$#@%! (Universally Serious Bullsh*t)

[YukesVonFaust]

Did you try to backup all of your Data?
maybe a restore point?

[Jeimuzu73]

Did you try to backup all of your Data?
maybe a restore point?

Restoring doesn't work, the attrib command doesn't work, and AVG can't kill the trojan. I have to painfully backup as much data as I can and even the data recovery programs don't work.

[edward850]

You'll probably find the trojan isn't actually running. It's just an application there that you've had sitting dormant.

[zZaRDoZz]

Did you try to backup all of your Data?
maybe a restore point?

Restoring doesn't work, the attrib command doesn't work, and AVG can't kill the trojan. I have to painfully backup as much data as I can and even the data recovery programs don't work.

If money's not an issue, there are companies that specialize in data recovery from damaged drives. If it isn't solid state and you're at the end of your rope, there's always the freezer trick.

Anyone know if the freezer trick is still useful?
It's really an old school hack.

[ibm5155]

Please, use a trial version of Kaspersky complete or bitdeffender total security, AVG is more like a virus magnet than an antivírus itself '-' .
I just gave up from avg long time ago, even in some friends computers where avg was installed, it claimed the system was clean, but ofc it wasn't, it was actually funny, because there was a trojan that blocks to access anything even installing a well known antivírus, but it allowed to install avg xD (at the end, I just gave up from that computer, I eliminated like 10.000 vírus/trojans/malwares, + a fake antivírus that was actually a vírus [not avg in the case ])

[Hellsmith1]

You could try downloading Norton 360 just go to there website and do a 30-day free trial cause I have norton 360 on my system and it's excellent and it can even remove any trojans from your computer its the best top of the line protection. Kaspersky antivirus is your secondary protection.
My advice download Norton 360 and Kaspersky for the best protection.
If you try to save any files from your computer don't do it because your also saving the trojan virus as well too sorry to be saying that but it's true.

I'm just curious about something when's the last time you updated your system or did a background check? That could be the solution I don't know and it depends on how old your system is too.

[grouchbag]

Don't feel bad.Today I thought I had a virus in my laptop b/c the way the mouse arrow was jiggling funny.I use a wireless folding mouse.Sooo, I set it back to factory condition, not saving any files.(Have backups anyway) I was surprised when the mouse arrow did it again.Shit.Then it finally dawned on me to change the batteries in the mouse.Worked like a charm.Do I need to say how dumb I felt? Well anyway, sorry for being off topic.Hope you guys get a good laugh.I did.

[edward850]

Please, use a trial version of Kaspersky complete or bitdeffender total security, AVG is more like a virus magnet than an antivírus itself '-' .

This is bad advice. And yet...

You could try downloading Norton 360

This is actually worse advice.

[Graf Zahl]

Why the antivirus advice? This sounds more like physically broken hardware.
So my advice would be, to copy as much data off it as you can, and then throw that thing away.

DON'T EVEN THINK about reformatting and using it again. You may actually lose some more stuff then.

[ShadowTiger]

I work in a data recovery and computer repair center. There are others that know more than I do, but I've seen quite a few hard drives fail, especially when they already contain bad sectors. Do not reuse bad hard drives. It's like someone poking a hole into a vinyl record with a thumb tack, and then that hole expanding and expanding... who knows what data might have been under the vicious pinpoint precision of that hole. I watched a single bad sector that had downed a Win7 installation turn into over two thousand bad sectors over a weekend of scans.


Backing up onto an external hard drive may be useful. Or you can pick up a few of those USB sticks from Microcenter, Best Buy, or Staples. Staples has plenty of sales on them fairly often. I know 32 GB for $12 won't hold much, but it's a good start. They're also really, REALLY useful to use as bootable Linux LiveCDs to help diagnose a problem or bypass Windows to get files off of it in case of a Windows problem. You can still store files on it in a subfolder. Use "Rufus" to burn the ISO to the USB. Great little program.

Otherwise, if there are mechanical problems with the drive, it'll likely have to go into a clean room. The one connected to our company charges $200 just to look at it, and can run between (an extra) $200 to $800 depending on what they have to do to it. If it's just a mechanical failure though, you're probably in pretty good standing. If something dropped and the reader head scraped against the platters, then it gets quite a bit harder to recover data.

