Malware problems

Discussion in 'Life, the Universe and Everything' started by nexus7, Sep 23, 2007.

Tags:
  1. Hi; I haven't posted for a while as I am having problems with accessing Add/Remove Programs and other systems tools in the Control Pannel.

    When ever I attempt to, a standard Windows restrictions message pops up (see attached jpg) denying me access - no doubt I've contracted malware or something... Any help really appreciated.
     

    Attached Files:

  2. Phoenix

    Phoenix Esquire

    Try logging in with the Administrator account. Boot the PC in Safe mode in order to make the account appear in the login. Then run the Add/Remove program. I hope you will be able to uninstall the programs you want, and hopefully the malware as well :)
     
    • Like Like x 2
  3. Many thanks Phoenix! I completely forgot about safe mode, but I still think there's something bad on my pc.

    I couldn't remember exactly how to boot in safe mode, but then found some old notes on when I last used it some years ago - the steps are/were:

    1. Click Start, then Run
    2. Type msconfig, then OK
    3. In System Configuration Utility select BOOT.INI tab, then click /SAFEBOOT
    4. Click OK
    5. Click RESTART when asked to (this reboots pc in Safe mode)
    6. When finished working in Safe mode use the System Config Utils to start XP in normal mode (see below):-
    7. Finish what you need to do in Safe mode
    8. Repeat steps 1 to 4 except in step 3 uncheck /SAFEBOOT
    9. Close all progs if any are open then restart

    Basically I got into Safe mode OK after logging in with administrator acct (I'm the only user anyway...) but I still got the same pop-up as shown in first post when I tried to access Add/Remove Programs, so I haven't a clue now...:confused:
     
  4. TalkerBot

    TalkerBot Forum Pest

    Which ones?Thats okay I forget things all the time.Could anyone do remember exactly how to boot in safe mode but then found some old notes on when he or she last used it some years ago - the steps arewere1?How did you hear about Program E?
    "msconfig then OK3"What is in System Configuration Utility select BOOT like in there? My brain uses AIML to format responses to your inputs, but I don't have one for that.
    What's your sign?
    Have you ever been to Europe?
    The past is history, the future a mystery. Today is a gift,
    that's why it is called "the present".Are you really a ""?
    "steps 1 to 4 except in step 3 uncheck SAFEBOOT9 "In any case, Is that a command?Oh.
    Umm.
    What would make you stop got the same pop-up as shown in first post when he or she tried to access AddRemove Programs so he or she have not a clue? Where did you get your the same pop-up as shown in first post when he or she tried to access AddRemove Programs so he or she have not a clue?
    I have
    a perfect operational record.
    No I never get confused.
     
  5. Phoenix

    Phoenix Esquire

    Things are bad then. I can only suggest to find a spyware-adware removal program along with an antivirus to check your pc and hopefully remove the malware. If something like this is not possible or gives no results, then backup everything important and use the old good way of Format. I've formatted my HDD thousands of times. It's the final and most safe and secure way of dealing with anything malicious in your PC. The only side-effect is that you have to back everything up. At least the important stuff. Don't use a backup manager (like the one Windows have) because the malware might be stored as well, thus resulting in a big waste of time :(

    Good luck I hope, m8! :)
     
    • Like Like x 3
  6. TalkerBot

    TalkerBot Forum Pest

    Where did you hear that?Oh you can, can you?
    It could be true I suppose.That's nice.
    I have
    a perfect operational record.
    I've heard of it before.There might be others.Tell me more.Ok I'll try not to do

    use a backup manager like the one Windows have because the malware might be stored as well thus resulting in a big waste of time Good luck he or she hope m8

    too much.I'm happy you're amused.
     
  7. Phoenix

    Phoenix Esquire

    Hmm, BlabberBot is the malware it seems!

    -rep to you Bot! :mad:
     
    • Like Like x 2
  8. I told you talkerbot's madness leaked out :(
     
  9. alternatively, if you press F8 a few times during just after BIOS screen, memory checks etc, you should get a boot menu that allows you to select a few things including safe mode.

    Another nice tip is if you don't have expensive anti-virus, you can use House-Call which is a free scan.
    I think you can even do this from 'safe mode with networking'.
     
    • Like Like x 3
  10. Many thanks to all. I'll try all the suggestions
     
  11. Right. I ran House-Call but found that this is a bogus anti spyware program - it doesn't actually remove anything, or it doesn't work with Mozilla.
    I'm reluctant to reformat the HDD as I no longer have the original instalation CD's for some programs. Yes I could still backup the installed run files on my 30 gig usb drive but do not know if I could reload these programs from that after formatting.
    My data is all backed up so no worries there... So I'm still really stuck here
     
  12. Phoenix

    Phoenix Esquire


    This is a problem... If you can, since you own those programs, you can download a copy of them from the Web. Search a little and get them because you really need to be in a condition to be able to format the HDD and get your system up and running afterwards. Also, if someone knows a free or even shareware program for removing spyware and adware (cause I don't) which actually works, please post here.

    I hope your problem ends soon, m8!

