Ask MetaFilter questions tagged with windows and virus

How to "lock down" Windows on a home PC

ackptui — Thu, 16 Jul 2009 06:52:03 -0800

I've been wondering if it is possible to apply the same solution to the never-ending problem of Windows corruption (and the resulting degraded performance) that data centers use. As I understand it, Windows is booted over the network, so what happens to the local hard drive does not matter. Is there a way of doing the same thing to a home PC? Can you make a hard drive "read-only" after putting a bootable Windows image on it, and then use a seperate hard drive for data storage? I really detest the solution that MS sponsors (virus protection/firewall software) because it is just another thing that you have to buy which supports it's business partners. Any other ideas?

How can I reinstall Windows onto an old Toshiba Portege 7010CT with no external drives?

ajp — Sun, 21 Dec 2008 06:16:50 -0800

How can I reinstall Windows onto an old Toshiba Portege 7010CT with no external drives? I've inherited an old Toshiba Portege 7010CT with Windows 2000 on it. It's also chock-full of viruses. I don't have any external drives for it, and I hope I don't have to buy one. It has one USB port.

Is it even possible to reinstall Windows on the thing? I'm planning on XP, but I guess I can live with 2000 if necessary. But it's the lack of drives that's the problem. The BIOS doesn't have an option to boot from USB. I've no idea if it's possible to change that somehow...?

So, any advice much appreciated.

In case you're wondering, my plan is to use Remote Desktop from the Portege pretty much exclusively, so it can act as a reasonably lightweight and portable visual interface onto my heavier hardware. I'm hoping a wifi dongle in the USB port will achieve this.

Merry Xmas :-)

Disk Drawer Double Bind

Acheman — Fri, 14 Nov 2008 14:09:57 -0800

My friend's only Admin account on Windows has been ripped to shreds by a virus, an uninstaller program, or both; his CD drawer won't open or shut manually at all; and his BIOS settings, which are protected by a password we don't know, are to boot from a CD in the drive before anything else. Help me to not destroy his computer with an axe. I'm a Mac user who somehow became the Tech Support for our shared house. (It started with showing a friend how to use a bittorrent client and is now way beyond my control.) For various reasons, one friend's computer never got the once-over, with new antivirus software etc., that I'd been meaning to give it. I thought 'Hey, he uses Firefox and hardly ever even downloads anything. Things won't go too badly wrong for the time being'. And boy am I regretting that now.

A couple of days ago, he came to me telling me that his five-years-old antivirus software had detected virus infection, and this was corroborated by the appearance of thousands of popup windows for a poker site. The antivirus told him it had deleted four viruses, but clearly hadn't - the popups continued along with some other strange stuff. He immediately shut the computer down and came to me.

When we started up the computer, the popups appeared to calm down to a manageable level. I decided to get rid of his old antivirus and install AVG. Here's where a couple of nights' terrible insomnia led to my making a mistake: I tried to do those two things in that order. After deleting a bunch of files Revo Uninstaller suggested I delete, I couldn't open any programs from his user account - I got messages saying that it was 'not authorised' to open them. Switching to the Guest account meant I was able to do anything the Guest account can do, but this didn't include installing AVG or repairing his Admin account. The Guest account started to be beset by popups after a few minutes and we shut down.

My friend still has his Windows XP pro CDs and doesn't have any important files he can't retrieve from email attachments, or any music that isn't from his own CDs. So we were all set to do a clean reinstall, until he reminded me about the CD drive.

Since he dropped the computer about six months ago, the CD drawer won't open or shut manually - it has to be opened using his DVD-reading software. Also, his BIOS settings are set to boot from the CD drive if there's anything in it, and always have been. This has already caused problems when he left a CD in the drawer before shutting the computer down, but after attempting to boot for about five minutes it would move on to the HD and all would be well again. Trouble is, this won't work when trying to reinstall Windows from the CD - as I understand it, it can and will just boot from the Windows installation CD again and again and again.

I'd already tried to reset the BIOS settings, but they're password protected and he was never told what the password was. (He got it as part of a government entitlement for disabled students, and so it came from some little outsourced office somewhere).

