How can I remove a virus when I can't get online?
February 1, 2010 6:05 PM   Subscribe

Help! I have a virus and I don't know how to fix it when I can't even surf the web!

This started a few hours ago. I can get to google. I search. I get results. When I cluck on a search result no matter what it is, the search calls up triplexfeed.com (the firefox or ie (both) status bar says "waiting for triplexfeed.com. The address bar also lists a triplexfeed.com address.) then it autoforwards to another site then another until it reaches something like yyzz-bb.com. I could have that last domain wrong. That address doesn't resolve so it stops there.

Ok, so I ran Norton and it found a "tracking Cookie" which it claimed to fix. But same problem. Microtell housecall won't run, I think because it can't load the TOS for me to approve. Microtell hijack this gave me 92 results and I said fix all, though you're not supposed to do that. Rebooted and all the little tray icons are gone from my clock, but search still doesn't work.

Now the last few minutes I can't search at all instead I get popups claiming I have a virus and offering to fix it. When I close those windows I get a web page designed to look like explorer

At this point I can't seem to use the web at all. I just get the faux virus warning everytime. I'm posting from my iPhone.

Help! What do I do?
posted by If only I had a penguin... to Computers & Internet (31 answers total)
 
Restore from a backup, format / reinstall. If you don't have a backup, after you reinstall, start putting together a backup system. Viruses suck, I'm sorry. :(
posted by CharlesV42 at 6:13 PM on February 1, 2010


That's not an easy one to remove completely. But in general, when removing viruses, the best way to go about it is to reboot in safe mode and run the virus and spyware scans there. To boot into safe mode, restart your computer, and as it restarts (before you see the logo) start hitting the F8 key. At the least, you should be able to back up files in Safe Mode without the fake antivirus program taking over, then reinstall everything.
posted by beyond_pink at 6:26 PM on February 1, 2010


If you can get to a different computer and download superantispyware, malwarebytes, and avast, you can try to install / run them on your computer. I would disconnect it from the internet right now though, it's not doing the world any good.

Also, maybe you can get somewhere by resetting your hosts file, it shouldn't have anything in it except the localhost reference:
http://www.spywarevoid.com/how-to-block-malicious-websites-using-hosts-file
posted by defcom1 at 6:33 PM on February 1, 2010


oh, and after you edit it and save, make it read-only. (Right click on the file, go to properties). That may help a bit...
posted by defcom1 at 6:34 PM on February 1, 2010


Response by poster: This just in: computer does not boot. It sometimes gets ad far as the windows splashscreen and then starts over. Over and over again. Doesn't boot in any mode at all.

I would like to do a final backup of my documents folder and would be more likely to get a new computer than to format (cause it's just time). Trying s cold reboot now.

Will there be a way to get documents, pictures and music off the hard drive if it doesn't boot and I replace the computer?
posted by If only I had a penguin... at 6:35 PM on February 1, 2010


Response by poster: Way back when there was DOS there was a way to boot so that you had to ok each boot command. Does that sell exist , and if so how do I do it and what should I watch for on the list of commands?
posted by If only I had a penguin... at 6:45 PM on February 1, 2010


You can create a self-booting CD, and you should be able to access your HD from there.

Google how to do this for now (I assume you're on a 2nd computer here). I can't find a step-by-step site, but they're out there. You can even boot from a USB stick, I believe.

btw this will put you in DOS mode, and should give you access to every available drive.

Are you absolutely sure that you can't boot in safe mode, though? I've never heard of that being disabled by a virus.
posted by hiteleven at 6:51 PM on February 1, 2010


hijack this gave me 92 results and I said fix all, though you're not supposed to do that.

...

computer does not boot. It sometimes gets ad far as the windows splashscreen and then starts over. Over and over again. Doesn't boot in any mode at all.

... and now you know why you're not supposed to do that. All Hijack This does is show you a bunch of places where things can hook themselves into your system, and allow you to remove the ones you think are malware-related. Quite a lot of those hooked-in things are not malware-related; some, as you've just found out, are vital for the ordinary operation of your system.

Way back when there was DOS there was a way to boot so that you had to ok each boot command. Does that sell exist

No. Windows versions from NT onward no longer have DOS under the hood; it's more like in the glove compartment. The closest thing Windows now gives you to a boot-time command line environment is the Recovery Console, and it's pretty useless. If only you had a penguin...

At this point, your safest and least time-consuming way to get your machine back on its feet is going to be this:

1. Use a different computer to download and burn an Ubuntu Live CD.

2. Boot the live CD on the sick computer.

3. Use the Ubuntu desktop environment, which looks and works enough like Windows that you won't get too lost, to open the sick computer's hard disk drive, find all the files and folders you want to keep (they will probably all be somewhere inside the Documents and Settings folder) onto an external hard drive or USB memory stick. If you don't have a big enough external hard drive for all the stuff you want to keep, now's the time to buy one.

