Computer Virus Removal

I’m often asked what free anti-virus I recommend.

Unfortunately no one anti-virus can remove all viruses. In our Calgary computer repair shop we use many different ones and each finds different infections. Some that we use are AVG, Avira, Avast, Kaspersky, Dr. Web Cure-it, E-set online and off, among others. If we relied on only one, we wouldn’t be able to do an adequate job of fixing computers. So it rankles when an anti-virus company wants to be the only one used by people. It’s not realistic and would mean that a lot more computers would have to be reformatted to get cleaned.

If you’re asking which one I think you should keep resident on your computer, I like both Avira and AVG best. Both are really good at catching viruses. Google (search on Google for) either one and find the result that includes “download.cnet.com” in its address. I recommend both Avira and AVG. Of course, I don’t mean both at once. I mean choose one of the two.

I used to prefer AVG over Avira until AVG stopped working with Combofix of Bleeping Computers. I loved AVG and put it on every computer in close proximity. I liked AVG better because of its easier user interface. Being “easier” meant more effective, because people were able to use it more effectively. Now I prefer Avira since you don’t have to uninstall it to run Combofix, which is, unfortunately, the only solution sometimes to an infected computer.

By the way, whoever the creator of Combofix is, whoever sUBS is, he ought to receive knighthood or hero-hood for the amount of computers he saves on a daily or even an hourly basis, and for which he does not even receive payment. He really makes a huge difference in people’s lives without much recognition or money. I respect him enormously and hope he lives a long time because we will be all be sunk without him.

Only people who are experienced techs should use Combofix, however. Very, very occasionally it will cause a computer to stop booting and if this happens and you don’t know how to undo the changes it makes, you may have to reinstall Windows.

Both AVG and Avira ought to take note, their new default of having scheduled scans disabled upon install is dangerous. Many people think they are protected when they are not. If you have Avira or AVG make sure they’re scanning on a daily basis.

If you have a virus and live in Calgary, come to our Virus Removal Lab and will be able to help you out without losing your data or programs or even changing your computer except to speed it up. We would love to see you.

PS. We enjoy all kinds of people and computers and viruses…and aren’t judgmental.

Ms. Ducktoes did it! I beat the dreaded Virut without reformatting. This is how I did it.

1. The Dr. Web Cureit Live CD I spoke of in the last post didn’t work. At the beginning of the scan, it stopped everytime. So instead:
2. I created an Ultimate Boot CD for Windows. I downloaded the image from the UBCD website and burned it to cd. There are detailed instructions on the site on how to do this.
3. I booted off the cd and went on the Internet through the UBCD interface. I downloaded Dr. Web Cureit to the Ram drive.
4. Then from the “Run” option off the start menu I browsed to the B: Ram drive and opened cureit.exe.
5. Dr. Web Cureit started. I had to stop the Express scan and run the Custom scan and select the C drive or the C and D drives since I had more than one hard drive. Otherwise Dr. Web Cureit just scanned the CD.
6. I cured the files instead of deleting them. The Virut virus changes the system files and your computer system needs them.
7. I scanned a three times this way.
8. I rebooted but the computer wouldn’t start. So I did a “repair install” with my Windows Xp cd.
9. After the Repair Install, it booted, but after the logon, the logon kept returning. I couldn’t get past it.
10. So I booted off the UBCD and replaced the Userinit.exe file in the System32/dllcache folder. I found another copy of it in the 1386 folder and copied and pasted. You can search using the Windows Explorer on the UBCD disk.
11. Then I ran regedit (still off UBCD) and searched for userinit. I found the registry keys related to userinit. One of them was set for the logon to repeat over and over, so I changed it from “1″ to “0″.
12. Then I rebooted and the computer started and the logon didn’t repeat!!
13. Immediately I went into Safe Mode and started running virus scans like crazy. I ran Malwarebytes, AVG, SuperAntiSpyware and Dr. Web Cureit again. And found more trojans and viruses.
14. After all the scans ran clean. I rebooted.
15. The Virut was removed!!! And I didn’t reformat.

I just fixed an odd virus: the “Open With” Virus. Everything I tried to open including my usual anti-virus programs prompted a dialog box asking what I wanted to open the AVG with. Of course that’s silly, you can’t open AVG with another program like Microsoft Word or Adobe Reader. It kept me from doing anything. That’s why it’s called the “Open With” virus. The virus asks, What would like to open that with? Oh, I think I’ll open Internet Explorer with Civilization 4 (I have sons). And I’ll open itunes with Instant Messenger. See, it doesn’t make sense, and moreover it doesn’t work, in fact nothing works, and you are stuck. You are deep in the doo doo of Malwareland.