I did, however, happen across a video on how to recover data from a hard drive that can't be recognized. Can't for the life of me recall the name of it, but it exists, which is at least a good start. Looking around on Youtube isn't a bad idea.

-------------------

Additionally, and I'll place this in a spoiler tag because it's not as relevant as one may imagine, here's a little copy and paste of a "How to clean malware" guide that's been floating around. Feel free to interject where appropriate.

---

Proper malware treatment procedures.

First, let's get ourselves some proper tools. It's all free on the internet. Make a new folder for these. It's all going onto a USB flash drive.

www.bleepingcomputer.com -> Downloads section. Download the following items. You can use the search bar to find them all. If it gives you a chance to download a 32bit and a 64bit version, get them both, and put whichever it is into the filename as you download it. Some windows operating systems only take one or the other, so if there's a choice, have them both! Otherwise you won't know until it's too late and you don't have the version that you need.

Remember, these programs should be kept up to date! It's easy to acquire a new virus or piece of malware because windows or any other programs you're using haven't likely been patched for it yet. So don't let these get even four weeks old.

RKill -- Use this to stop any malicious processes that are running. It helps to give you a bit of breathing room. Run this before using any other programs, and if your PC restarts while you believe you're infected, this should be the first thing that you run.

AdwCleaner
RogueKiller
ComboFix
JRT (Junkware Removal Tool)
- These four programs will help with the malware removal process. They are roughly in order of efficacy. I always run AdwCleaner first.

TDSSKiller
Malwarebytes Anti-Rootkit -- These two are effective rootkit-removal programs. A rootkit is a piece of malware that hides so deep within the operating system that it's nearly impossible to find it. It restores any malicious processes that are running even after you think you've gotten them all.

Avast Free Antivirus - Really good to have. No catch. You can turn off pop-ups from it by going into Settings -> "Silent Mode." Only have one antivirus on your PC at a time. Get rid of Norton or McAfee. Keep this one up to date, and you'll be good. Do full scans once a month.

SUPERAntiSpyware
MalwareBytes Anti-Malware - Two anti-malware / spyware programs. Not the same thing as viruses. These can be run at the same time without a problem.

While you're at it, take a look around the Downloads section of BleepingComputer and take anything else that you think looks good. Read their descriptions, and when you save them, add a little blurb in the filename about what they do. You never know if you'll need one.

---------------------------
--- Let's get started ---
---------------------------

So we should have a minimum of 10 programs on this USB flash disc. If you can get these programs onto a PC from the same PC that has malware on it, kudos to you. It could even be attaching the malware to the files as they download, or just preventing you from access the internet.

Put all of these programs into a folder. The folder is more portable than loose files because you can drag 'n drop a single folder and keep track of it, which we're about to do in a bit.

When you insert the new flash disc into the infected computer, hold Shift (Either of them) so nothing automatically plays or executes. Then copy and paste the folder from the USB Flash disc onto the desktop.

Now here's another important step. Some malware attempts to interfere with your efforts when you start running programs. So go into the folder, highlight everything in it, do a Ctrl-C to copy it all, and then do a Ctrl-V to paste it again into the same folder. This makes a duplicate copy of every file. If one file gets erased while you're about to run it, you'll have a spare that you can copy right back in its place.

------------------------------
--- Malware Removal ---
------------------------------

First a word of warning: There are parts of the Windows Operating System that will ask you if you really want to run a file when you open it. Allow these. User Account Control can be annoying at times, but you can turn that off. Don't do it while you're working with these, though. Also, with some of these programs, if it tells you that the program is out of date and you can't access the internet to update it automatically, and you select no, it may delete the program on its own. That's why you have a spare copy from earlier.

At this point, use RKill to stop any processes. It may take a few minutes. Take a note at what it does. Sometimes it disables (Or re-enables) Windows Firewall. It may stop a few suspicious processes that are running. It may even remove a proxy server, which essentially redirects internet traffic away from where you want it, both incoming and outgoing. RogueKiller does a great job of that as well. It dumps a log file RKill.txt onto the desktop.

