Virus Alert

[bigk181]

I keep getting a virus on my computer. The name is the same but sometimes the extension is different. Sometimes there are multiple viruses of this nature. The last time I scanned my computer, it found 5 viruses and then it stopped scanning when it got to a system file. The time elapsed was still running but it wouldn't scan any further.

Another problem is that my browser crashes whenever I try to access my AOL mail. This only happens in Firefox and never in IE. I mainly use Firefox because IE has become a little slow.

I ran Spybot and it found some trojans and I deleted them. I use ZoneAlarm Internet Security Suite as well. It has a firewall, antivirus, and antispyware. I used to use Norton Antivirus but the new versions kept crashing. I like ZoneAlarm, it's quite effective.

One of the names I've seen this virus have is Trojan-GameThief.Win32.Magania.bfre. I've looked this up on the Internet for a solution but the only solutions I'm finding are to download a special program for it. There are so many different programs being suggested that I don't know what to trust.

Has anyone else had this problem. I want to find out where these viruses are coming from and how I can stop them from infecting my computer.

Here's a website that lists several different extensions of this virus that have been detected.

http://www.kaspersky.com/viruswatchl...hour_offset=-8

[lordsmurf]

Try SuperAntiSpyware to remove the junk.

The term "virus" is pretty much obsolete now. These days, consider anything bad to be "malware" (malicious software). Anti-virus tools can only handle "virus-like" malware, so those are become more and more useless as time goes on. Indeed, spyware, rootkits, trojans and other non-virus type pests seem to now be more common.

[bigk181]

I will try it but removing the malware is not really the problem. Spybot and ZoneAlarm remove them just fine. I want to stop them from infecting my computer in the first place.

[lordsmurf]

I run Spybot S&D "teatimer" with immunize.
Also WinPatrol.
Both of these freeware prevent software from self-installing or changing the registry.

Another good idea is a firewall. Not that comes-with-Windows junk, but one from somebody like Kerio (what I use on my main machine). Only approved software is allowed to use net access.

[bigk181]

As I said before, I use ZoneAlarm which has a firewall, antivirus, and antispyware. I'm happy with it's performance. I also run Spybot S&D "teatimer" but I've never used immunize. Someone told me years ago that immunize will screw up the computer. I don't know how that could happen. I'm going to give it a try.

[lordsmurf]

Yeah, that sounds like BS to me. Immunize is fine.

It sounds like you're trying to keep a clean system. No idea why it got infected with junk. Maybe somebody else uses it, or maybe you disabled some of that stuff one time? No idea, just guessing.

[bigk181]

That guy didn't explain why he thought that immunizing would screw up the computer, so it doesn't make any sense to me. I immunized earlier and everything is fine. I hope that prevents the malware I've been getting from infecting my computer again. I'm going to run some scans again now that I've immunized my computer.

I'm the only one that uses this computer. I haven't changed any settings or disabled anything lately. I was just hoping somebody may have heard of Trojan-GameThief.Win32.Magania.bfre and know what to do to stop it. My AOL mail still crashes the browser in Firefox.

[Tranzor]

It could be a few things you did not check or do yet. Let me explain my not too long ago problem as it may help you in a way;

I was doing something I shouldn't have been and sure enough virtumundo and a few friends paid a visit. It really fu*ked my comp and I thought I was going to have to reformat.

I have spybot, but also put on superantispyware and malwarebytes (via laptop before these trojans stopped that hookup)
At the virus infection date, I was still running norton antivirus 2005. I knew I finally had to upgrade and ran out to pick up norton 2009(antivirus only)

This virus had few goodies running and it hijacked the desktop, disabled any usbs, completely screwed with the registry, disabled system restore, disabled taskbar and a few other things. My firewall blocked a few things, but doing a control,alt,delete button push, I saw some processes I did not regonize and knew should not be running.Ii was able to stop them temporarily

however I was able to get anitspyware and malwarebytres and spybot updated and running before it added some of the damage above (and of course I did not stay online after that). In my case ALL THREE OF THEM found different items MULTIPLE TIMES when I thought I was finally clean. I eventually got enough under control so the pc would allow me to put on norton (yep that was blocked too). And norton kept finding more. I ran CCleaner and had it fix the regisrty. I also ran regmechanic.

What helped me out a lot was that I had backed up my reg a few days prior because I did a reg cleaning.

All in all about 16 hours later everything finally was wiped out and whatever ccleaner and regmechainc did it restored my desktop and some other reg changes.

I am using this as an example because you probably had some reg changes from this virus or even may still have parts of it running you are unaware of and this is why they keep showing up

do the following
download and run ccleaner (it is free) also use it's reg fix option
use spybot, superantispyware and malwarebytes (all free) update them, sign offline and have them scan

Cannot comment on zone alarm's antivirus, but you might want to try avg, norton or klasperky (who I spelled wrong)

ONCE you get your system under control and all seems well:
ERASE your system restore points because whatever you had still exist in them.

