Expert: Lorry - 6/28/2005

Question
Hello Lorry! Thank you for your help. However, my real problem is I don't know how to gain access to my internet-or desktop for that matter! As soon as I turn on my computer and enter the password,the desktop appears but the hour glass won't go away. I can't click on anything, so I can't go to any website to download any programs from my computer. I already have McGaffey Virus and Adware protection installed on the machine (for the past 6 months) and the virus somehow bypassed the protection and took over. Before it completely locked me out of Windows, I ran a scan and about 20 threats were identified. All but two were cleaned or deleted. What can I do to get access to my computer again? It says it won't function in regular mode. Should I try to switch to safe mode? If so, please explain how.
Thank you again. I would appreciate help getting back to my desktop.
Jeremy
-------------------------
Followup To
Question -
I use the Windows ME operating system. A virus is keeping me from accessing Windows Explorer. The background of my screen warns of a Virus infection and recommends using any Adware or virus removal software to fix the problem. I can see the Explorer screen and all of the icons and menus, but the hourglass dosen't go away and multiple programs are now running on my machine making my availabele resources low. How can I rid my computer of this virus?
Answer -
Hi Jeremy,

Go to: http://sarc.com/  Scroll down and click on,"Free Online Virus and Security Check"  Write down exactly anything it finds, then return to: http://sarc.com/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually.

Download Ad-AwareŽ SE Personal Edition, a free program that you can download at:

http://www.lavasoftusa.com/support/download/

Check for updates before running program. Then follow the directions here to do a full scan:

1. In the 'General' window make sure the following are selected with a checkmark and are green:

ˇ Automatically save log-file
ˇ Automatically quarantine objects prior to removal
ˇ Safe Mode (always request confirmation)

2. Click on the 'Scanning' button on the left and select :

ˇ Scan Within Archives
ˇ Scan Active Processes
ˇ Scan Registry
ˇ Deep Scan Registry
ˇ Scan my IE favorites for banned URL's
ˇ Scan my Hosts file
ˇ Under 'Click here to select drives + folders, choose: All of your hard drives.

3. Click on the 'Advanced' button on the left and select:

ˇ Include additional file information
ˇ Include additional object details
ˇ Include environment information

4. Click the 'Tweak' button and select:

Under the 'Scanning Engine' be sure a checkmark is beside:

ˇ Unload recognized processes & modules during scanning
ˇ Scan registry for all users instead of current user only
ˇ Obtain command line of scanned processes

Under the 'Cleaning Engine' be sure a checkmark is beside:

ˇ Automatically try to unregister objects prior to deletion
ˇ Let Windows remove files in use at next reboot
ˇ Always try to unload modules before deletion
ˇ During removal, unload explorer and IE if necessary
ˇ Delete quarantined objects after restoring

5. Click on 'Safety Settings' and select "Write-protect system files after repair (Hosts file, etc)"

6. Click on 'Proceed' to save the settings.

7. Click 'Start' and on the next screen choose 'Activate in-depth Scan' at the bottom of the page and then choose:

ˇ Perform full system scan

8. Close all programs except Ad-Aware.

Click on "Next" in the bottom right corner to start the scan.

Run the Ad-Aware scan and allow it to remove everything it finds and then REBOOT - Even if not prompted.

After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.

When you first open Ad-aware, click "Check for updates now", click Connect, if there any updates available - get them, when done click Next or Finish.

Now click Start, Next and let it run.

When it is done scanning, you will see the Scanning results window, check all of the boxes, then click Next.

The next window will say "X" number of objects will be removed - click OK.

Anything that is removed is quarantined, making the computer safe.

I would suggest installing an antivirus program ASAP, update it once a week and then run a virus scan afterwards.

Hope this helps!
Lorry

Answer
Hi Jeremy,

To start Windows in Safe Mode, when the computer first starts, keep tapping the "F8" key until you get a windows with various ways to start Windows, using the arrow keys, navigate to Safe Mode(usually #3)and highlight it, now hit the Enter key. Windows will show a dialog box stating it's starting in Safe Mode, click OK.

Once in Safe Mode, run a virus scan using McAfee. Whatever viruses that cannot be repaired, let me know what they are and we'll take it from there.

McAfee is up to date, correct? Hope so! Regarding Ad-aware SE, download it, copy the download onto a CD, now use that CD to install on your computer, run it in Safe Mode.

Hope this helps!
Lorry