Author Topic: Abnormal desktop  (Read 1679 times)

Offline Bizman

  • Plutonium Member
  • *******
  • Posts: 9690
Re: Abnormal desktop
« Reply #15 on: September 18, 2013, 02:10:34 PM »
Absolutely fabulous, Fulcrum! And perfectly correct. :salute
I was so blinded to just give some options for Gyrene's suggestion of running some scanning tools in Safe Mode and then sorting out why they wouldn't work, that I totally forgot about the bootable scanners. My personal favourite of them is F-Secure Rescue CD: http://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142, and I've also used Kaspersky and Avira in those rare cases when F-S can't recognize the netcard.

Fulcrum, I recommend you to include Rkill in your bag of tricks, it might come in handy after having done the basic cleaning with a boot cd.

Max, do as the man says. I stand corrected. And about if it could be a hardware problem, I've seen viruses damage video drivers so that the image looked like it only had 8 colours and a resolution of 640x480.

Somehow it's much easier to do the right things in the right order when the thing is on my desk than trying to figure out another person's capability and resources on the other side of the world in a foreign language...
« Last Edit: September 18, 2013, 02:14:18 PM by Bizman »

Offline gyrene81

  • Plutonium Member
  • *******
  • Posts: 11629
Re: Abnormal desktop
« Reply #16 on: September 18, 2013, 02:16:48 PM »
Fulcrum's suggestion is optimal, especially if the infection is of an unknown or particularly harmful nature...i've been lucky lately not having to deal with anything more harmful than the moneypak virus and the gpcode file encrypter virus. both easily removed without having to do anything real special.
jarhed  
Build a man a fire and he'll be warm for a day...
Set a man on fire and he'll be warm for the rest of his life. - Terry Pratchett

Offline Fulcrum

  • Silver Member
  • ****
  • Posts: 1183
Re: Abnormal desktop
« Reply #17 on: September 18, 2013, 02:28:14 PM »
Absolutely fabulous, Fulcrum! And perfectly correct. :salute
I was so blinded to just give some options for Gyrene's suggestion of running some scanning tools in Safe Mode and then sorting out why they wouldn't work, that I totally forgot about the bootable scanners. My personal favourite of them is F-Secure Rescue CD: http://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142, and I've also used Kaspersky and Avira in those rare cases when F-S can't recognize the netcard.

Fulcrum, I recommend you to include Rkill in your bag of tricks, it might come in handy after having done the basic cleaning with a boot cd.

Max, do as the man says. I stand corrected. And about if it could be a hardware problem, I've seen viruses damage video drivers so that the image looked like it only had 8 colours and a resolution of 640x480.

Somehow it's much easier to do the right things in the right order when the thing is on my desk than trying to figure out another person's capability and resources on the other side of the world in a foreign language...

No worries at all! Most people go the "Safe Mode" route....just in my experience it's not a great way to go.  Once the OS is compromised you are (pardon the language) screwed....best to eliminate the OS from the equation before you attempt to repair the system.

F-Secure and Kaspersky are great too and in my tool kit.  Havent used Avira in a while...as for Rkill...come on man, do I look like an amature?!?! *grin* Just kiddin'...and don't answer that.   :rofl

You are also correct on the virus being able to damage video card drivers...but in that case I'd still make sure the virus is gone / system is clean prior to fixing the driver, lest you run into an issue of fixing the symptom and not the problem.  I suspect the virus may well have damaged this and other drivers (likely through replacing or deleting DLLs and other needed files, etc).


Going by "Hoplite" now. :)

Offline Bizman

  • Plutonium Member
  • *******
  • Posts: 9690
Re: Abnormal desktop
« Reply #18 on: September 18, 2013, 02:45:10 PM »
i've been lucky lately not having to deal with anything more harmful than the moneypak virus and the gpcode file encrypter virus. both easily removed without having to do anything real special.
Same here, that's why I got blinded so easily.

On second thoughts, about if it possibly could be hardware related: Back in 2005 or so Fujitsu-Siemens had a desktop with a certain motherboard made by Asus. The southbridge had a tiny fan in an aluminum cup as a cooler. The fan was of very poor quality and it burned its bearings in a couple of years. Depending on usage the southbridge would last for over three years before overheating, but when it did, the computer was fully functional in Safe Mode. I can't remember, though, if normal booting crashed or just stuck. Nevertheless, starting Windows normally was an unusable option.

