Endpoint Protection

 View Only

Virus Removal 

Nov 24, 2009 04:46 AM

 
*****ITS IS HIGHLY RECOMMNEDED TO INSTALL AN ANTIVIRUS PRGORAM ON A COMPUTER PREFERABLY SEP /SAV *****


*****DO NOT TRY TO UNINSTALL /UPGRADE AN ANTIVIRUS PROGRAM IN CASE OF A VIRUS OUT BREAK****






When a virus/threat attacks a computer it can impact the system in many ways then one, They can either be minimal for example   create annoying pop ups or message , or misdirect to other sites ect. But some may do a bigger damage to the system. They  may delete files needed for an application to work or perform vital operating system tasks. Some may open ports on the machine and make the system vulnerable. They may also get necessary information from the system and may pass them over to the hackers.


The best way to deal with them is install an AV program and make sure it is updated on a daily basis. Because prevention is always better then cure.
There could a scenario where there is no AV program installed or we are not able to install one or the threat might have corrupted the Antivirus program itself. Neither we are able to run any removal tool. In that case either we have to map the drive to a different computer and then scan  it   or try to remove  the virus/threat manually.




Going with the manual removal is the last resort what you need to follow. If there is no way out then go with the manual removal.




1.The first important  thing  that you need to do is be calm and don’t  panic as there could be a possibility that the  you may not even been infected.


2. Disconnect the machine from the network so that other machines are not infected by the infected machine.


3. Open the Task manger and look for unfamiliar process that are running try to find information about them , if you do not get any information then kill the process


4. Do the same thing in add remove program , Uninstall any application and delete the related files if you are not able to identify the  program.


This will help to unhook the registry.

Take the backup of the registry .Now look for the .exe that you have terminated from the Task manger , if you find any instance of that then delete that key.
 

 
6. Delete all Temporary Internet files from the browser .


7.Nvigate to
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Browser Helper Objects   and delete all subfolders and then reboot the machine.

 
8. If there is an access  to the Internet,  run an online scan  from http://security.symantec.com/sscv6/WelcomePage.asp


9.Try to  run other  programs , application  and operating system functions just to confirm that it is just one component that has failed or become corrupted.


10.If the system is not working at all, try booting the computer using the installation disk or CD. Or try to boot the machine using  bootable backup disks or CD's that you have. Scan the system ( if the Antivirus Program is functional ) after booting from disk or CD and look for any virus or infected files.


11. If that also does not work then try to  the  boot option: Last Known Good Configuration.



12. In  Windows, check for the presence and dates of key operating system files. Although that list is too long to show here, you can search Microsoft's web site for 'Operating System files'. Alternatively, make a list from the Windows directory and the System or System32 sub-directory, of another computer. Provided that both computers are running the same service pack level, the majority if not all dates should match other files.




13. Check specifically kernel32.exe and lsass.exe. as hackers love to go for those two. If you find one with a different date, treat it as suspect. Replace those files with known good ones, if needed.




If you are able to remove the threat from the computer then Install SEP / SAV and then run a full scan in safe mode.




If you are not able to install the program , download the Norton Security Scan and then Run a  Scan.






Last if nothing is working and if you have a backup of the data then rather then wasting time in trying to fix the system .Format the machine. But before Formatting the machine run the LoadPoint Diagnostic Tool and submit the suspected files to the Symantec security Response.

Statistics
0 Favorited
0 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Comments

Oct 25, 2010 11:10 AM

Hello Suvin,

I am very sorry to hear that you have had a bad experience with Symantec. I am not a Norton support person, but I would like to try and help you out. Could you please PM me your contact information?  I will see if I can get your issue escalated up to someone that can help resolve this.

 

Best,

Thomas

Oct 25, 2010 12:48 AM

Complaint about Symantec’s  Norton Live  online tech support…or lack thereof!!!

 

If this posting can help anyone else, I will have to be content with that. DO NOT USE ANY OF THE NORTON LIVE SERVICES! They took my $$$, guaranteed results or a refund, failed to resolve the issues for which they were hired, and denied my right to a refund.

