Printable View
Fresh bait guys...
So I got that P2P virus, the one that infects cmd.exe. Apparently it likes to install lots of porn zip files on my computer whenever I use kazaa (which btw, sux and I never want to see it again). It's replicated to 2500 files, and if I dont keep on it, it will replicate more.
Here's a chance all you worm-attacking fiends...get at me. I really want this to et the hell off my system.
Okay, do you have an updated AntiVirus program installed? If not then I recommend AVG which is a free antivirus porgram that on a regualr basis scores just as high as the paid options on reviews.
You can acquire it here
Do you know the nameof the virus?
And I didn't even know kazaa was still around......
Ryan
btw......uh huh.......thats where all those porn zips came from.........
I have used that one myself....
btw! Hello Sara!
And the irony of the statement of that *one* P2P virus.....
Wow, look at all of those " ......"
Call me Nihil Jr!
Actually I do have virus protection...McAfee 9.1 and Spyware Doctor both which fail to recognize this virus.
However, I will definitley take all the help I can get
So what was the name of the virus and probably your going to have to reboot into Safe Mode and run the AV from there.
Safe Mode is basically windows running in essential only mode.
Okay, so I did a search here and came up with a few threads you can read as well as any help I can do for you.
http://www.antionline.com/showthread...removing+virus
This thread is a basic "tune-up" of your pc.
xierox wrote a great security tut which you can find here
and finally this one here is great
http://www.antionline.com/showthread...removing+virus
Use of the search function on this site can usually solve most problems but any help that I or anyone else can offer you pleas ask.
Ryan
Thanks for your help ryan... I tried AVG, it wouldnt install
I cant really figure out the name but I know it infected files in this dir
C:\WINDOWS\SoftwareDistibution\download
Is this even Windows folder?
Also what do you mean by 'run the AV'?
Okay, so do this for me. Reboot your computer into safe mode.
You accomplish this by restarting and pressing f8 repeatively as soon as you see bios start up. Then, once booted, try running your AV program then.
Once you do that see if you still have a problem.
Btw, that is a windows dir. It is used during upgrading SPs I believe.
Ryan
AV is referring to Anti-Virus. So just scan using (Nortons was it?)
Also, if you want to speed this process up you can reach me on AIM @ Gadg3tt as my sn.
Not to take away from the boards you see but this is a very slow method of communication. I sent you a pm but your probably don't know how they work.
Dear Steven and Sarah,
hjack is a creature of low intellect that is attempting to help you...........naturally, I shall terminate it with extreme prejudice, should it fail in its pathetic attempt?
Please do listen to him though, because he does know his stuff :D
Johnno
I too had to deal with P2P. I can't remember which program i have got rid of it in safe mode because when i cleaned my system i had so many problems i just ran a lot of programs to clean it all. I can tell you if you use ewidow, a-squared, ad-aware, and spyboy s&d one of them is bound to kill it for you since those are what i used to get rid of that and more.
If you have a decent internet connection you might want to try an on-line virus scanner. Symantec does this and I believe McAfee does but I don't remember.
Go to Symantec AV center
Click on the Symantec Security Check at the lower middle of the page.
A pop up window will ask you to be sure you really want to do this. There is a Go button on the screen in yellow you will need to hit.
After hitting go another pop up will ask you if you want to do a security scan or virus detection.
Just click on virus detection and let it run from there.
***Warning***
this process is very slow.
Hopefully this will help.
Falcis
Hi
First you might want to run a couple of online scans which may help get rid of the trojans/worms you ended up getting thanks to Kazaa.
Panda
Trend Micro Housecall
Kazaa Removal instructions
Like everyone else has mentioned, run your scans in "Safe Mode" and make sure you have all of the definitions for your AV as well as your OS (Windows security patches).
Good idea to get Spywareblaster/Spywareguard
http://www.javacoolsoftware.com/spywareblaster.html
Good advice from everyone,
Remember to only have 1 antivirus on your machine at any time.
So if you're going to put on AVG remember to uninstall McAfee first.
I've seen Kazaa screw a lot of machines beyond reasonable repair (requiring a reformat) so if you have important info on your machine back it up before you go too far. And scan your backups if you think you have a virus.
I don't know if kazaa itself is really to blame. Actually any file-sharing program
comes with some risks. I got a "p2p" virus once when I wasn't even using p2p.
The virus attempted to spread by putting infected files in every folder
that included the word "share" or "shared" in its name, on the assumption that
those folders might be shared via p2p.
The real danger is when you download and run a lot of software from p2p.
Unfortunately, some people like to share evil stuff.
One of the things you can do if you are curious, is check the names of any
newly arrived files that look suspicious. New arrivals in the windows folder
with [b].EXE or .DLL extensions would excite my curiousity. Enter their
names into a Google search, and you'll learn a lot about them.
The standard procedure is, as others have said, to run an antivirus scan.
Hopefully, you already had the antivirus program installed and up to date.
Some antivirus software won't install on an infected system, and for good reasons.
When all else fails, you live and learn. Format the hard drive and reinstall windows
Again I want to emphasize, it's not file sharing that's the problem so much
as running questionable software, like pirated versions of popular, and expensive
programs.
:cool:
Hey Aspman,
You mentioned not running two AV programs on the same machine. While I understand that it would eat up your resources for no good reason is there any other reason that this would be bad? I just have not heard anything about this before.
Falcis
Sometimes some AVs (at least historically) will fight each other. Not really a good thing.Quote:
While I understand that it would eat up your resources for no good reason is there any other reason that this would be bad?
From what I hear at other forums, if you must or like to use two AV's, at least disable one of their Active Scans,(real time monitoring) as these will conflict with each other, depending on their definitions.
A good idea is to keep the AV with the better active detection (real time monitoring) options running and use the other for manual scans.
They will hog resources in active mode. ;)
one of the things Kazaa liked to drop is ALTNET and Dashboard two very hard registry entries to get rid of.Quote:
I don't know if kazaa itself is really to blame
Quote:
Altnet Description
Altnet may launch targeted advertisements, and may track your web browsing habits and report your personal information to a central ad server. This adware is usually co-installed on computers through file-sharing programs.
Altnet Removal Instructions
Before you delete it, it must have it permission changed:
Open the registry (Start->Run->regedit) and select the keys
[HKEY_LOCAL_MACHINE\\Software\\Altnet]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Altnet\\Dashboard]
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Management\\ARPCache\\AltnetDM]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
\"C:\WINDOWS\Temp\Altnet\msvcirt.dll\"=dword:00000001
[HKEY_USERS\S-1-5-21-14627781-1401277002-153983898-1006\Software\Microsoft\\Search Assistant\ACMru\5603]
\"000\"=\"altnet\"
[HKEY_USERS\S-1-5-21-14627781-1401277002-153983898-1006\Software\Microsoft\Windows\CurrentVersion\\Explorer\MenuOrder\\Start Menu2\Programs\Altnet]
Start with the top folder which is Altnet and work down and follow these instruction to change the permission for all folders.
Right click on Altnet then click on permission, click on add, click on advanced, click on find now, and look for your log on name and click on okay twice to get back to permissions for Altnet. Now, put a check mark in the boxes for allow after click on advanced, click on the tab for owner and highligt your log under \'change owner to\' and check the box that say\'s : \'Replace permission entries on all child objects with entries shown here that apply to child objects\\' and click on ok, click on apply and click ok. Continue the same for the rest of the folders listed.
After the changing the permission, end the ?Altnet? process from the Task Manager (ctrl-alt-delete). Having successfully done this you should be able to delete the entire ?Altnet? folder.