You're in the deep doodoo of Malwareland.

Some techs say you have to reformat if you get this virus, but Ms Ducktoes hates that word “reformat”. I’ve seen it make a grown man cry. And then when he cries, I cry, and then I get a sinus headache and my mascara runs down my cheeks. So I find it much better and less embarrassing to do this instead:

Right click on the program you want to run, such as AVG. From the choices displayed, click on “Run as” and pick your own user. There’s a box you have to uncheck too. I ran AVG and it quarantined the virus. Then I was able to do the usual virus clean up.

But if you don’t have an anti-virus on the computer already what do you do? Install Malwarebytes on another computer. You’ll get a set up icon on your desktop. Stick a flash drive (you can buy them at any electronics store) into the usb port and go to My Computer (Start > My Computer, or just “Computer” on Vista) and you’ll see all your drives, your hard drive or drives, your dvd player, and now the flash drive. Click on the flash drive. A window will open. Now drag the set up icon of Malwarebytes into the flash drive’s window. Remove the flash drive.

Then put the flash drive into the infected computer. It will probably have to install as a drive. Go to My Computer. Find the Malwarebytes set-up icon. Right click on it and “Run As” your user. Let it install and run and do it’s thing.

After that go to this page on my blog, click these words here and follow the rest of the instructions.

If you want, Ducktoes Computer Repair can fix your virus. Click here to read more about our remote service. Or click here to book remote appointment. http://ducktoes.com/book_online.php We’ll get back to you.

This week I found a new type of virus: Sysguard, Win32 Patched-Kg, and Malware Alerts difficult to remove. The usual ways of removal didn’t work since these spyware/viruses suppress ComboFix and Malwarebytes and keep them from running. I had to run Avast first. The boot scanner in Avast made the first dent in the viruses armor. After that I could run the other programs. I’ve been using Avast all week, for the first time on a regular basis, and am grateful for it’s effectiveness. Avast will probably help in all viruses that suppress installation or running of anti-spyware or anti-viruses.

So if you have a difficult virus, follow these steps:
1. Download Avast. Install and run it. It will run automatically and usually, if you have Sysguard, Win 32 Patched-Kg, or Malware Alerts, it’ll find a virus right away. Then it will want to run a bootscan. Let it. The bootscan should remove enough of the virus that you can now update Avast and run it again. So make sure you Update Avast. Click the button that looks like a lightening strike or Harry Potter’s forehead.

2. After updating and running Avast again, you can now download and run ComboFix. It will automatically delete some bad virus files.

3. Then download, run, and update Malwarebytes.

Let me know if this works for you or if you have another suggestion or comment.

Many of my clients are worried about the new AVG. They’ve been receiving alerts and trying to update to the new AVG. AVG 8.5. They think they have to pay.

A new version of AVG is out but no, you don’t have to pay for it. It’s free as usual. Click here to download it. If you have trouble downloading it I will be glad to assist you. Just call 403-483-0105. It is the first thing you need for good protection along with some decent anti-spyware software.

Sorry I’ve been away, floating down rivers in Europe with Mr. Ducktoes, Little Ducky son and so have been remiss in writing posts for this blog.

Please as usual don’t be shy about making comments and suggestions.

The worst spyware of 2008 (in my experience) is certainly Windows XP Antivirus 2008/2009 or one of its many variations. This malware invades a computer in one of many ways, usually bundled with a video codec, or freeware or shareware, or sometimes when you accidentally go to (drive by) a bad website.

Infected computers display warnings and scans that look like Window alerts. They lead you–the besieged users–to buy the rogue product for $40. If you buy the rogue software then the fraudsters now have access to your credit card. (Call your credit card company immediately if this is the case.) And the purchase of the rogue anti-spyware does nothing to relieve the infection, in fact it takes over your computer to make it part of its botnet. This is the part I don’t understand. From my experience the infection makes the computer so totally crippled it can’t function, and for this reason I question how well it would serve even a botnet. But that according to this article is the intention.

And here’s another article about it.

http://www.nytimes.com/2008/10/30/technology/internet/30virus.html?th&emc=th

I find Windows XP Antivirus 2008/2009 extremely difficult to remove. Sometimes it comes back even after a Windows Repair from the cd.

Here’s a post that tells how to remove it.

The spyware that seems to have affected the most readers of this blog, is the Hallmark Card virus. So it is the 2nd Worst Spyware of 2008. Here’s how to remove it.

And here’s a great slideshow by Channel Web showing the top ten malware in the news.