I just finished dealings with the Norton Live “Customer Relations” dept. which ended with me hanging up on their ever apologizing drones. The cause for my abrupt ending of correspondence was their stubborn insistence on telling me that they would not refund my money.     For a detailed account, read below.

The order of events is as follows:
I contacted them initially, on the recommendation of a tech that has been helpful in the past. He, having heard the description of my issue, suggested that Norton might provide a downloadable disc from which I could scan my computer and solve my problem(s). I could not get my computer into “Safe Mode”. This, he said, was a classic symptom of something viral.    Upon contacting Norton Live, they proceeded to steer me towards a service they provided remotely which would; update my version of their anti-virus software, give me some sort of “PC Power Boost” (portrayed as something that would increase the speed of my computer), and rid my computer of suspected viruses and diagnose and / or deal with whatever issues to ensure that my computer would be running smoothly. It should be pointed out that my record would clearly have shown that I have been a customer of Norton for years and have purchased their software to keep these infections from happening in the first place. You would think that, if a new version of software that you have purchased became available during your subscription period, you would be provided with that version during your regular updates. Apparently, this was not the case.  I am typically very skeptical about remote fix boasts and, therefore, questioned two representatives at length to ensure that any tech who might work on my computer had the training and up to the minute knowledge of virus issues, etc. faced by systems like mine. Only after multiple guarantees (one of which was the promise of a detailed list of exactly what was done to fix the problems), did I provide my payment info. This was on Fri. 10-15-2010.

That’s when the “fun” started. Their “trained tech”, and I use the phrase verrrry loosely, did his work, didn’t provide the agreed upon list of actions taken and didn’t resolve any of the issues with which I had been dealing. It gets even better. I called within one business day to say that the issues were unresolved and to demand my money back…$159, by the way. They stalled and misled and misrepresented. They answered different questions with the same repetitive responses, simply placing the words in different order, as though repeating something often enough will make it true or brow beat you into submission. Also, without intending any offense, not one of the staff had an ”as a first language” grasp of English. I mention this only because it complicated the communication efforts at both ends of the phone. Clearly, this concept is not racist in that it applies equally to any situation in which an English speaker would attempt to provide customer support for citizens of a country mostly using a language in which he had only limited fluency. Outsourcing may be humorous fodder for sitcoms, but it has become a constant frustration for those seeking basic customer service by phone. I was on the phone with nine separate representatives from two departments for over three hours. After their unrelenting insistence that they could completely solve all issues with another chance to remotely diagnose and work on the problems (and that, if they could not, I would indeed receive a refund), I, exhausted by the lengthy argument, decided to let them try. Two separate techs did their work. Again, they didn’t provide the requested list of actions taken, they promised that everything was resolved and, you guessed it, they didn’t solve anything.  I still couldn’t access the “Safe Mode” of my computer. I have all the problems I had initially. And now, when I attempt to shut down my computer, I have seven programs worth of “End Now” windows opening (some saying they are non-responsive) and needing to be shut down before the computer can shut down. Apparently, these programs have begun running amok in the background. I have checked the origins of these programs and can say that the browser program among them was never even opened by me. I use another browser. If anything, my problems have only multiplied since dealing with this awful online service.

I called on 10-21-2010 to again demand my money back and was placed on hold for almost 40 min.  I had previously never waited more than a few min. to speak to anyone in any dept. I hung up and called again and was told that they were “experiencing an unusually large volume of calls”. I suspect that the wait was simply because the profile of my case number showed that I was attempting to get a refund. The representative wanted to take my phone number and asked if it was OK for someone to get back to me within…wait for it…24 to 48 hrs.  They must be trying to take over the record for ridiculously imposed waits currently held by the clichéd wait for the cable guy. Finding this totally unacceptable, I suggested that someone call me at 2:00 PM on 10-22-2010. They “couldn’t guarantee” anything like that.