This weird little logic loop is most tormenting: I can't boot from the hard drive until I've removed the disk with the DVD software, and I can't remove the disk with the DVD software until I've booted from the hard drive.

Will a USB external CD drive work to install Windows from straight out of the box? Can I get a pirate version of Windows and install it from a USB flash drive? Is there some really simple, far less radical solution to this that I'm missing? I'm in way over my head with this, and keep coming back to fantasies about the violence I might enact upon this infernal devil-box.

Installing Vista Securely

kidbritish — Mon, 15 Sep 2008 10:15:22 -0800

Those stories about Windows PCs getting infected within minutes of connecting to the internet... does that still apply in Vista SP1? Soon I'll be setting up a new PC put together from parts and doing a fresh install of Vista Ultimate with SP1 (retail). Should I do anything special to maximize security?

XP Filter: I set up a non admin account for safer computing -- Am I safe enough now?

dancestoblue — Mon, 21 Jul 2008 09:06:12 -0800

I've read so much here lately 1 2 3 about not browsing as an admin, decided to check it out and yepper, I surely was using an admin account. I've set up a non admin account, made a few other changes (described inside), hoping to find out from The Hive Mind if I am now safe enough to breathe easy(er). Ya'll put the fear of computer death into me, I finally decided to check and yeah, I was doing it wrong wrong wrong. So I set about trying to get my mind (and puter) right in the eyes of The Hive Mind.

I set up an account without Admin rights, and will use this for most everything from now on.

I left both accounts without passwords because of reading this post -- is this a good plan, or is this guy off the wall?

I am using a fairly fresh XP install (maybe two months) and I'm pretty sure I'm still clean -- I've run Spybot and AdAware, updated as needed, maybe every couple weeks.

I'm using AVG Anti-Virus Free and update it as it says it's needed.

I'm using the ZoneAlarm free firewall -- I LOVE that it allows me to determine when software decides to 'call home' and I get to decide -- Apple is pretty determined with this, I've found, and so is Open Office, a few others.

I've got Windows Auto Update turned on but not to auto download and install -- I want it to prompt me and let me decide if and when.

I'm using MS Windows Defender and upgrading as it suggests.

I'm using Firefox 3 upgraded automatically any time they suggest, and running AdBlock Plus and NoScript, updated when suggested.

If any site gives me problems in Firefox, I first try Opera (updated as needed) and then IE7, last resort. I run IE Tab through Firefox rather than firing up IE7, and I only use it on sites that demand IE7 (NetFlix, Sprint, a couple of others) -- I'm hoping this helps me but I don't actually know if it adds safety or not. I update IE7 as Windows Update suggests, pretty sure I'm always current.

I'm using Foxit PDF rather than Adope bloatware.

"Aye" suggested Disabliing all AutoRun and AutoPlay options with TweakUI (a Microsoft PowerToy) is this needed/wanted?

What have I missed? Where have I gone overboard? I want safety but don't want to live locked down so hard I cannot move.

Thanx in advance.

Peace.

dancestoblue

Best free Windows malware removers?

i_am_joe's_spleen — Wed, 09 Jul 2008 15:15:22 -0800

What free Windows malware detectors/removers should I put on a CD or USB stick? I will shortly be visiting a relative with an XP machine which I have reason to believe may be less than sanitary. I have not been maintaining Windows boxes regularly for a couple of years, so I am not up with the play, but I have a modest level of cluefulness as a hardcore Unix person and ex-XP user.

If I were to offer to clean this machine up, what I should I use to do so? I was thinking of creating a disk of utilities for the purpose before I leave.

Computers says it's infected and asks for a disc that I don't have.

Flying Saucer — Thu, 12 Jun 2008 22:51:04 -0800

I seem to have corrupted files, but don't know how to replace them. I must have gone to the wrong website, because my CA Anti Virus software just told me two files are infected.

And I got this warning:

"Files that are required for windows to run properly have been replaced by unrecognised versions.To maintain system stability,windows must restore the original versions of these files. Please insert Windows XP Disc 2."

And I don't have Disc 2. I don't have any discs. I'm not sure I ever had them. I have a Sony VAIO and everything may already have been installed. Or they may have disappeared when I moved last year.

So...what might happen to my computer when I reboot it tomorrow? And how can I get that disc? Is there some kind of download from Microsoft? Is my computer toast?

What is this mysterious process that hijacked my shortcut?

Optimus Chyme — Wed, 04 Jun 2008 10:11:20 -0800

What is this mysterious process that hijacked my shortcut? I was using Photoshop CS2 and entered the shortcut key for "Save for Web" (Alt+Shift+Ctrl+S) and instead of getting the Save for Web dialog, a very minimalist login box appeared. Intrigued, I brought up the Task manager, right-clicked on the "Login" entry in the list, and selected "Go To Process." The process turned out to be C:\WINDOWS\SYSTEM32\vidifker.exe. This is on Windows XP Pro 2002 SP2.

All web searches for vidifker turn up nothing; if this is a virus or trojan, it's probably trivial for it to generate different names for itself. But then why was it so easy to find? Is it a keylogger? Commercial monitoring software? Is anyone familiar with any of this?

Last Try Before I Shoot Old Yeller

StrikeTheViol — Tue, 27 May 2008 18:47:42 -0800

Windows XP TrojanFilter: I caught a trojan, cleaned it out, and now...100% CPU usage making my computer unusable, and I can't turn on Windows Update besides. With System Restore off, and every piece of software I've run so far telling me it's now clean, how can I fix my system without wiping my hard drive? My computer runs fine in safe mode, and I used Autoruns to delete some suspicious looking dll files. I'd use my Sony VAIO a690's restore partition, but I'm worried it won't do the trick. I don't have enough media to fully back up my computer, and I don't seem to have a Windows XP disk. With my tech wizard friends out of town, I'm stuck, and these kinds of problems aren't my forte. Any ideas before I reluctantly start from scratch?

(I've been using up to date versions of Norton Antivirus, Ad-Aware free version, Spybot S&D, and HighjackThis.)

Switching to Windows

bonaldi — Tue, 13 Nov 2007 06:49:30 -0800

Advice/recommendations for a Mac to Windows switcher please For a number of odd reasons I find myself with a Windows laptop, and at a loss. Apart from a passing acquaintance with locked-down uni PCs, I haven't used Windows since 1995, and that was only till I could get the cash for a Mac.

So, I'm looking for advice on things that are second-nature to Windows people, but that I won't know. You know the stuff, basically just the reverse of all those "I have a Mac, what now?" questions.

In particular, though, are there equivalents for:
* Quicksilver (basically just the type-to-launch-apps bit)
* Spotlight (fast full-text searching)
* Textmate (mdi text editor with highlighting, autocomplete and SVN integration)
* BibDesk (and are there any recommend LaTeX editors?)
* Devonthink
* Mail.app -- I hear good things about The Bat! Is it all that?

Finally: how big a deal is the virus thing? If I'm just sitting on cafe WiFi, not actively browsing, can web-wandering exploits pwn me? And if so, what sort of virus-cum-filter software should I be running?

Thanks in advance!

My Windows caught a cold?

MtDewd — Sun, 14 Oct 2007 10:23:49 -0800

My Windows 2000 system suddenly has many services problems. Details inside. WIN2K with SP4 at home. No antivirus program.

First thing I noticed was that I couldn't copy from Firefox when I posted a couple of days ago. (Can copy from IE)
A day or 2 later I tried to print and saw I didn't have any printers installed anymore. Went to services- Print Spooler was on auto but not started. Clicked Start and get message '...Error 1068: The dependency service or group failed to start.
I see that many automatic services are not started and get this message. Searching the net I see the RPC service is mentioned a bit. My RPC service is disabled. If I click Properties, the properties popup does not appear (although if I try to close Computer Management it says I have a Properties screen open.
Oh, and if I go to F:\WINNT nothing shows up (although the status bar says there are 123 objects there and if I arrow down it tells me how big the objects are)

I assume I picked up a virus of some kind. I ran an (old-2004) antivirus scan (Symantic) which picked up nothing.

