H-E-L- P !!!

[Russethouse]

Can any one help please ? - This morning two boxes which looked like they were from AVG popped up saying my PC was under threat and did I want to quarantine 2 files  - since then I cannot access many of my programs, Picassa (but I can get into Irfanview) AVG, so I can't scan,  Dropbox from my desktop, but I can access it in a different format from the web)I can open existing Word and Excel files etc but cannot open the programs to make new files -  I can't access IE via my desktop icon or the tray bottom left.......I can't even use System restore in addition several things are missing from my system tray (?) bottom right...

 

 If I click on IE for instance, a box pops up saying which program do you want to use to open this file - but even clicking on the matching program only brings up a 'Run' or 'Save' option, but that doesn't work either - other things that wont open come up with a Win 32dl message !!!

 

 Any thoughts - yes I know I've been an idiot to click on the AVG warnings which can't have been genuine but apart from that ????

 

TIA

[Théière]

You need a program to remove the threats, don't log into any important bank sites as the bug could contain Trojans or key loggers.

Stopzilla is very good used it successfully when O/H opened something similar (not free)

Also Spybot which is free so may be worth a try

[tel]

Sorry Kay but it appears you have downloaded a Trojan which uses bogus Anti-Virus warnings.  In the past two week I have had to clean 4 friends computers with the same problem.  It will disable your Anti-Virus programme, Regedit, system restore and any other methods that would normally use to remove it.  So far I have had some success downloading MalwareBytes using another computer, putting it onto a USB flash drive then installing it on the infected PC and running a scan.  Unfortunately the process can by long and involved identifying and removing all traces and you need to be savvy with the process.  Have you tried starting your computer in 'Safe Mode' and running System Restore?, this may work.

[Russethouse]

 I'll try tomorrow - too tired now - by Safe mode do you mean clicking on a key when the screen first comes up, white type on a black screen ? I've done it before but not for a long time......

[pachapapa]

Click on Start.

In menu click on Run.

Enter MRT in box.

Click OK.

In pop up window select option for quick scan.

[Russethouse]

It says 'choose the program you want to open this file' where is the head banging icon !

[NormanH]

I hesitate to offer advice as others are far more competent, but have you tried an online scan such as

http://www.kaspersky.com/virusscanner   ?

[Théière]

Whilst that is good advice Norman, it won't actually get RH any further as it needs to be followed up by purchasing of the full product and Stopzilla is more competent at those type of problem removals I have found, The result is more "stuff on your hard drive nagging you to purchase it and more clogging up of the registry files as anti virus programmes seem to do even when you have uninstalled them. Like you I also bow to others better knowledge, hopefully Earnst will appear soon, he's good at this sort of thing.

[tel]

Hi Gay,

Sorry for calling you Kay.  Safe mode, start or restart your computer, as it is booting keep hitting the F8 key, when the options appear use the arrow keys (up - down) to select 'Start in safe mode' when highlighted hit the enter/return key then when windows starts try 'System Restore'

Best of Luck

[Gardener]

I had what sounds like one of these false warnings yesterday when I was looking at the Guardian website ! I have free avast which I ran and that seemed to solve whatever problem was there. I also have C Cleaner which I run weekly, between them they seem to be looking after the computer for me.

[Théière]

There is a big difference between a virus scanner and removing one of these nasties once they get into the machine. Most of the clever Trojans disable your virus scanner software.

[cooperlola]

[quote user="Russethouse"]

where is the head banging icon ![/quote]

Anything for you, R/H.

[IMG]http://i134.photobucket.com/albums/q103/cooperlola/pchead.gif[/IMG]

[Russethouse]

Thanks Coops [:)]

 Don't worry about the name thing tel, being called by another name seems to be my lot in life - the guy we have to fit our curtains called me Jane (which happens to be my sisters name ) and a French guy called me 'Gloria' as does the picture framer we use  (Gloria Gaynor - shows their age !)

Even my husband sometimes calls me Marlene (when I'm running late........'Come along Marlene' from Only Fools and horses...[:)] ) Good job I'm not sensitive !!!

 I phoned the computer guy I use and he is coming to take a look this afternoon - no doubt he'll moan about all the emails I have, again ! [:P]

Thanks for all the advice

[Will]

Gay

As long as you can get into Windows you should be able to run a 'system restore' which will get you back to the state before you downloaded the 'naughty' files. You will then still need to run a full scan/cleanup before doing anything else, because the offending files will probably still be on your computer and they need to be zapped as quickly and comprehensively as possible.

[AnOther]

[quote user="NormanH"]have you tried an online scan such as
http://www.kaspersky.com/virusscanner   ?
[/quote]That would be a reasonable move if RH could get online in the first place which, as I understand it, she cannot !

Personally, in a case like this, I'd be inclined to remove the hard drive and connect it to another machine for a through virus scan, alternatively a DOS based virus scanner might work however both involve a level of skill which, with all due respect, I doubt RH possesses.

