which i highly doubt. then you need some spyware removal programs. get both spy-bot and ad-aware, theyre both free. just google them and youll find a good place to download the upto date versions.

[silverdemon]

If you know what the program/virus is called, you can boot in safe-mode and then uninstall and remove everything that has something to with it (also look in 'temp' folders and the like...)

[Nagoshi]

Get AVG Free Edition (free.grisoft.com), it should get rid of most of the viruses you can find. There may be some that you wont be able to get rid of, but it will show you where they are, just go delete them yourself :P

[Aero]

hmm, I think I had this one before. I tried installing codec for a non-mainstream video of some kind (don't remember it was last year). I thinkI had to end up doing a system restore though. You may have to if the anti-virus programs don't work.

Next time you get a pop-up saying "virus found" write down the name and google it. I think there a database that has all known viruses and ways to remove them.

[CanaBalistic]

OK, i have the complete system for removing malicious crap you may have downloaded.

First i start with a registry scann and repair as needed (registry mechanic pro)
Then i do a spyware scann (Ad-Aware SE Professional)
Then ill do my virus scann (norton AV 2005)

Now ive had the problem where you can find the file but not delete it. This allways, ALLWAYS, ALLWAYS!!! pisses me off to the max! I got this really cool program that intergrates with windows and lets me select any file for deletion on the next boot (very useful if you hate safe mode as much as i do) The program is called "Move On Boot".

Iformation on program:
Version: 2.9. Languages: English, German, French.
GiPo@FileUtilities is a set of utilities for Windows 95/98/ME/NT/2000/XP that provide many useful services:
GiPo@MoveOnBoot - copying/moving/renaming/deleting files and folders on the next system boot.
GiPo@DirMonitor - monitoring changes in the file system.
GiPo@Mount - local folders substitution and local/remote drives mounting.
GiPo@Hardlink - UNIX-like (POSIX) hardlinks for NTFS creation.
GiPo@ReadTest - checking files and folders for read errors.
Utilities can be integrated into shell.


http://www.gibinsoft.net/gipoutils/

With this set of programs i have managed to stay virus free for over a year and a half.

[edit] All thies programs can be obtained "free" if you patch them (i wont give out info as it got me in trouble last time, PM me if needed)
Your welcome

[.jrauck]

They guys for the help but mainly thankyou very much Cana-Balsitic for helping me get rid of that virus. I took al the steps you said(instead of norton I used avg) and the viruses are finally gone.

[.jrauck]

Dammit, the popups came back I dont know how but they did.

[silverdemon]

some virusses are programmed to install themselves again when they are not properly deleted... You need to delete every part of it before it is truly gone. Check your temp folders (temporary internet files etc...) and throw everything away that you don't need. You might need to boot in safe mode to clear everything, since the virus could still be active as a 'proces'... try doing what you did (as cana-balsitic said) but now when you're in safe-mode...

hope that helps you get rid of the nasty virus for good

[.jrauck]

Im not trying to dis anything you have said but what is the point of going into safe mod?

[CanaBalistic]

safe mode only runs system critical applications and shuts down all networking (unless specified, i think). This disables everything else including viruses and lets you fix problems in a safe environment.

Do thoes pop ups open when your browser is opened or closed?

I also forgot to mention what firewall i use. I use Sygate pro. It was bought out by symantec and is now the firewall they use in thier bundel. I have the last free version of this program and it still works flawlessly as the internet hasnt changed since it was created.

[Rankenphile]

Go get Hijack This! (http://www.download.com/HijackThis/3000-8022_4-10379544.html) and post your log results. It should give us a good idea of what is going on.

[Nagoshi]

I use ZoneAlarm as my firewall (free version) to control my Internet traffic, and since I use it I only got like 1 virus since I have DSL (which is about 6 months) and I dont have pop-ups or any backdooring spyware activities going since I only limit the softwares I want to go on Internet.

[CanaBalistic]

I hear zone alarm is pretty good. Black Ice Defender is supposed to be excelent. I've now heard that windows firewall is really good too.

[silverdemon]

yes, like cana said, safe mode starts only the processes that are truly NEEDed for windows to run. You can choose to boot in safe mode and safe mode with networking (and another option which i don't remember right now...)
So the virus-proces will not be started when you boot in safe mode, and thus you can remove it...
I believe you can boot into safe mode by pressing F8 when restarting (booting)

[CanaBalistic]

The other option is safe-mode with promt. I think this was added for backwards compatibillity with older version of windows. Who uses a command promt now days?

C:\ dir \anchient\craplola\

[Guttenaffe]

Post the hi-jack this log. I used to do this for a living before I transferred to work in the data-center.

Another the best program is ewido (http://www.ewido.net) from my experience working on 1000’s of student PCs at a major University.

From what you said you might have some form of "Spy Sheriff" but I'd need to see more stuff from the PC.

Safe mode doesn’t work for all malware, especially the ones that hook the shell and are loaded with the window's logon applications.

edit: EEEK!!! I just read the post of other users; DO NOT UNINSTALL the application that dropped the malware on your PC. Most of these applications will add more and WORSE malware to your PC than what you are trying to remove. The best action is to delete the malware from the pc. They use a program such as Jouni Vuorio's "Reg Cleaner" to remove the uninstall entry and then do a scan for useless/missing file entries.

Spybot S&D also has a tool to clean the uninstall menu, but I've yet to be able to remove something with just SpybotS&D or ad-aware, though both programs are very good at cleaning up after the internal (mostly manual) removal of these horrid applications.

[DaveW]

Get AVG Free Edition

A great peice of software. When i can afford it i'll be paying for the full version, just so they keep churning out good software. Adaware is allright but i find they lag behing other programs when it comes to updates for modernised malware/spyware programs.

I've cleaned my little brothers porn/spyware infested computer too many times. Any hints as to how to stop a 15 year old from downloading all the porn in the world, including the really weird ****, will be appreciated.

-Dave