Ms. Ducktoes is still in a flap due Windows Xp Anti-virus 2008/2009. Too many people are losing everything on their computers and having to reformat their hard drives. People are losing irreplaceable family photos. Businesses are losing all their contacts and documents at enormous expense.

If your computer is infected, you can fix it without losing your precious photos, music, business data, and files. Spyware Doctor with Antivirus is one easy, no fuss solution. And as a bonus, afterward, your computer will be safe against future infections of other types of malware. Otherwise if the malware progresses, you’ll may lose everything and end up hiring a tech to reinstall your operating system. Save yourself a lot of trouble and cost now and by using this top-rated anti-spyware. It repairs Windows XP Antivirus and many other difficult malwares.

Windows XP Antivirus 2008/2009 is a rogue antivirus. It is made by criminals in Russia. They’re trying to get your money by invading your computer. Their malware manufactures fake alerts about trojans and spyware right on your desktop. Eventually it’ll wreck your operating system. And if you actually buy this fraudulent product, the owners steal your credit card numbers. And then flood your computer with even more spyware and malware. It can be difficult to remove and hides deep in the coding of the operating system. Once removed, it tends to return.

So all you darling ducklings out there everywhere, never buy anything that creates ads or alerts right on your desktop. No legitimate company invades your desktop (nest-top) like that.

The creators of this destructive malware are generating many, many versions of their malware. This is to make it difficult for anti-spyware and anti-virus programs to catch, remove, or heal all the different variants. Elizabeth Rood of PC Tools says, “…last count, we have defined at least 22 variants of the program being offered. They (creators of Windows XP Antivirus 2008) update the program every week, however, so keeping up is tricky. I believe the changes in the program behavior are being randomized via an automated programming method.”

To get rid of this menace once and for all, this is what she and I recommend:
1. Instead of just Spyware Doctor, purchase Spyware Doctor with Antivirus.
2. Update Spyware Doctor with Antivirus and then run multiple scans.
3. After running one full scan, reboot in safe mode (Restart computer, tap F8 as computer starts up, choose Safe Mode.)
4. It typically takes more than one scan to remove it.

I found Spyware Doctor with Antivirus very effective against Windows XP Antivirus. If you just want to get rid of this terrible danger to you computer easily and prevent future dangers of all types, then get Spyware Doctor with Antivirus. It’ll remove Windows XP Antivirus now, at this instant. Click the small ad of Spyware Doctor below.

If you need help with the install, let me know, and I’ll help you via phone or remotely over the computer.

Call 403-483-0105.

Click here for my e-mail.

Ms. Ducktoes now has eat her words, and take back what she said about Grisoft’s free AVG 8 in her last blog. AVG has proved to be a real trooper (a State Trooper even or an RCMP Mountie!) against the criminal and fraudulent Ad Agent BN.

This week the malware has been extremely difficutl to get rid of. Ad Agent BN has been one of the worst.

Ad Agent BN was on a client’s computer, along with several other related Trojans. The client, a friendly twenty-something young man named Matt, had somehow gotten this rogue anti-spyware on his computer. At first the rogue program ran fake warning pop-ups on his desktop saying the computer had spyware. But much worse it then locked up the Matt’s Control Panel, Start menu, and Windows Explorer. Also Run and Search were not accessible.

Matt, a student, needed to turn in his assignments. They were not backed up. The computer was going down fast along with Matt’s marks. I took out the hard drive of his computer and connected it to another computer and ran Spy Sweeper, Avira, and Avast! on the mounted disk. They found several viruses and trojan horses. I also ran regedit by mounting the hive of the harddrive and deleted some infected keys. However when I reconnected the hard drive to Matt’s computer, the spyware and viruses were still there. And they were active!!

Ms. Ducktoes, now in a tizzy about Matt’s marks, not to mention his photos and music, had to do something more. Ducktoes to the rescue!

This is what worked. You can do it too:

1. Boot into Safe Mode with Networking. To do this: Restart the computer. Tap the the F8 key several times while the computer boots up. When you get to the screen with several booting options select Safe Mode with Networking.

2. After Windows starts, then download PC Tools Spyware Doctor, purchase, update it, and run the scan.

3. Restart the computer, let it boot into regular mode several times, restart it after each scan as Spyware Doctor recommends.

4. Boot back into Safe Mode with Networking. Download AVG free. Download AVG 8 free for home users.

5. AVG doesn’t update in Safe Mode. So restart the computer into regular mode. Update AVG. Now run Spyware Doctor. While Spyware Doctor is running the Avg Shields will kick into effect and remove the processes. Using the two programs together will get rid of the Ad Agent BN.

I know that the programs during install tell you that it’s not good to have two anti-viruses running at the same time but it worked!!

