Few General Questions: No Taskbar @ Safe Mode. Virus removal.

[Coldkilla]

I've got a nasty Virus in one of my PCs. I have registered versions of both Spyware Doctor and BitDefender. Both programs have flawlessly removed the viruses/spyware from the past. Now the virus/spyware keeps coming back after it is removed.

I have Windows XP Pro (2600). I did a full scan with both SW and BDefender. Both found Viruses/Spyware and were deleted accordingly. I restarted PC in safemode. I did not see the taskbar so I ran everything from the task manager. I ran SW no problem, did a scan and found same viruses/spyware. However I could not open the main menu screen for Bit Defender and could thus not start a system-wide scan.

What do yall recommend I do? I know the infection will come back if I don't run the appropriate scans with the appropriate software. Any info appreciated. Thanks.

 

[Coldkilla]

4+ hr bump

 

[mechBgon]

Can you get the exact names of the viruses and spyware, as reported by SW Doctor and BitDefender, and post them here? That will help figure out a good plan for retaliation :evil:

 

[Coldkilla]

Sure. I'll be sure to throw that up tomorrow. *Be Warned there are a lot of them* -- Personally I think its just one infection that is hidden inside my computer and the scanners check and delete all of the branched off infections but fail to kill the "core" infection if that makes any sense

I'll have it tomorrow. Thanks mech.

 

[Coldkilla]

The Viruses that have been detected this far:

BitDefender starts with saying "Virus Alert - Infected With" -- Here are the viruses:
MemScan:Trojan.Downloader.ConHook.AI
Trojan.Virtumod.ALZ
BehavestLike:Win32.ExplorerHijack
Trojan.Vundo.AY
Exploit.Win32.MS05-002.Gen
Adware.Winantivirus.M

 

[mechBgon]

Originally posted by: Coldkilla
The Viruses that have been detected this far:

BitDefender starts with saying "Virus Alert - Infected With" -- Here are the viruses:
MemScan:Trojan.Downloader.ConHook.AI
Trojan.Virtumod.ALZ
BehavestLike:Win32.ExplorerHijack
Trojan.Vundo.AY
Exploit.Win32.MS05-002.Gen
Adware.Winantivirus.M

Vundo. If it were me, I'd back up my important stuff, make a DBAN CD, unplug extra drives, DBAN the boot drive, then reinstall Windows, and then avoid whatever sort of stuff (typically warez, serials and cracks) brought Vundo in the door.

If you want to slug it out with Vundo, try John's malware removal guide. I'd suggest uninstalling your present antivirus and installing a 30-day trial of Kaspersky Antivirus 6 too, and max out all the detection in the Settings panel. If necessary, see if you can lasso a HijackThis expert into helping you (Medea comes to mind). But I think my Burn-It-To-The-Ground? method will be faster, and it leaves no uncertainty that the malware is dead :evil:

If you do reinstall Windows, take precautions (scroll down halfway for precautions) and take some more precautions in the future

 

[Schadenfroh]

If you have a clean system around, you can build an Ultimate BootCD for Windows with this massive load of antispyware / antivirus applications on it, you can even load the latest definitions for them, iirc.

This way you can scan and remove them all without having to boot from the infected windows install.

 

[Bulldog13]

Originally posted by: Schadenfroh
If you have a clean system around, you can build an Ultimate BootCD for Windows with this massive load of antispyware / antivirus applications on it, you can even load the latest definitions for them, iirc.

This way you can scan and remove them all without having to boot from the infected windows install.

Just discovered this thing 2 weeks ago. Awesome CD, just make sure to update all the requisite software before burning the CD.

 

[bsobel]

Either do what Schadenfroh suggested or if you can slave the drive to another working box (DONT RUN ANY CODE FROM IT) and run the scanner from the working box.

 

[tehach]

Have you tried the Vundo removal tools from Symantec:

http://www.symantec.com/securi...id=2004-112210-3747-99

or the one from Atribune:

http://www.atribune.org/content/view/24/2/

I used them both on a stubborn vundo infection and the atribune fix tool seemed to work a little better. That coupled with HiJack This worked to clean it up.