Still, if she has a tame geek coming to sort her out it's now all a bit academic isn't it [;-)]

[Russethouse]

I can get online by using the links here that come into my email box - however I know my own strengths and dealing with this sort of thing isn't one of them - I suspect Peter will take the computer away for a couple of days :-(

 I've avoided any sites like banks etc so hopefully all the harm that will be done is a lightening of the wallet [:(]

[pachapapa]

[quote user="tel"]

Hi Gay,

Sorry for calling you Kay.  Safe mode, start or restart your computer, as it is booting keep hitting the F8 key, when the options appear use the arrow keys (up - down) to select 'Start in safe mode' when highlighted hit the enter/return key then when windows starts try 'System Restore'

Best of Luck

[/quote]

Safe Mode is worth a try but the problem is that you will not be able to use your browser to do an online scan.

That would require Safe Mode with réseau (french computer) to get limited access to the internet.

An alternative which I have used with XP, never had a problem with Vista, is when the Window appears after tapping F8 to enter Safe Mode; do NOT slavishly select one of the customary options but scroll the page down, where in the lower portion you will presented with the option of selecting System Restore WITHOUT entering Safe Mode.

Then choose a Restore Point at least the day before the problem occurred.

If the System Restores to the earlier date successfully then do a thorough Virus and Malware clean up.

[pachapapa]

I have also available on a 256 MB Thumb Drive the Microsoft Standalone System Sweeper Beta in a 32 bit iso version suitable for use on either the Vista Tower or the XP+ SP3 Netbook.

The download to the Thumb Drive or CD Rom can be done on any Windows Computer and then plugged in to the PC with the infection before rebooting it.

Available at the following link.

http://connect.microsoft.com/systemsweeper

More information on Google.

http://www.google.fr/search?q=Microsoft+Standalone+System+Sweeper+Beta+&rls=com.microsoft:fr:IE-ContextMenu&ie=UTF-8&oe=UTF-8&sourceid=ie7&redir_esc=&ei=SoxOTryRBe6P4gSmmLXoBw

Help file on installation on CD DVD USB

https://connect.microsoft.com/systemsweeper/content/content.aspx?ContentID=24894

[pachapapa]

Perhaps a little further info on the application.

What it is effectively doing is running the Microsoft Security Essentials protection software in an OFFLINE environment so no connection to the internet is required.

It should be noted that Microsoft update the definitions for this Security Programme several times a day. So consideration should be given to installing the application on a bootable medium immediately before attempting the clean up operation.

As stated above I have a pre installed Standalone System Sweeper installed on a Thumb Drive on the 6th june 2011 and the definitions are therefore more than 2 months out of date and ostensibly of limited use.

Now PPP knows that the security definitions are in a file called mpam-fe.exe. This file is available for download in its updated condition at the following link, note for a 32 bit system, the link http://go.microsoft.com/fwlink/?LinkID=87342 .

PPP downloads this file to his desktop ready for replacement of the current mpam-fe.exe file resident on the thumb drive; normally this would be done in case of need, rather than for todays didactic exercise.

Now the thumb drive has not sufficient space on it to simply transfer the file to the thumb drive, so the resident file is suppressed before transferring the new file to the thumb drive.

PPP notes with satisfaction that the size of mpam has increased by some 2 MB [:D] but he is sad that by tomorrow it will be out of date.[:(]

For those of you who already use Microsoft Security Essentials the modus operandi will be more familiar.

Nice little number....thanks a span Microsoft.[:-))]

[pachapapa]

For anyone interested more info on the mpam-fe.exe update.

http://goo.gl/j3ik9

Editted an earlier post so just bumping.

[pachapapa]

Been playing with the USB drive.

Downloading and executing the mssstool32 wizard now updates the previously installed Application.

The updating of the definitions is now simple, thankyou Microsoft.

Effectively the mfam-fe.exe info can now be ignored.

[Russethouse]

PC is away being fixed.........I'm using an old, slow lap top :-(

[Russethouse]

 At last I have my PC back, the problem would not budge and all my data had to be removed the hard drive wiped (???? I think, not sure) then my info put back -----as per usual my layout has been altered, files and folders not all where they were, esp those on the desktop !

  In the meantime I managed with an old slow laptop however although the Inbox on my Bt yahoo mail has been imported to my PC fine, the outbox has not...is there a way to move those emails to my PC outbox rather than the online bt mailbox I was using before..... ?

TIA

[AnOther]

Hmm, not necessarily knocking your man Peter, we don't really know what the problem was and it's easy to criticise at arms length, but wiping does sounds more like a 'PC World' sledge hammer approach than a skillful targeted repair.

Re your mail, I presume you were using something like Outlook or Outlook Express. If you can confirm which we may be able to help get the sent mail back onto the machine.

Oh, and you haven't said yet which version of Windows it is !

[Russethouse]

 To be honest I'm not entirely sure what he did, only that it took longer than anticipated because the usual method  (what ever that is) didn't work - he also physically cleaned the inside....

I'm on XP and use Outlook Express