    PS. Another thought. Make a partition in your HDD and install Windows XP there. Then enter the Program Files folder of the problematic Windows and simply delete the spyware program folder (if you know which it is). It won't be able to work when you start the previous Windows, and maybe you will be able to get rid of it for good :)
     
    • Like Like x 2

  13. There is also a VERY useful utility called Bart's PE - this creates a runnable version of windows on a bootable CDROM - which can than access your windows partition on the HD.

    It allows the kind of editing that Phoenix recommends above, without having to install a fresh copy of windows.

    Spware wise, I generally use ad-aware because it is free/trialware and although it doesn't clean up ALL such software, it is a good name i.e. reliable
     
    • Like Like x 3
  14. Many thanks, and sorry to tie you all up with this as I know you're really about Entropia.
    I've decided to copy all the programs that I no longer have the original CD-ROM's for to my usb drive (the others I can simply reinstall) to see if they will run from there. If that works, I will then copy them back to the HDD and see if they will run from there. If that works, then I'll be ok in reformatting.
    ----
    If I can't do that, then it will mean looking for a good anti spyware prog...
    --------
    OK- I copied one program that I no longer have the original CD for to the usb drive, copied it back to the HDD, and it ran OK. This should mean that I can copy the entire Programs folder in the same way, and then back again and all programs should run. Don't know if this is a new trade secret here...
    -----
    One final silly question though... If I reformat the HDD what will happen to the Windows-XP? Would I have to reinstall that or does it remain?
     
    Last edited by a moderator: Sep 29, 2007
  15. Unfortunately, just because one program works it doesn't mean all the others will. Some may install DLL files in to the Windows area, or they may put stuff in the registry. You'll need to try each one to be sure.

    And if you reformat the HDD everything will be gone. That includes Windows XP.

    It's a real pain :(

    Hope you get it sorted.

    Erach.
     
    • Like Like x 6
  16. Phoenix

    Phoenix Esquire


    This DOESN'T work Nexus7. Windows tricked you. If you just copy the Program Files folder, almost no program will work after you paste it again in the new formated HDD. As Erach said, most programs, if not all, put stuff in the registry. This way Windows know this program exists and know how to run it. When you format the HDD, everything is gone, including the registry. So when you paste the Program Files folder later, Windows will not understand anything because the registry will be blank. And I do not recommend backing up the registry you currently have because this will lead to backing up the malware as well. This is also why I mentioned not to use a BackUp Manager. The program you backed up and then pasted back into the HDD, either hadn't inputs into the registry or, most probably, since the registry still recognises it, it run successfully.

    I hope that you will finally solve this problem, m8!

    PS. This trick is like the one used for shortcuts. It really annoyed me every time a friend came home and told me he managed to fit several games into a Floppy Disk, only to discover later that he had put shortcuts of them inside. And of course those shortcuts worked just fine when he ran them from the Floppy at his PC, because he had already installed the games and the shortcuts had a valid target to run from. In my PC those shortcuts had no valid target so... you get my point.
     
    • Like Like x 4
  17. Hi Nexus, as others have commented you will have limited success doing this.
    To make your test complete you would have to try to copy the progrgams folder to a new windows installation.

    An installed program usually consists of:

    • Program binaries - as found in program files
    • Local libraries - also found in program files
    • Other files - like .ini files for configuration, also resources such as images and sound - usually in program files
    • Shared libraries - usually found in the windows\system32 folder, but may also be associated with other programs (office suite for example shared lots of libraries amongst it's programs
    • Registry entries - in the registry, and can be 'copied' by using the import and export facilities in the 'regedit' program - some under LOCAL_MACHINE and some under CURRENT_USER

    The trick is to determine the full load of an installer. Sometimes you may find a log generated by the installer within the program files folder - this may identify the elements described above or may not - it may not even be readable with 'notepad' or similar program.

    I suggest you list the programs you are talking about - you may find that people here on the forum may know where to obtain an installer.

    The same could be said of program files that you are copying - unless they have been 'cleaned' by an anti-virus program you may be infecting your new installation.
     
    • Like Like x 4
  18. Heck... Many thanks to all. I think I'll try ad-aware as I used that once before, only the free period ran out.
     
  19. Shamy

    Shamy Dr. Nick of Dark Lands

    Ok... It seems that my computer is damned to annoying corruption of malware/virus...
    :cough:
    The virus came through Messenger link, that I foolishly clicked. Quickly it took over messenger and sended itself to all my pals who were online (no infections were made since no1 clicked on that damn link.) I activated my Antivir program and it found 2 viruses and a malware program. I deleted these files and quickly realised that my Antivir was infected also.

    Now I cannot delete/reinstall it, it refuces to operate and it blocks all my attempts to install other anti-virus program. So other words I'm screwed... Destroying all files from C:\ and reinstalling windows is my final move :D. I'm not sure how this works, but I won't be around until everything is back to O.K. (Hopefully tomorrow)

    Just in case:
    Cya around m8s!

    ps. I didn't think that any1 would mind if I use this threat rather than creating a new one.
     
  20. Phoenix

    Phoenix Esquire

    OUCH! Good luck m8!!! :Nurse:

    PS. I don't mind. ;)
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.