I thought if I booted the Windows CD I could get a repair option, but it won't boot from CD anymore, either. (Still shows CD ahead of disk in boot options, though)

Is there any hope for me? Thanks in advance.

Why is my MSWord program seizing up with hot-pink static snow and how can I make it stop?

applemeat — Sun, 25 Jun 2006 06:43:45 -0800

Help! What is making my MS Word program suddenly seize up and look like scrambled pink and blue static? I've got Windows XP and Office 2003 (both clean legal installs on a recently purchased used computer) and am having a strange and annoying problem with MS Word. The program opens normally and works perfectly, until inevitably the screen siezed up with light blue and bright pink static blurryness that looks like television "snow" (and which you cannot work through--you can barely see a thing) and I have to reboot the system because the "snow" remains on monitor even if I close out of Word. Rebooting fixes everything, but the problem always returns the next time I use Word (which is everyday). Sometimes the problem kicks in within seconds of using Word, sometimes I can work for up to an hour before it is triggered. I thought it might be triggered by using the mouse or scrollbar, so on a friend's advice I checked for mouse drivers and replaced the mouse but still have the problem. Likewise I have also scanned for viruses and found nothing on my system. Any suggestions? I have looked everywhere for a patch and can't find a single mention of this problem.

How to clean stubborn hiding media file?

zaelic — Wed, 07 Jun 2006 06:54:58 -0800

How do I clean a large, stubborn, aborted media download from my PC, and how do I interpret all this strange, buggy behavior that has plagued me since I terminated the download? A week ago I tried to download a media file using Utorrent. Two thirds of the way through the computer started to hang, so I terminated the download, and checked for viruses. Spybot found Haxdoor.H and Trend Housecall found win32.alemod. I cleaned them, and deleted the Utorrent program, and went back to not having anything to do with any of this new Torrent technology ever again. I blame it all on the Cylons (hint... hint...) anyway.

Since then, my PC continues acting very buggy. (Windows 98, 4 GB hard drive, PII processor.) Problems are mainly two:
a) My C drive properties list still shows something - from the original media file download? - taking up 275 MB of my disc space from the aborted download. I can’t seem to clear it or find it. Looked through the sytem files, temp files, registry. Asked on a Torrent oriented forum. No luck.

b) Computer still acting buggy – slow, looses passwords, gets hung with “Program not reponding” messages, cannot shut down or restart using Ctrl-Alt-Delete. Does not shutdown automatically after the “Windows is Shutting Down” screen. When I boot up, a very brief screen of DOS info comes up after the first opening “Windows 98” screen, which then shows a message mentioning C:\Windows attrib sys –s-h-r Cannot find Sertgs.dll. … A google finds that Sertgs.dll is part of the Haxdoor virus that I have already cleaned.

Getting a new PC or drive is not an option for now – no spare cash. I know the PC is old, but it has survived a lot and been declared dead by Ask me several times, but it still runs. Help me save my zombie computer, please!

Help speeding up a WinXP machine?

Dr. Wu — Fri, 25 Nov 2005 13:03:30 -0800

Please help a Mac Guy diagnose and correct a problem with a Windows XP machine! So I'm at my mother's place for Thanksgiving, and EVERYthing on this machine (a Dell somethingorother running Win XP) is slow: downloads, uploads, word processing, even Solitaire. If this were a Mac, I could maybe figure it out, but I don't know anything about Windows XP.

I've tried the built-in diagnostics, like Defragmenter and Disk Cleanup - they did nothing. I searched online (very slooooowly) for discussion forums with similar queries, and downloaded both Spybot and Ad-Aware, neither of which have done much of anything. (I was convinced it was going to be a spyware problem, but Spybot found no problems.)

