Nasty virus

jbstacyg
jbstacyg used Ask the Experts™
on
I have several viruses on my computer.  only way I can use my computer is in safe mode.  What is the best virus removal software I should use?  I know there are good free ones out there.  As a matter of fact, I have norton on my system and it said I had to manually remove it.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
It depends on the nature of whatever is infecting your system. You may have to use several different removal tools from different vendors to clean up your computer.

When I'm dealing with such problems I sometimes find that the time taken to remove every threat on a computer would exceed that needed to back up critical data, reformat the drive, and re-install Windows.

Also, the line between viruses, scareware, malware and other threats is becoming increasingly blurred, making it difficult sometimes even to identify what kind of infection you're dealing with.
1) The 2 WORST AV programs out there are: McAfee & Norton!  Dump it!
2) I usually have success attaching the drive to another GOOD PC and doing a complete scan with the following TWO tools:
  Microsoft Security Essentials, and
  Malware Bytes AntiMalware...
3) If they have difficulties with removal, there are some "heavy hitter" tools I use next, but they require a bit of expertise to use...  The main thing is that, once the drive is scanned without having been booted from, it won't have a chance to load and mask the baddies before the OS!

Author

Commented:
the virus was:

zeroaccess rootkit activity 4
Why Diversity in Tech Matters

Kesha Williams, certified professional and software developer, explores the imbalance of diversity in the world of technology -- especially when it comes to hiring women. She showcases ways she's making a difference through the Colors of STEM program.

Author

Commented:
i am running spybot search and destroy right now.  is that a good tool?
Spybot is good for spyware, but not so good for viruses...

Actually, Symantec (vendors of Norton) have a removal tool here:

http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FixZeroAccess.exe

However, if the virus on your PC prevents it from running, things are a bit more difficult.

It would be prudent to back up your data before continuing, while you can still access it.

Slaving the drive to another computer as n2fc suggests is an excellent idea, if you have one available.
DavidPresident
Top Expert 2010

Commented:
By definition, there can't be a "best" AV package.  Not all AV software can protect against any specific virus, and some viruses can bypass specific AV packages.

You want to be immune? Then stop downloading stuff and going to the types of sites (you know what they are) that serve code that tries to hack into your machine.  

Free AV code?  Really now, you get what you pay for.  Unless this is an open source community AV, then look out.  Also remember that the people who create viruses also have access to the same source code.
Virus (word used generically here) removal usually involves two steps: removing the virus itself, then removing the damage it has left.  The first part is often the easier of the two.

The suggestions to install your drive as a second one and scan it from there are good, exactly for the reasons given.  Even after the cleaning is done there, you will still have to rescan when in your system and also clean up the damage.

You MIGHT be able to clean it up through scans in Safe Mode, but that is less likely.

I typically scan with the following:
TDSSkiller (from Kaspersky, VERY limited in what it is designed to kill, but quick and effective)
Malwarebytes AntiMalware
SuperAntiSpyware
Housecall (housecall.trendmicro.com)
Microsoft Security Essentials

The key is that you are not done until you have done full scans with whatever tools you are using and NOTHING shows up.  If something shows up and you tell the program to get rid of it, don't assume it is gone.  Reboot and rescan.

After all scans are clean, check to see that you can access the internet and that Windows Updates works.  This is where I see a lot of damage, sometimes easy and sometimes not easy at all to fix.

Perard..... makes a good comment that it may be easier to do a backup, reformat, and restore.  It is a matter of how comfortable you are of being able to back up everything important and reinstall whatever software you need to.  If I'm taking this approach, or if the situation is particularly difficult, I will usually image the drive to a spare one before proceeding so I can always get back to where I started if I want to.
Distinguished Expert 2017

Commented:
Since you are in safe mode, first thing to check that the viruses do not have their hooks in the system.
Msconfig
Check the prefetch to make sure it is not there.
Younghv has a set of articles which I think include the references compprobsolve included with some additional overview.
http://www.experts-exchange.com/M_3628488.html

The other part to check is to make sure the virus is not part of the ie addons.
When booting in normal start start IE with extensions off
Then check the addons to make sure the ones there should be there.

Author

Commented:
was able to pull the drive and save all my critical files.  wiped the drive and put a fresh copy of xp on there.  its an outdated copy (SP1).  now i have outdated drivers so i cant connect to the internet.
Distinguished Expert 2017

Commented:
At this point this question is mute?
With the approach you have chosen, you will have to find the appropriate drivers with another computer and install them on your computer or load them with a disk that may have been provided with your computer.
You only need network adapter drivers to regain your internet connectivity, but I would get some good AV protection at the same time, because virus problems are the rock that you just foundered on.

If you can recall the make of your NIC you may not need to know the exact model, as manufacturers such as Intel and Realtek tend to offer drivers for families of adapters rather than specific models.

Once you have connectivity you can download all the necessary drivers, service packs, and updates; there will be a lot of them!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial