Who hasn't seen this once?

[brokencrow]

The most infected files I've ever seen was one of our sales reps desktops
he brought in from his home office: 1900+ infected files. Lots of Cool Web
Search files. Those things must breed like rabbits...

Chit, I wanted to throw the guy to lions in Personnel, but my co-workers
talked me out of it.

[Moira]

A complete reformat seems in order with a computer infected as badly as that. Especially if it's picked up CWS.

[ech0]

10,000. Some doods botnet just got taken out with one virus scan. Haha
My personal best was with Ewido before avg bought them out 150,000.
I love when the machines so riddled with crap the IE wont even open or the desktop doesn't show. Thank god for safe mode

[Moira]

Thank God for a different browser too .... I've had to sort machines that have basically wrecked Internet Explorer and it's only because Firefox has been installed that I've been able to avoid a complete reformat.

[nihil]

Hmmm,

The most I encountered was just over 1700. The Laptop had "stopped working" I was told.

It was something like a PI/120 with 128Mb of RAM. Win 98 and 56.6 dial up.

It was used by a small hotel for bookings and correspondence and was probably on the net for short periods about 4 times a week.

The problems were:

1. No firewall
2. No AV
3. Outlook Express with preview turned "on"

What had happened (apart from the malware) was that they had received a spam e-mail with a corrupted header and this was freezing OE.

It seems that back then a fair bit of spam also carried adware and spyware. Being a hotel, they were on several trade listings so they got a fair amount of spam.

Once I got rid of the rubbish and turned off OE preview, all I had to do was show them how to open OE and delete the spam before it opened. A firewall and AV rounded things off.

I am not entirely sure that a lot of malware will neccessarily kill the PC. I think that a fair bit of it checks to see if it is running and will only allow one instance, even though there might be several hundred files involved.

I have also seen stuff hiding in places like the Java cache, that presumably require you to run Java to activate?

[Moira]

I don't think malware will kill a PC because you can always reformat. However, I've seen machines so infected with Cool Web Search that the internet was more or less useless - IE just kept going to malware sites and refused to access anything that might have been useful in cleaning it up.

[ech0]

My other fave is when theres something in the background and FireFox is the default web browser. Little FireFox popups over and over again. The customer is always 'you said it would help with popups'......*sigh*

[Moira]

Yeah, some people are just dumb

[nickstanovic]

Thank God for a different browser too .... I've had to sort machines that have basically wrecked Internet Explorer and it's only because Firefox has been installed that I've been able to avoid a complete reformat.

If they didn't have Firefox in this situation, Windows Explorer could also be used to browse and download that browser. When our customers get IE completely hosed, we instruct them to use WE as the emergency backup; WE works the same but ignores all the hijacking/spyware attached to IE.

EDIT: If the hijacking changed the DNS then WE will not make a difference so it's not fool-proof but then again other browsers will also be affected - rambling sorry. Nick =0)

[ShagDevil]

Hmm...worst case scenario for me was the Nimda virus. It infected somewhere around 3,000+ files (if memory serves me right).