One thing I do know is that this machine has on it McAfee VirusScan, v.7.03.6000, and the last update of virus definitions was about a year and a half ago(!!). I realize I can download these definitions from McAfee, but I'd have to pay. Which is fine, and I'll do that if I have to. But, before I do, my questions are:

- What are some tactics/programs (prefrably free downloads, or something built-in to XP) I can use to speed this thing up?
- Is this likely a virus issue? If it is, is downloading the long-overdue updates from McAfee the way to go? Or should I get the newest version of Norton and start from scratch? Are there other virus-removal programs that do not require expensive downloads?

I realize I may not be giving all the information necessary to fix the problem, but I'll monitor this question and answer any follow-ups. Again, I may need a little help, because XP is fairly foreign to me.

Thanks in advance!

How rid this poor grammer message?

Idiot Mittens — Sat, 01 Oct 2005 11:29:11 -0800

The following message keeps popping up in Windows concerning a virus on my computer. Is it coming from my computer or the Internet? If it's a fake (and it may be since I noticed that it's gramatically incorrect) how do I get rid of it? (message inside) Warning!

We detected a dangerous Virus installed on your computer but was unable to remove it. This Virus allow companies/users to monitor your Internet browsing patterns. It is recommeded that you install the latest software to remove these by going to: www.fixscan.com

Preserving Windows 2000

rolypolyman — Fri, 17 Jun 2005 10:37:38 -0800

After fruitlessly trying to remove a port scan virus buried deep within the system services (even AVG couldn't detect it), I am starting a fresh W2K installation. What software packages can do rollbacks on the registry and /winnt, and cancel all the damage from any particular software install session? Sometimes the registry and /winnt seem like a wide-open mouth where junk is dumped endlessly, and preventing this would be an effective way of keeping the computer clean.

Shutting Down...

terrier319 — Fri, 11 Feb 2005 08:40:58 -0800

Since installing XP professional in November, I have experienced a spontaneous shutdown and restart of my desktop. When it returns, it tells me the system has recovered from a fatal error that is caused by an unspecified device driver. I have uninstalled both software and hardware one by one over the last several weeks in hopes of identifying the problem. Nothing. Even system restore does not solve it. Is is time to reinstall XP, even with the risk that it will likely happen again?

How do I remove this computer virus?

Servo5678 — Mon, 24 Jan 2005 09:16:27 -0800

My mother's computer has picked up a persistant trojan virus. She's over 1,000 miles away so I can't work on her PC myself, so I've been talking her through things on the phone. AVG Free 7.0 detects the virus and claims to remove it, but it always comes back the next time she scans. The only thing she can tell me about the virus is that AVG removes a file with a mixture of English and Cyrillic letters in it. Any idea how I can help her slay this thing once and for all?

What's producing these exe files in my temp folder?

ajbattrick — Tue, 04 Jan 2005 06:29:12 -0800

On WinXP, every minute, I get a new file in my temp directory, and it appears to be a downloaded webpage. I'm sure I have a virus or summat, but I can't see where. MI. I've run adaware and AntiVir, but nothing is found. There are no scheduled tasks and I am no novice user.

The files are being created in
C:\Documents and Settings\User\Local Settings\Temp

There is a new one each minute. Filenames are randomly created, such as ddgdjjgi.exe and jqdobkpk.exe. The files are Hex when I view them in Textpad, but the program also shows the ASCII version (?) of the Hex code, which is virtually identical to the source from http://www.flexiblesolutions.ws, or at least the first 2 to 6 kb of it.

It's really wierd. I've been through all the running processes, and all seem to be valid.

How do I tell what program inserted a registry entry?

twine42 — Sun, 18 Jul 2004 07:05:52 -0800

PCFilter : Is there any way to tell what program inserted something into the registry?
I've been attacked by four seperate virii that sophos claims don't exist in the wild. One of them (netclnc.exe) keeps reappearing in my registry and the system32, and I want to know what's putting it there so I can kill it. Ideas?

Windows XP questions

Termite — Mon, 07 Jun 2004 23:43:07 -0800

Windows XP firewall + Zone Alarm = problem?
I've just upgraded to Windows XP and I have three questions (so far...). 1. After installing the Zone Alarm firewall I can't get online. Is this because of a conflict between the Windows firewall and ZA? How good is the Windows firewall – maybe I don't need ZA anymore? Should I disable the Windows firewall instead?