In any case, starting with a virus cleaning especially when nasties have already been found is the right way to do. After having cleaned the computer backing up everything valuable would not be a bad idea either just in case there'd be something hardware related.

@Fulcrum: You're perfectly right in saying that the computer must be clean before repairing any damage the viruses might have caused. That's one reason I like to run ComboFix after the boot CD: It both cleans and fixes, using the tools of the Windows Recovery Console. Running chkdsk /r from the Windows installation/repair disk on a cleaned machine will do basically the same, and then sfc /scannow. Or even a repair install of the OS. And before my friend MrRipley gets to say it, in tough cases a total clean reinstall is the ultimate solution for getting rid of anything harmful, be it viruses or damaged drivers/dll's/anything. Sometimes that just isn't an option, at least not the primary one.

Offline FA_Refugee

  • Copper Member
  • **
  • Posts: 146
Re: Abnormal desktop
« Reply #19 on: September 18, 2013, 03:19:27 PM »
Fulcrum , very good info and explantion.  If possible this should be a "sticky" somewhere.
Weizel

"Vodka without beer and truffles is like throwing money in the wind."

Offline Fulcrum

  • Silver Member
  • ****
  • Posts: 1183
Re: Abnormal desktop
« Reply #20 on: September 18, 2013, 03:34:02 PM »
Same here, that's why I got blinded so easily.

On second thoughts, about if it possibly could be hardware related: Back in 2005 or so Fujitsu-Siemens had a desktop with a certain motherboard made by Asus. The southbridge had a tiny fan in an aluminum cup as a cooler. The fan was of very poor quality and it burned its bearings in a couple of years. Depending on usage the southbridge would last for over three years before overheating, but when it did, the computer was fully functional in Safe Mode. I can't remember, though, if normal booting crashed or just stuck. Nevertheless, starting Windows normally was an unusable option.

In any case, starting with a virus cleaning especially when nasties have already been found is the right way to do. After having cleaned the computer backing up everything valuable would not be a bad idea either just in case there'd be something hardware related.

@Fulcrum: You're perfectly right in saying that the computer must be clean before repairing any damage the viruses might have caused. That's one reason I like to run ComboFix after the boot CD: It both cleans and fixes, using the tools of the Windows Recovery Console. Running chkdsk /r from the Windows installation/repair disk on a cleaned machine will do basically the same, and then sfc /scannow. Or even a repair install of the OS. And before my friend MrRipley gets to say it, in tough cases a total clean reinstall is the ultimate solution for getting rid of anything harmful, be it viruses or damaged drivers/dll's/anything. Sometimes that just isn't an option, at least not the primary one.

I actually haven't used ComboFix tho....gonna have to check that one out. Anything that saves me time is welcome. :D
Going by "Hoplite" now. :)

Offline Max

  • Platinum Member
  • ******
  • Posts: 7815
Re: Abnormal desktop
« Reply #21 on: September 18, 2013, 03:44:02 PM »
Many thanks for the valuable input. I printed the "Fulcrum Method" and will give it a shot tomorrow when I have a couple of hours.

Expect more questions...my level of geek expertise is a 5 on a scale of 1-10.

 :salute

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: Abnormal desktop
« Reply #22 on: September 19, 2013, 12:15:00 AM »
And before my friend MrRipley gets to say it, in tough cases a total clean reinstall is the ultimate solution for getting rid of anything harmful, be it viruses or damaged drivers/dll's/anything. Sometimes that just isn't an option, at least not the primary one.

IMO reinstall is always an option. I never trust any antiviruses ability to clean the system. If the antiviruses worked, the system wouldn't get infected in the first place! It's that simple. Boot to linux live cd, copy necessary personal files to a USB stick or a network drive, use the same bootable DVD to scan the personal files and then format the drive not forgetting the boot sector erase. If the computer has an unprotected bios even the bios should be reflashed.

Then preferably my favourite last part to fix the infection is to install linux on the computer instead of windows :D My parents used to have malware or other problems every 2 months minimum while on windows. After literally forcing them to use linux I haven't had to go there to fix anything for the past 2 years. Well, 4 months ago I did. They complained that the wireless network in their linux laptop didnt work. So I go there to check, sure enough no internet. I troubleshoot and troubleshoot. I can't find any problems. Then it struck me... do they have internet IN GENERAL? No.. The problem was that the wireless modem upstairs had dropped offline lol.