4. Boot from your Windows setup disc and try performing a repair install. If this works, you should be back to square 1, complete with a virus infection that will need cleaning. If not, then it's reformat and clean-install time.

Do not install the execrable Norton antivirus suite again. Panda Cloud Antivirus is free and will give you much less trouble.
posted by flabdablet at 11:59 PM on February 1, 2010 [1 favorite]


...onto an external hard drive... should of course read ...and drag and drop them onto an external hard drive...
posted by flabdablet at 12:02 AM on February 2, 2010


My SO had a very similar problem last week; her laptop would boot, try to log her in, then immediately log her off and restart. We followed flabdablet's advice; salvaged her important files with an Ubuntu live CD and a bunch of flash drive transfers to my healthy laptop (we didn't have an external HD), then attempted a repair install with the windows disc that Dell overnighted to her. That didn't nuke the virus, and running malwarebytes from a flash drive couldn't root it out either, so we did a fresh windows install and now it's up and running again.
posted by craven_morhead at 7:56 AM on February 2, 2010


Response by poster: Thanks everyone. I'm going to start with flagdablet's solution and hope thR works. I don't get nearly as far as loogin when booting up so hopefully it's not the same virus as craven's SO had.

Is there a virus scanner I can run from ubuntu so I can try to clean the computer before returning to/ repairing windows?

I so dread the thought of formatting. Also, I haveu windows XP cd, but not the registration numbers so formatting could be a problem.
posted by If only I had a penguin... at 8:11 AM on February 2, 2010


In my digging around, I couldn't find a way to run a virus scan from ubuntu that would dig out viruses rooted in the Windows install. Might not be impossible though.

Also, when we reformatted from the XP CD, I don't think it asked for registration numbers or anything. Again, YMMV.
posted by craven_morhead at 9:03 AM on February 2, 2010


When you boot from the CD, select the option called "Try Ubuntu without any change to your computer" to run it from the CD. To get to your Windows files select places from top panel then XX GB media (that's your hard drive).

You can run Clam Antivirus in Ubuntu. It might not catch it, but it's worth a try. Select Applications > Ubuntu Software Center, then search for "Clam." Note: the installation will not be saved between Live CD sessions.
posted by nangar at 9:11 AM on February 2, 2010


Response by poster: It won't boot from the ubuntu CD. The cd drive is listed first in the boot sequence. It boots off of a CD called Knoppix. Somehow it doesn't recognize ubuntu as a boot disc. A laptop boots fine from the same CD so the CD is fine.

This says it can't find the filesystem (presumably because I don't have Linux installed) and leaves me at a shell where I can't enter anything because it doesn't seem to recognize my wireless keyboard.

Thinking of booting from the windows CD. Bad idea to back-up from there? To do the repair install without backing up first?
posted by If only I had a penguin... at 9:46 AM on February 2, 2010


Did you properly burn the .iso image file for the ubuntu CD?
posted by craven_morhead at 9:50 AM on February 2, 2010


I'm not quite following your description, but if it boots on your laptop, I would think the image is OK. It probably needs a driver to talk your keyboard, which isn't included on the CD.

Can you connect a regular keyboard to your computer and try again? (Borrow one maybe?) See if that fixes it and lets you use the CD.
posted by nangar at 10:13 AM on February 2, 2010


Response by poster: No, ubuntu doesn't boot on the desktop at all. It's the other CD that doesn't recognize the keyboard. And it's just a shell do I can't install a driver without a keyboard.

Also, it seems that if the ubuntu disc is in, it sometimes but not always finishes bootin into windows. But once in windows I still have the virus and it doesn't find my bexternal hard drive so I can't back up.

Current plan is to burn an anti-virus onto a cd and try to run it while windows is booted.
posted by If only I had a penguin... at 10:22 AM on February 2, 2010


Yeah, I think you want to get your data off of there first.

I'm not getting "can't find file system."
posted by nangar at 10:23 AM on February 2, 2010


Um. Wait a minute. Maybe this is really simple.

We forgot to say: insert the CD. Turn off the computer. Turn the computer back on with the CD inserted. Then it will boot from the CD. (And hopefully your keyboard will work too.)