2. On top of the file tree in Windows Explorer is the "My documents" folder on my C drive. I've got all my documents stored in a "My documents" folder on my D drive (the D drive is bigger). I want to get the D drive folder on top of the file tree instead or, if this isn't possible, to delete the "My documents" folder from the file tree and start with the D drive expanded.

3. Any chance of getting the pie charts back in the "My computer" folder somehow? To view the used/free space on all hard drives at a glance was mighty handy, says me.

They keep making Windows uglier for every version...

What are the best spyware killers? Will antivirus programs start checking for spyware? Where in the registry do spyware processes launch?

theora55 — Thu, 03 Jun 2004 06:26:41 -0800

Multipart question: Scumware, spyware, adware, it's all malware, I say. Currently using both Spybot and Adaware to catch and kill most of this crap.
1. Looking for feedback on the best spyware killers for home and work.
2. Are Norton and Macafee working on adding spware killers to their anti-virus packages?
3. Some of this stuff launches using svchost.exe. Where in the registry, besides
HKLM\Software\Microsoft\Windows\CurrentVersion\Run and its relatives, do services launch?
[Inside, there is more] FYI, HKLM\Software\Microsoft\Windows\CurrentVersion\Run and
HKCU\Software\Microsoft\Windows\CurrentVersion\Run are obvious places to find some of the junkware that loads at boot. Quicktime is dandy, but I don’t need it in the System Tray.

I’ve had this crap install itself just from browsing the web (memo to self: don’t let teenage males use my pc), alter my hosts file, take over my start page, and annoy me half to death. It’s a growing problem at work, too. I want my processing power back. Thanks.

I can't get Mozilla to work since I dewormed my computer

wendell — Thu, 13 May 2004 16:18:36 -0800

Since I de-sasser-wormed my Compaq machine and updated WinXPHome, I haven't been able to get Mozilla to work; re-installed it twice, re-downloaded 1.6 once, I get nothin' but little warning boxes saying "script error", that, after I un-installed Mo, now pop up when I start IE. Wendell sad. Wendell dumb.

I have a virus. Can you help?

banished — Wed, 28 Apr 2004 23:22:48 -0800

Virus Question: I have something nasty. It closes any type of anti-virus application I install, closes regedit if I try to get in there, prevents access to anti-virus websites, and yes, there's [more inside]. A friend suggested I use an online anti-virus program, but unfortunately the virus blocked my access to antivirus.com. I eventually got McAfee 8.0 to install in safemode, but I can't liveupdate any of the anti-viral software I install because the virus is blocking access to those sites. Luckily, I got into McAfee's help site, and they had a way to download a file to update 8.0 manually. Unfortunately, that download didn't work because of this virus blocking their site. I searched google and found the file on some foreign site, so I was saved... McAfee found several versions of the Gaobot virus. This still hasn't cleaned everything, because I ran the Panda online virus scanner I found online, and that found 7 more things. Now, after a brief period of being able to access anti-viral sites like the Panda online scanner, it seems I can't access them anymore, and the virus has taken over again.

Symptoms include 3 DOS windows that pop up in succession and disappear too fast to read them, closing of antiviral software and regedit within a few seconds of opening them (or not allowing their liveupdates to work), not allowing access to anti-viral internet sites, and slowing my computer down so it runs terribly. If someone knows what I have, please let me know. I've never run into anything this good. They got me on this one.

What's msiwin84.exe, and how can I get rid of it?

PrinceValium — Tue, 27 Apr 2004 15:20:22 -0800

What the hell is msiwin84.exe? Somehow this has been installed on my computer in c:\windows\system. Zonealarm warned me that it was trying to access the internet and act as a server. And then about 300 identically sized exe files (136 KB each) with random filenames showed up in c:\. Symantec virus scan didn't pick anything up, and google comes up empty for variations of the filename. I deleted questionable files with today's date stamp, and rebooted - am I okay now?