So I’m now using free AVG 8 again for all my clients.

Let me know–click the Comments link below– if this works for you.

Ms. Ducktoes, like most other computer techs, has always loved AVG by Grisoft. Grisoft has given free anti-virus to home users and, unlike most other free anti-virus applications, AVG Free included an automated update and scan that was reliable, efficient, and effective. AVG was too good to be true. Or to last. Other techs and I happily uninstalled scores of the bloated Norton and McCaffee programs and switched our clients to the free AVG. Our clients, now with much faster computers, were ecstatic. Yet on May 31, AVG 7.5 breathed its last breaths. We all had to switch to 8.0.

But the new AVG 8 has a few kinks. One, it doesn’t update or run automatically, at least not reliably, and, two, seems to be trying to be all things to all people and uses up too many resources. It’s going the way of Norton. I don’t blame Grisoft. They see Norton–a fat lazy slob of an anti-virus program–getting most of the business, cornering the market, and so they abandon their market niche of small but effective to go after the big bucks. In their shoes, I might do the same. Free don’t pay the bills, honey.

Also malware is getting bad–the spyware especially. Some really pernicious bugs are being downloaded from e-mail, so adding anti-spyware and an e-mail scanner might be considered a good idea. Yet still, a little education about e-mail and a separate anti-spyware, AVG’s anti-spy is not the best, and you’ll have to have another one anyway. I recommend Spyware Doctor, e-mail me to buy it) makes more sense than the toll AVG takes on speed. However, I do understand where they’re coming from.

Yet, even though I sympathize with Grisoft, many clients are calling me to fix their AVG. Somewhere in the updating process from 7.5 to 8.0, the clients get lost. The free version is hard to find, and they are worried it doesn’t give them enough protection. So I install it for them. But even so, it doesn’t seem to work well. My husband, who is conscientious computer user in that he habitually updates and runs all his anti-virus and anti-spyware, doesn’t have a problem. He just runs AVG manually. But many of my clients can’t seem to manage it. In fact, I’ve gotten several new clients from the switch to AVG 8.0.

Also the new AVG uses up a lot of resources. On my teenage son’s computer, the AVG processes use up more than 100,030 . That’s more than any other running process. AVG’s become a resource hog, just like Norton or McCaffee. On newer, more powerful computers, this may be fine, but on a lot of older, slower computers, it’s too much. So now I find myself uninstalling AVG and looking around for something else.

What I wish for is a free AVG that was like the old one, just anti-virus with a scheduler and automatic updater. But in the meantime I’m researching.

But use AVG 8.0 if you can. AVG’s not a problem for newer, larger computers, and it’s too risky to go without protection for the sake of speed.

Now Ms. Ducktoes wants you to be a get all your ducks in a row and make sure your anti-virus software is working, or if you’re too much of a newbie to understand or know what you’re doing yet, get a friend or co-worker to help you. And to train you. Or hire a techie to check it and train. Ignorance is not bliss when it comes to computers.

1. Make sure your anti-virus is downloading updates regularly and running scans automatically and that if it is a paid subscription, that you have paid on time. Don’t be without working anti-virus software for one nano-second. It is like tossing your computer out a second story window. The result’s not pretty. If you are fond of your computer or what is on it, take charge.

Also a reader of this blog who really knows his stuff has recommended Avira for an excellent anti-virus software. Here’s the link. I used it on a client’s computer and it worked well. It found and removed viruses and didn’t use up all the computer’s resources. That’s called having a small footprint. And it’s free for personal, home use. Don’t put it off. Here’s a link to his comments (you’ll have to scroll down).

2. Also use a different browser besides Internet Explorer. Use Firefox or Opera.

3. And after you have done all that, get anti-spyware too. Click here to see how to do that.

Anti-virus, anti-spyware, Firefox or Opera, and you’ve protected your computer, your wallet, your identity.

For more information click here.

For you techies among my readers, always make sure the client has working and up-to-date anti-virus and anti-spyware. Do this check as part of your routine. Tell them where they are amiss and install both if necessary. I recommend both manual anti-spyware such as Spybot and Ad-aware SE and one that runs in real time. Read the next post on this blog for more hints for techies.

As always Ducktoes to the rescue!! If you live in the Calgary area give us a shout or even if you don’t.

Ta ta for now.

I found a great site that checks files for viruses. If you have a file on your computer that you worry might be a virus. You can upload it here to be scanned by several (32, I think) different virus scanners. I checked out a file called “Good Karma” a friend, Joyce, received as an attachment. It was NOT a virus.

Ducktoes at your service.

If you want to speed up your computer, read my tips here.