You can't restart after inserting the CD like you did with your laptop (I'm guessing) because you can't get into windows.
posted by nangar at 10:29 AM on February 2, 2010


But if you can get Windows to boot, just go into safe mode and work from there.
posted by nangar at 10:32 AM on February 2, 2010


Response by poster: Yes, I was turning the computer off. Anyway, it booted from the windows cd and booted into the repair, but didn't want to repair. Tried ubuntu again and this time it booted. However it says there are "many bad sectors" on my main HD. Anyway I'm backing up now. It's 400gb to back up so it will be a few hours.

If my documents are on the bad sectors will they still back up?
posted by If only I had a penguin... at 11:45 AM on February 2, 2010


bad sectors are recognized by the drive's firmware and data isn't written to them. Lots of bad sectors means the drive may fail sooner rather than later.
posted by defcom1 at 3:33 PM on February 2, 2010


If an Ubuntu live CD is complaining about missing filesystems and bad sectors, it's complaining about its own boot environment (i.e. the CD) rather than the HD. Live CDs won't generally care what's on the HD until its own desktop environment has started and you try to get to the HD from there.

There's a menu option on every Ubuntu live CD to check the CD for errors. You should try this. If it fails, burn a different CD (preferably a different brand) and try again.

Don't plug your external HD into your computer while a virus-infested Windows is in control of it, or you'll end up with a virus-infested backup drive.

Is there a virus scanner I can run from ubuntu so I can try to clean the computer before returning to/ repairing windows?

There's Clam AV, but that will only detect viruses, not remove them.

The Trinity Rescue Kit is a small, command-line-only Linux distribution that comes with a virus scan script that will download and execute the trial versions of several commercial virus scanners. I use it regularly for cleaning infected Winboxen.

Thinking of booting from the windows CD. Bad idea to back-up from there?

If you can work out how to perform a backup using a standard Windows CD, let me know how you did it. I've never found a way to do that.

To do the repair install without backing up first?

A repair install, by design, will not mess with non-system files, so in theory this is a safe operation. In theory, there's no difference between practice and theory.

If you get no joy from your Ubuntu live CD, you might have better luck with BartPE. This is fiddlier to set up, though, because you need a working Windows installation (and a licence key) to build it against.

If my documents are on the bad sectors will they still back up?

Short answer: maybe. System administration principle number 0, which takes precedence over all other principles on all systems everywhere: digital data doesn't really exist until there are at least two copies of it. The right time to make backups is before you need them.

Long answer:

A sector is not like a zone that a document can be "in" or "on" (unless it's a very small documents). Disk sectors are the 512-byte chunks of disk space that disk drives let your operating system read and write. When an OS looks at a disk, it just sees a vast and featureless array of nameless disk sectors; it tells them apart by their logical block addresses (LBA) which are just numbers.

You don't usually see that, because your OS implements various kinds of file system to organize raw disk sectors into files (aka programs and documents) and folders.

Drives compute an error checking code (ECC) from the data in every sector they write, and store it on disk along with the sector's data. The drive checks the data against the ECC every time a sector is read, and if they don't match even after several re-reads it declares that sector "bad" or unreadable, and marks it as "pending reallocation". Then, next time the OS writes data back to that same sector, the drive will put it in a physically different place on the disc surface, avoiding the spot that caused the error. From the OS point of view, that makes the badness go away and the drive looks perfect again.

An OS can do a disc surface scan to identify bad sectors that haven't been transparently fixed in this way. When it finds one, it will add it to an OS-level (not drive-level) "bad sectors" or "bad clusters" list, and simply refuse to use it in future. This feature, still present in every present-day OS, is pretty much a legacy from a time before drives could do their own internal bad-sector management.

Keeping all that in mind: if your OS is telling you about bad sectors on a hard disc, that could mean one of three things:

1. The OS encountered one or more unreadable sectors while trying to work with a disc file. This kind of error will generally be reported slowly, often cryptically, and might cause an error box to pop up unexpectedly while you're doing something else. The cause is errors that have grown on the disc surface since the sectors belonging to that file were last written, and files affected by this kind of error will in general suffer some data corruption or even become completely unreadable.

2. The OS has at some point done a disc surface scan, and is now reporting that its own bad-clusters list has one or more entries. An OS-level surface scan will generally completely delete files that contain bad sectors; files left alone by such a scan will generally be completely fine unless the disc grows more errors after the scan, in which case (1).

3. The OS has interrogated the drive's own internal error log (SMART data) and been told that the drive has either moved (reallocated) more than some nominal amount of bad sectors, or that there are still outstanding bad sectors pending such reallocation. This will generally cause warnings about imminent drive failure. These warnings are often more alarmist than they need to be (automatic sector reallocation is a feature, not a bug) except when they're not (if a drive has used up more than about half its spare spots to reallocate bad sectors, it's on the way out and should be replaced).