Once RKill has finished, run AdwCleaner. Fantastic little program. It'll find a lot of things. It may take between 3 and 10 minutes. Very efficient! When it's finished with its scan, take a look at each tab and see what you find. If you recognize most of these programs, you know what not to download in the future. Ask.com is usually on there. Some AOL related things are as well. I'm not surprised. You can trust it completely. There are a lot of deceptively innocent programs that introduce unintended consequences to your computing environment. Note that AdwCleaner requires a reboot of the computer. Don't forget to run RKill again when it reaches the desktop! It dumps a log file into the root C:\ Drive. C:\AdwCleaner, usually.

Then run JRT. It'll catch a bunch of stragglers, thinning the herd. At one point early on it'll look for an update and then ask you to hit enter to proceed. There is absolutely no reason why we would not hit enter at this point. Please do so. The scan should take between 10 and 30 minutes. It dumps a JRT.txt log file onto the desktop.

Then check out RogueKiller. There are a bunch of steps involved; none difficult. It'll first try to update. Then it'll do an intial set-up of itself, loading itself into memory where necessary. This can take a few minutes. Then at one point you'll be asked to start the scan, whose button is in the upper-right corner. Then you'll wait ten minutes or so while it scans. Then check out the tabs for what's available. USUALLY, not everything here will be malicious. It highlights many things in green which are generally okay to stay.

I'll designate an entire paragraph to the following reminder: DO NOT delete anything that is in green. Leave them be. Occasionally these are useful to the computer, and their deletion may render certain parts of the computer inoperable.

Anyway, anything in yellow can go. Check the box to the left of anything in yellow, and when everything yellow in every tab has a check next to it, click the "Delete" button in the upper-right corner. Wait a minute or so. Sometimes it takes a while to really get it all. Be sure it's not doing anything before you close the program. I don't believe it automatically creates a log file, but I think you can make one via a button on the right. Sometimes a reboot of the PC helps. Don't forget RKill!

One of the tabs in RogueKiller is the Hosts tab. It'll have a button "Fix Hosts File." If there is a proxy installed onto the machine, that will help get rid of it and restore natural functionality, though it's often only one step. If you can access the internet just fine after all is said and done and all of these programs have been run, you probably don't need this.

Next up is ComboFix. It will attempt to update itself. If you have an antivirus running in the background, (Lot of good it did, right?) disable it and just exit out of that antivirus entirely. It'll give you quite a loud and unfamiliar beep if it finds out. Just a word of warning. Also note, this is one of those programs that you NEED to have a copy of in case it can't update and it deletes itself. The program likely takes the longest. It may take up to an hour or more. It'll leave a log in C:\ComboFix.

Also, either ComboFix or AdwCleaner may also leave a folder C:\Qoobox or some-such folder as part of its naming scheme. Just letting you know so you don't think it's anything suspicious.
It's a good idea to look at the log files so you can see what files have been deleted.


--------------------------
--- The next steps ---
--------------------------

Okay, let's install SUPERAntiSpyware and MalwareBytes! Remember that malware and spyware are two different things, but spyware includes the infamous Trojan type of malware, which acts as a bypass conduit onto the computer to bring malicious stuff in, even through any antivirus shields you may have. That's a great way to get infected.

When you run the installer, be sure to read every page. You can decline any trials or other offers they have. When you have them installed, be sure to look for a way to update the definitions. It allows it to scan for even more modern and recent bits of adware. Really important to update it. Both programs are similar and do similar things, but have different layouts and catch slightly different things that the other one doesn't. You can run a complete scan using both programs simultaneously. The duration of the scan depends on the size of your Hard Drive and how filled it is.

Next, let's talk about Anti-Virus programs. You should only have a single Anti-Virus program on your PC at any time because of how it scans. It's comparing files on your Hard Drive with a file that it has filled with a select line from most common viruses. If the scanner happens to come across that definitions file from another anti-virus, it'll send off more alarms than you've ever seen in your life, and will do its best to "erase the threat." It's like the police looking for criminals and finding a prison, and sending in the police because of all the criminals it finds in there. You get the idea.

So, uninstall any other Anti-virus programs that you have (Hit Start, then type "appwiz.cpl" without the quotation marks and find them in the list and uninstall them.) and then let's install Avast Free Antivirus! This thing is amazing.

It'll ask you to register. It's really easy. It won't even ask you to check your E-mail account for anything, so just give it whatever information you'd like. I make up an address every time. Couldn't hurt to use real information though.

