computer doing strange things. possibly a virus. help! (1 Viewer)

[taubstumm]

for some reason, pressing ctrl-alt-delete isn't working on my laptop. when i do it, nothing happens.

is that normal under any circumstances?

i thought that it was some strange once-off quirk, so i restarted a couple of times, and it still wasn't working.

so i decided to do a spyware scan. i've just tried to launch microsoft antispyware and now i'm getting an 'error launching microsoft antispyware' message.

the thing is, everything else seems pretty normal - nothing else has stopped working or gone funny.

advice please. do you reckon it's something serious or is there just something gone a bit gammy?

 

[cookiemonster]

maybe try using a different antivirus / antispyware scanner and see if that makes any difference?
avg, ad-aware, hijackthis, trojanhunter are all good

 

[Rogue]

If it is malware then it may be hijacking the task manager and
antispyware, try rootkitrevealer as well as all what cookiemonster did said.

 

[pete]

and do as many in Safe Mode as possible

 

[taubstumm]

and do as many in Safe Mode as possible

how do i do that?

 

[cookiemonster]

restart your laptop then keep hitting F8 as it's switching itself back on, you'll get a list of options like 'last known good configuration' 'restart as normal' 'safe mode' etc. run the programs as normal once you've logged in in safe mode.

 

[taubstumm]

progress since starting this thread:

- downloaded and installed ad aware and trojan hunter.

- uninstalled the gammy copy of microsoft antispyware.

- tried to download a new copy of microsoft antispyware. it's no longer available. apparently you're now meant to install windows defender instead.

- downloaded windows defender. started to install it. couldn't - you need to have service pack 2 installed in order for it to work.

- sighed heavily. (however, it did solve one of the questions. presumably. i'm assuming that microsoft antispyware was acting funny originally because everyone's using windows defender instead now so the support for microsoft antispyware is crappy. am i right?)

- ran scan with ad aware. it found nine copies of this fucker: WIN32.P2P-WORM.ALCAN.A. it was coloured bright red and had exclamation marks beside it, so i quarantined it and deleted it.

- ran scan with trojan hunter. all ok.

- took a look at this thread again. saw the thing about safe mode. gritted teeth.

- restarted in safe mode. ran scans with ad aware and trojan hunter. found one more copy of the WIN32.P2P-WORM.ALCAN.A thing. deleted it.

- restarted in normal mode. tried doing ctrl-alt-del. still not working!

so...

questions arising out of all of this:

- why can i still not do ctrl-alt-del to see what's running?

- should i install service pack 2?

- will installing service pack 2 break other things? old/cracked/foreign software, for example? will it make me cry?

- what should i do next?

- why is nothing ever simple?

 

[cookiemonster]

- should i install service pack 2?

yeah

- will installing service pack 2 break other things? old/cracked/foreign software, for example? will it make me cry?

wouldn't say it would break any cracked software

- what should i do next?

are you using any kind of software firewall? here's a good one if you're not -> zonealarm

 

[RED(tape)MENACE]

- should i install service pack 2?

Yes, goddamnit.. fuckin ages ago. Get it now.

Run every spyware/trojan thing you have in safe mode. Do a search for the exact Win32 version you had.. often you have to go in and manually delete registry keys and such. Sometimes there's wee programs you can download from mcafee and them that do a job for ya. Either way, you're not done yet.

 

[taubstumm]

shite

 

[RED(tape)MENACE]

FWIW, I reckon the windows firewall is as good as any.

 

[RED(tape)MENACE]

Oh, and you're missing American Idol. And riots on O'Connell Street.

 

[taubstumm]

Oh, and you're missing American Idol. And riots on O'Connell Street.

i certainly feel like throwing a few bricks right now

 

[ICUH8N]

specific removal instructions

This assumes you have a virus scanner with up-to-date defs installed. It's important that you kill all the reg keys, startup entries etc, or you'll never be rid of it.

 

[RED(tape)MENACE]

Yeah, that's the shit I was talking about.

 

[Theseus Mock]

not to dismiss all the previous suggestions, but are you sure all the keys for crtl+alt+del actually work? take a look in your windows folders look for the taskmgr.exe and see if there's anything funny running.

 

[pete]

not to dismiss all the previous suggestions, but are you sure all the keys for crtl+alt+del actually work? take a look in your windows folders look for the taskmgr.exe and see if there's anything funny running.

or just right click the taskbar & select Task Manager

 

[classic seanc]

or just right click the taskbar & select Task Manager

Or just press ctrl+alt+del.


Oh, no. wait a minute.................................nevermind

 

[taubstumm]

specific removal instructions

This assumes you have a virus scanner with up-to-date defs installed. It's important that you kill all the reg keys, startup entries etc, or you'll never be rid of it.

thanks for the link. yes, i now have 3 antivirus things running (windows defender, ad-aware and trojan hunter), and i've just done full scans with all of them, in safe mode. ad-aware came up with ten more copies of the same w32.alcra.a thing.

so... it's safe to assume that it's some worm that's creating new copies of itself with each startup.

(though i still don't know if this has anything to do with my ctrl-alt-del problem that started the whole thing off - do you peeps reckon it does?)

however, i'm now having trouble with deleting stuff from the registry.

from the removal instructions linked by icuh8n:

To delete the value from the registry

1. Click Start > Run.
2. Type regedit

Then click OK.

Note: If the registry editor fails to open, the risk may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

this is, indeed, exactly what happens. i get a message saying "regedit is not a valid win32 application".

so, i went and downloaded the tool that they have for fixing this.

no use. so far.

i still get the "regedit is not a valid win32 application" message, despite having installed the tool.

so what should i do now?

 

[pete]

so what should i do now?

panic