I called them again on 10-22-2010 to press my case and get my money refunded. I was shuffled to two more of their representatives who repeatedly told me, among other things, that the $159 charge was a “one time consultation fee”, a phrase I do not recall being used during the initial contact… when they were trying to sell the service. Finally, I was transferred to the man in the customer relations dept. who had guaranteed to refund my money, if the second fix attempt did not work. He began stalling and rewriting the history and terminology of the entire transaction and even tried to offer a one yr. extension of my anti-virus software subscription. First, that is nowhere near the value of the $159 I had paid. And second, and far more importantly, who, given the details of the story above, would think that a customer as frustrated as I was would have the slightest interest in receiving more of anything from a business in which that customer has absolutely no faith.

I have had some very poor customer service throughout the years, but Norton Live now ranks as the very worst I have ever experienced! Before this, I have never posted to any blogs or forums.

If you have already entered into a transaction with Norton Live and there is time to reasonably do so, document as much of the transaction as possible, contact your credit card company and dispute the charges immediately. You will doubtless have better luck with your own credit card company than with anyone at this particular online service’s customer relations dept.       Good luck.

Sep 12, 2010 03:23 PM

Hi Every one,

      I think the best way to remove viruses would be in safe mode with networking.  You know why ? Because in safe mode with networking, your computer would be 80% safe . The remaining 20% depends on how bad the threat is!

In Safe Mode With Networking, you would be able to access internet from the infected computer, if you are using a hard wired internet connection. This help you to get sufficient informations on how to remove the threats from Internet.

As Prachand said, please take a back up of the registry before doing anything on the computer.

 

After that open the system configuration utility , follow the command : START--> RUN--> type in command "msconfig" without quotes -- click on "start up" on top right corner --> uncheck all the entries. 

If any unfamiliar entries are identified, please take a note of it . Most probably it would start with some suspicious entries with some meaningless words (aplha-numneric) or start with the name of some security softwares(unknown).

 

Then the next step is to clear the temp files.

Follow the steps:

START--> RUN--> type in command "temp" without quotes--> ENTER--> Delete all the files in temp folder.

START--> RUN--> type in command "%temp%" without quotes--> ENTER--> Delete all the files in %temp% folder.

START--> RUN--> type in command "Prefetch" without quotes--> ENTER--> Delete all the files in Prefetch folder.

START--> RUN--> type in command "Recent" without quotes--> ENTER--> Delete all the files in Recent folder.

 

Then the next step is to clear the Internet explorer settings:

Follow the steps:

START--> RUN--> type in command "intecpl.cpl" without quotes--> ENTER-->click on the "Advanced" tab on top right corner and click on "Reset" on the right bottom of that window.

Also check whether there is any proxy set by the malware or Spyware to make your computer more and more infected .

To check proxy follow the below steps:

START--> RUN--> type in command "intecpl.cpl" without quotes--> ENTER-->click on the "Connections" tab on top--> click on "Lan Settings"--> a new window will pop up, you can see four boxes over there , please uncheck all the boxes . If it is already unchecked, please leave it as such .

Then check for DNS poisoning:

To check DNS poisoning follow the below steps:

 

START--> RUN--> type in command "ncpa.cpl" without quotes--> From the network connections window, please highlight the active network used to access internet, then press the two keyboard keys (ALT+ENTER) simultaneously, you will get a properties windows, please scroll down and select the option TCP/IP then click on properties . Please check whether the DNS is set to obtain automatically or whether the values are entered manually .  If it is entered manually, please delete that and select the option" obtain DNS server address automatically "

 

Also you can use command prompt to flush the DNS settings, please open CMD and then use the command ipconfig/flushdns

start --> run--> cmd--> ipconfig/flushdns

Some spywares may affect the winsock part, so it would be better to reset the winsock but there is a chance that some programs might not work correctly after reseting the winsock catalog, nevermind if the situation demands, you can reset the wincosk catalog.

 

To reset the winsock catalog please use the below command in CMD .

start --> run--> cmd--> netsh winsock reset

I am tired, please post a message here if you need further help.....

Jan 26, 2010 10:17 AM

Hello,

Nice! A few sceenshots will be nice.

Best regards,
Wah

Related Entries and Links

No Related Resource entered.