Then do an update if possible, and do a full scan. By the time this finishes, if you've done everything in this guide so far, you should be all clean, or at least close enough to it for full functionality. There are more complex things you can do, but this is quite basic.



-------------------------------------------
--- Unable to acces the internet? ---
-------------------------------------------

If at any point you feel like you're clean, but you still can't access the internet, take note. This does happen sometimes. It's not an impossible fix. It's basically residual disabilities proxies. We just have to go into the internet browser settings, into the LAN area, and remove any manual proxy that has been established.

On Firefox:
Tools -> Options -> "Advanced" Tab -> "Network" Tab.
Choose the top button, "Connection, Configure how Firefox connects to the internet," and see if it's using anything other than the Auto-Detect setting or the Use System Proxy Settings."

On Internet Explorer: (Which nobody should be using anyway.)
Press Alt-T then the 'up' button for "Internet Options" then go to the "Connections" tab up on top.
The "Lan Settings" button near the bottom.
Make sure only the top button "Automatically detect settings" is checked, and make sure the bottom "Proxy server" button is not, and there's nothing in there except Port 80. It's more of a default setting, not that it matters at this point.
O

In Chrome:
(It says "Unable to connect to the proxy server)
In the upper right corner, there's that triple-horizontal bar menu thing. Click it, then go to Settings.
Scroll all the way down and click the "Show advanced settings" link. It's not a button. It's just blue words.
Somewhere down below there's a "Network" category with a button that says "Change Proxy Settings." Click that button. From there, it's exactly the same as in Internet Explorer. Chrome is built on IE's architecture, after all. I prefer Firefox. :-/

Here's a video detailing it for Chrome: [ https://www.youtube.com/watch?v=UmapUgg12UU ] Be sure to watch the full video. It has a lot of useful tidbits in it.

------------------------------
--- For safe browsing ---
------------------------------

To secure your browsing experience in the future:
You need to get the "AdBlock Plus" AddOn. It's a fantastic little thing that blocks pop-ups and other annoyances. There's a version of it for both Firefox and Chrome. Google for it.

-- One reason why people get infected by something without even doing anything at all that is troublesome is due to the cycling of ads on a page. Even on completely trusted websites like amazon or yahoo, the ads that appear on the sides of the page are cycling ads. Anyone can put an ad in there. It's virtually randomized. If some jerk injects a malicious script into one of those ads, and it's displayed on one of those cycling displays, then you're infected. Simple as that. That's why AdBlock Plus is so useful. I haven't seen an ad in a long time.

---- There's another AddOn called "NoScript" which is like AdBlock Plus, but a lot more interactive and selective. It allows you to choose which scripts run, blocking all of them by default. If you choose to download it, you have to be able to tell what scriptnames power the website you're on, and enable them one by one until you get the functionality that you need out of the website. It's tedious and annoying, but it really does help a lot. So this AddOn is optional unless you're willing to go the extra mile. It's like wearing platemail armor all day. Super-heavy and annoying, but it's decently big protection, unless you just enable every script to run. Again, very interactive, selective, and troublesome. Totally optional. Honestly, unless you really know what you're doing, don't bother with this one.

Another superb AddOn is the Web Of Trust, "WOT" AddOn. It places a green circle next to links that are safe, an orange circle next to links it doesn't recognize, (not that many of them) and a red one next to links you must never visit. It makes browsing the internet plain as day. It's a must-have for anyone.

Also be -very- wary of even viewing E-mails from sources that you don't recognize. If one of your friends sends you an E-mail that looks even remotely weird, CALL THEM and make sure they actually sent you that E-mail. It's so incredibly easy for someone to do a bounce-back spoof of an E-mail. I have very tech-savvy friends whose E-mail accounts are sending me spam daily. There's nothing they can do about it either because it's not even their computers or actual accounts that are doing it. It's just made to look like it.

Never use download.com or cnet.com, or softtronic or softpedia for your downloads. If there's a program that looks good, and got good reviews from a google search, (Yes, always google everything before you download it.) YOU MUST GET this file from the author's website!!! This is extremely important. Many sites like download.com actually package the item with other installers that can even be trojans. Additionally, many legitimate downloads come bundled with an offer. Be sure to read every page when installing a program. Seriously. Read EVERYTHING. Many of those bundles are checked by default, and you have to uncheck it manually to have it not install adware.