Only gaming computers in my family run windows anymore. All else is either OSX or linux and even their browsers run noscript and java is uninstalled.

Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline TequilaChaser

  • AH Training Corps - Retired
  • Plutonium Member
  • *******
  • Posts: 10173
      • The Damned - founded by Ptero in 1988
Re: Abnormal desktop
« Reply #23 on: September 19, 2013, 10:38:09 AM »
If there is no other way to get the system clean, I am all for reformatting/reinstalling the OS ( after trying to save as many/much of my pics/files/data/etc.. as possible

I also like Fulcrum's bootable CD recovery/cleaner CD reply


I usually use a combination of

www.malwarebytes.org  ( I most times will use the chameleon version of it, so it hides itself from the most pesky virus problems, although the regular name version has worked a good amount of times as wel )

using the above along with RKill, tdsskiller, and sometimes even using regassassin, although I have only used regassassin on a limited basis.......


once I have done a complete run through of the above programs, I will often do 2 or 3 more sweeps

then I will use ESET's online Scanner, once finished with that, and everything is checking out good, I will install ESET Smart Security ( 4.xx, 5.xx , 6.xx  and now I think they are up to version7.xx  )

If I am not mistaken and recall correctly, the link I provided for malwarebytes, will give you instructions on what order to run these programs in......... be cautious of using regassassin, read all instructions thoroughly )

alot of good posts in this thread, Maxie

pm me or call me if I can be of any help or you want someone to walk you through the process........

Good Luck, Bro

<S>

TC ( Johnny )
"When one considers just what they should say to a new pilot who is logging in Aces High, the mind becomes confused in the complex maze of info it is necessary for the new player to know. All of it is important; most of it vital; and all of it just too much for one brain to absorb in 1-2 lessons" TC

Offline Max

  • Platinum Member
  • ******
  • Posts: 7815
Re: Abnormal desktop
« Reply #24 on: September 23, 2013, 10:35:37 AM »
AAR....

Did a fresh install of W7 on a new hard drive. All's well. Thanks for all the tips!!

Offline Fulcrum

  • Silver Member
  • ****
  • Posts: 1183
Re: Abnormal desktop
« Reply #25 on: September 23, 2013, 10:44:33 AM »
AAR....

Did a fresh install of W7 on a new hard drive. All's well. Thanks for all the tips!!

Ugh.  Sorry to hear that.  Must have been something pretty nasty...but glad to hear you are back up and running!   :salute
Going by "Hoplite" now. :)

Offline Max

  • Platinum Member
  • ******
  • Posts: 7815
Re: Abnormal desktop
« Reply #26 on: September 23, 2013, 11:14:38 AM »
The old HD was almost 5 yrs old...figured a clean install was as good as anytime to spring for a new one. Never did pinpoint the issue(s) but I'm no longer pulling my hair out.  :devil

Offline MrRiplEy[H]

  • Persona Non Grata
  • Plutonium Member
  • *******
  • Posts: 11633
Re: Abnormal desktop
« Reply #27 on: September 23, 2013, 03:01:58 PM »
Ugh.  Sorry to hear that.  Must have been something pretty nasty...but glad to hear you are back up and running!   :salute

Why sorry? Fresh install on a fresh hdd is never a bad thing.
Definiteness of purpose is the starting point of all achievement. –W. Clement Stone

Offline Fulcrum

  • Silver Member
  • ****
  • Posts: 1183
Re: Abnormal desktop
« Reply #28 on: September 23, 2013, 03:13:21 PM »
Why sorry? Fresh install on a fresh hdd is never a bad thing.

No, but it is always a time consuming pain-in-the-arse to get the PC back to where it was i.e. all drivers installed, applications reloaded, games reloaded, setting restored, documents restored, etc.  Even if you are organized, have all your drivers at all times (I do), files backed up, etc it still consuming time I'd rather use for some other activity.
« Last Edit: September 23, 2013, 03:24:22 PM by Fulcrum »
Going by "Hoplite" now. :)

Offline Fulcrum

  • Silver Member
  • ****
  • Posts: 1183
Re: Abnormal desktop
« Reply #29 on: September 23, 2013, 03:23:47 PM »
The old HD was almost 5 yrs old...figured a clean install was as good as anytime to spring for a new one. Never did pinpoint the issue(s) but I'm no longer pulling my hair out.  :devil

Yeah....in that case it was time to start thinking about a new drive.  Good to hear it all worked out! :aok
Going by "Hoplite" now. :)