Reallocated sectors will generally cause no trouble, but sectors pending reallocation contain unreadable data, and if those happen to fall within existing files within the file system, those files will most likely suffer type (1) errors when read.

The current Ubuntu live CD includes a disk diagnostic utility (under Applications->Accessories, if I recall correctly - sorry, I'm posting this from a Winbox) that can show you what's in your hard disk's SMART log.

It's quite difficult in this day and age to cause a bad sector deliberately, and it's also quite unfashionable for virus authors to try (there's no money in it), so bad sectors on your HD are likely to have been there since before you got your virus.

I so dread the thought of formatting. Also, I haveu windows XP cd, but not the registration numbers so formatting could be a problem.

Since I'm aware that this is an absolute button-pushing issue for me, I will merely draw your attention to the fact that you could have a penguin, and leave it at that.
posted by flabdablet at 4:15 PM on February 2, 2010


You might also care to check whether mdevore is still up for this.
posted by flabdablet at 4:21 PM on February 2, 2010


Response by poster: I hope someone sees this...

Sorry for the long delay, but I had an illness and then death in the family and so this was all put on hold and then I had to catch up on work. But I'm back, and still computer-less I've ordered a new computer but a month after the order it still hasn't shipped and won't for a bit yet so I'd like to get the old computer working-ish in the meantime and since I'll be giving it away, it will need to be working-ish for that, too.

Last night I finally managed to format the hard drive (believe me, not simple to get there) a was and possibly re-install windows*. Today I woke up to:

"Windows cannot start because the following file is missing or corrupt: c:\windows\inf\biosinfo.inf . You can attempt to fix this by starting Windows Setup using the original Setup CD.

Ok, well I searched on that and found this. It's true I did have Norton installed on the computer. But the instructions to resolve this involve basically deleting Norton, which given that I formatted the hard drive, was surely done. There's no other resolution suggested. So now what? I now get this same error even booting from the CD.

I found this, but it's quite over my head and I never used this computer for IRC and I've never updated my bios.

*So how do I not know if Windows is re-installed. It was formatting through the windows set-up so I think it intended to go into setup as soon as the drive was formatted. When I went to bed it was 98% formatted and had been for 3 hours. Windows is installed enough that I can get the safe-mode etc. menu, but I get the same error if I try to boot in safe-mode.

Is it time to just give up on having a computer?
posted by If only I had a penguin... at 5:59 AM on March 4, 2010


Oh, I can't bear it.

Your Windows installation melted down into a bubbling pool of malware and malware removal tools. You've formatted your drive, so everything on it is gone. You're going to get a new computer, which will presumably come with Windows, and when it does you'll be able to run all those Windows-centric things that Windows people like to run. In the meantime, you just want a working computer, and you're finding that the license-enforcement crap built into the Windows installer is giving you the usual grief.

You are the textbook case of a person who ought to be downloading and test-driving Ubuntu, your username hints at a yearning for penguins... and yet you still see "giving up on having a computer" as your only alternative to continuing to suffer the death of a thousand cuts from Microsoft's feebly inadequate installer?

Just do it.
posted by flabdablet at 4:26 PM on March 4, 2010


Response by poster: HA! Well good point, I hadn't thought of using linux as a temporary computer, I had just thought about it as a way to recover my files. Anyway, I will give it a shot, but recall that getting it to boot off a linux CD wasn't really working when I tried it. Hopefully it will work now on the formatted drive.
posted by If only I had a penguin... at 9:07 PM on March 4, 2010


As I recall, getting it to boot off that particular linux CD wasn't working, and as I wrote above, I think the most likely reason for that is a bad burn. Burn another one, perhaps at a lower burn speed and/or using a different brand of blank, and try again.
posted by flabdablet at 11:22 PM on March 4, 2010


Response by poster: No, there were two linux CDs, both of which would boot another computer without incident. The computer doesn't seem to like to boot off of any CD (linux, windows, etc. it's all kind of hit or miss, mostly miss).
posted by If only I had a penguin... at 7:31 AM on March 5, 2010


See if you can get the Ubuntu CD to boot, and select installation. If not, try flabdablet's suggestion and burn another copy. Ubuntu has an excellent support community.

Earlier, I was totally confused because I didn't understand you had two CD's. I apologize for that.

We haven't forgotten you.
posted by nangar at 8:20 AM on March 5, 2010


Sounds like a bad CD drive.

If you can get temporary access to another computer with a working CD drive, you could try a different installation method.
posted by flabdablet at 6:52 PM on March 6, 2010


« Older Where's George? (2007 edition)   |   Can I make this sweater at home, and if so how? Newer »
This thread is closed to new comments.