If you are using the same pc to go online that was infected, each time you go online, the virus can be contacting somewhere or to someone who is trying to hack your system and opened up something (probably from a reg tweak) and is coming right in. Try to stay offline until you get things cleared up

also check here:
C:\Documents and Settings
and see if it list a folder name for someone you do not know and if so delete it. In my case it added a user name called "the mask"

[wayshway]

The Evil virtumundo. I was attacked by that once upon a time.

[lordsmurf]

Disabling auto-play is another good suggestion. USB thumb-drive viruses are a major pest right now.

[Tranzor]

I was fortunate enough to catch mine quick. When I was testing something and while it installed (I am always offline for these things) it tried to contact a porn video site so someone modded something and bundled it all up nicely

the reg changes were my biggest concern

[bigk181]

I used to use RegScrubXP and eventually my computer would restart on it's own several times. A computer tech guy said that I shouldn't use any programs that mess with the registry. I ended up having to format later on for a different reason and I haven't had that problem since. I think that RegScrubXP screwed up the registry and that's why my computer would restart on it's own. Now I'm wary of registry cleaners.

I would rather not have to mess with several different spyware and malware programs because that would just take more time to scan my computer but I may have to. I ran spyware and antivirus scans today and spybot didn't find any of the extra trojans that showed up before. That pesky Trojan-GameThief virus showed up again on the virus scan.

I don't know how to erase my system restore points.

[Tranzor]

I use to use spybot with adware. However from a post on videohelp.com, adaware is no longer supporting the free version. Of the two page post, literally every poster mentioned superantispyware (SAS) and malware bytes

when my issue hit, I already had adaware gone and just spybot running alone. Spybot found a few but that was it. SAS and malwarebytes both found a number of them (included an attempted root kit that came with the attack) and got rid of everything that spybot did not find. Really it was between those 3 that I was even capable of taking back my pc. I strongly recommend using SAS and malwarebytes along with spytbot. All three can co-exist fine. Also when you run scans do NOT do a smart scan and instead have them run a full scan so it does every file.

who gives a damn if a scan takes 6 hours? Would you rather have a long scan or knowing that backdoors keep showing up all the time?

some reg fixers are very good (regmechanic being one of the top). CCleaner will ask you if you want to make a backup of your reg first.

I am surprised you did not do this when you mentioned you were using regscrubXP. Most of those programs will make a back up so if you do have a problem you can restore your registry

if you feel safe in erasing your previous system restore points do this:
on your desktop, right click on the "my computer" shortcut and select properties. Select the system restore tab and you will see a box saying "turn off system restore". If you check it, it will erase any restore point so be aware of that before doing anything. Once done, restart, go back to the same place and uncheck the box to turn it back on.

The problem is that since you probably still have some form of the trojan on your pc, doing that will fix nothing becasue your newer restore point will have the virus back in it

[bigk181]

OK. I will give those programs a try and see what happens.

[bigk181]

I ran a full system scan with SUPERAntiSpyware, Malwarebytes, CCleaner, Spybot, and ZoneAlarm Internet Security Suite on my C drive, both external drives, and my thumb drive. I also erased my previous system restore points after all the scans were done and I made sure to turn system restore back on when I was done with that. During the SAS and MB scans, the ZoneAlarm antivirus came up a couple times with several infections of that pesky Trojan-GameThief virus. I must have deleted at least 10 of them from the quarantine. I ended up deleting a bunch of junk and a few trojans after some scans. I ran Spybot then ZoneAlarm last and no problems or infections were detected. I will take that as a good sign that the problem is gone.

It took all day because I did a full system scan with all the programs, whenever possible, instead of a quick scan but it was worth it. SAS alone took over 3 hours. However, it seems like the virus problem is gone.

I still have another problem, though. This problem started after the viruses starting showing up, so I suspect that they had something to do with this. When I double-click on the C drive, it doesn't open like it should. Instead, it gives me an "Open With" window asking me what program I want to use to open it. It's irritating because it's a disk drive, not a file. I can't figure out how to fix this problem. Can anybody help me with this?

I used to be unable to display hidden files and folders after I started getting the viruses but that works fine now after I deleted all the other junk with these programs.

Running all these scans took a long time but I was able to finish copying some sets that I owed and make some good progress on Metal Gear Solid: Portable Ops.

[lordsmurf]

It's also good to use CCleaner to go through the system and uninstall any unnecessary software. Less places for virus/malware to hide, that way.

[bigk181]

Great! So what about my C drive problem? Any suggestions?

[bigk181]

Now that my virus problem is resolved, you can enjoy this. I was going to embed the video but embedding has been disabled for this video.

http://www.youtube.com/watch?v=k-GaRKDsz-Y

[Tranzor]

use ccleaner and use its reg fix option. It will ask you if you want to make a backup first so let it (say yes). It was from the reg fixers that I was even able to take back my desktop which the virus took away.

as for your c drive problem I found this that may help you:
http://wiki.answers.com/Q/When_you_d...y_double_click

[bigk181]

Thanks for the advice, Tranzor but the problem has been fixed.