# I seem to have a virus problem (yes, I have consulted the stickies) **URL:** \ **Category:** Factual Questions\ **Created:** [March 15, 2005, 9:34am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615 "2005-03-15T09:34:22Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![threemae](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@threemae](https://boards.straightdope.com/u/threemae)\ **Post date:** [March 15, 2005, 9:34am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/1 "2005-03-15T09:34:22Z")
Okay, after some drama with getting a new HD up and running, which obviously eventually worked, I’ve been using FireFox exclusively and I’ve still ended up with an apparent virus. Bsically, my computer got extremely slow earlier this evening, and restarts have done nothing to stop this gradual slowing after each restart. Of cours I Ctrl-Alt-Deleted to find out what was hogging all the resources and then I discovered that the Ctrl-Alt-Delete window would pop up for just a moment and then something would shut it down. I tried to go to Grisoft to download AVG, but the whole Grisoft domain returned a suspicious “DNS Error” or something when I tried. Anyway, I’ve managed to find a mirror for the AVG Free version, and have downloaded and run it, but the problem still remains. The AVG software didn’t find any infections although my computer continues to lag, the windows I could use to fix this mysteriously shut down, and I can’t even go into AVG through the regular shortcut because it gets shut down by something so I just right-click on the task-bar thing. Also, some small, seemingly randomly named .exe’s are piling up in my c:\ drive, and I’m not sure where to go from here. ---
**Author:** ![Astroboy14](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@Astroboy14](https://boards.straightdope.com/u/Astroboy14)\ **Post date:** [March 15, 2005, 9:40am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/2 "2005-03-15T09:40:06Z")
Could you give us some information about the computer, please? Without knowing more about it, it’s hard to make any guesses… what flavor of windows, for example? 🙂 ---
**Author:** ![threemae](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@threemae](https://boards.straightdope.com/u/threemae)\ **Post date:** [March 15, 2005, 9:45am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/3 "2005-03-15T09:45:36Z")
Oh, sorry, it’s an HP Laptop running Windows XP Home. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [March 15, 2005, 10:13am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/4 "2005-03-15T10:13:08Z")
You can try an online virus scanner like [HouseCall](http://housecall.trendmicro.com/) if you haven’t done so already. Also, there’s a DOS-based Task Manager that you could try: [ol] [li]Go to Start → Run and type in **cmd** then push enter.[/li][li]Once the black DOS window opens, type in **tasklist /fi “CPUTIME gt 00:10:00”**. Anything that’s listed should be what’s using up your CPU power (be sure you’re not running any other apps at the moment).[/li][li]Hopefully, you’ll find more than just the “System Idle Process” in there. If so, it could be the virus. Look for a number under the “PID” column, and then type **taskkill /pid (number you just found)**. With any luck, that might close the virus and let you run other things easier. Sorry, that’s not a guarantee ☹ Viruses could work in a million different ways…[/li][/ol] Beyond that, try using a site like [Anonymouse](http://anonymouse.org/anonwww.html) to search for and download other anti-virus programs. Depending on how the virus was written, it may or may not block sites accessed in this way. If that still doesn’t work, see if you can clear out your “hosts” file: Go to Start -\> Run again. Type in **notepad “%windir%\system32\drivers\etc\hosts”**. See if any of the inaccessible websites are listed in that file, and if so, remove them and save the file. I don’t know if any of these will work, sorry. You could also try and plug the hard drive into another computer (with virus protection already installed) and scan it from there, but that requires knowledge of computer hardware and (of course) another computer. Good luck… I hope somebody else has a better solution. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [March 15, 2005, 1:16pm UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/5 "2005-03-15T13:16:51Z")
It sounds more like spyware, not a virus. If the task manager won’t run, try downloading [taskkill](http://www.siena.edu/antivirus/viruses/spybotworm.asp). It should bypass the process that’s killing the task manager, and let you see what’s running. It would also be worthwhile to install and run [Microsoft Antispyware](http://www.microsoft.com/athome/security/spyware/software/default.mspx). You may have to run it in safe mode to clear out the infection. If all else fails, get [hijackthis](http://www.siena.edu/antivirus/Spyware/hijackthis.asp) and e-mail me the log. ---
**Author:** ![threemae](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@threemae](https://boards.straightdope.com/u/threemae)\ **Post date:** [March 16, 2005, 6:18am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/6 "2005-03-16T06:18:39Z")
> [@RealityChuck](#): > > It sounds more like spyware, not a virus. > > If the task manager won’t run, try downloading [taskkill](http://www.siena.edu/antivirus/viruses/spybotworm.asp). It should bypass the process that’s killing the task manager, and let you see what’s running. > > It would also be worthwhile to install and run [Microsoft Antispyware](http://www.microsoft.com/athome/security/spyware/software/default.mspx). You may have to run it in safe mode to clear out the infection. > > If all else fails, get [hijackthis](http://www.siena.edu/antivirus/Spyware/hijackthis.asp) and e-mail me the log. Okay, I’ve gone through the recommended steps. First off, I’ve downloaded Taskkill, and I’ve got the following processes running: smss.exe csrss.exe winlogin.exe services.exe lsass.exe ati2evxx.exe svchost.exe (times 4) spoolsv.exe explorer.ede avgamsvr.exe avgupsvc.exe wdfmgr.exe gcasServe.exe jusched.exe Directcd.exe gcasDtServ.exe qttask.exe Ms64.exe avgcc.exe avgemc.exe compaq.exe reader\_sl.exe firefox.exe Finally, the most suspicious one is something called: RegstryManage.exe. Curiously, when I try to end that process, it says “Access is Denied.” Also, when I try to open up HijackThis, the same thing as the task manager happens, it opens up for an instant and then another process kills it. I’ve run the Microsoft Antispyware and the AVG Antivirus with brand new updates and nothing has come up except for AVG which found this: In my My Documents directory someting like msdirectx.sys, which of course I told it to delete, but then when I restarted nothing was fixed and the same file popped up again. Where should I go from here? Thanks again for all of your help. ---
**Author:** ![aenplusone](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@aenplusone](https://boards.straightdope.com/u/aenplusone)\ **Post date:** [March 16, 2005, 6:51am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/7 "2005-03-16T06:51:56Z")
Well, I hate to be negative but if up to date antivirii don’t work and antispyware utilities don’t work, you’re out of luck. I googled for that suspicious executable and nothing turned up. Seems a Backup/format is needed… ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [March 16, 2005, 6:55am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/8 "2005-03-16T06:55:13Z")
MS64.exe sounds suspicous. See if ending that allows you to run the other programs. You may want to try Microsoft’s [Malicious Software Removal Tool](http://www.microsoft.com/security/malwareremove/default.mspx). If that doesn’t work, did you try the online HouseCall thing? ---
**Author:** ![Ficer67](https://avatars.discourse-cdn.com/v4/letter/f/c57346/32.png) [@Ficer67](https://boards.straightdope.com/u/Ficer67)\ **Post date:** [March 16, 2005, 9:44am UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/9 "2005-03-16T09:44:21Z")
Sometimes you just have to reformat. Disconnect your computer from the internet and reformat. Make sure that you can install your antivirus, and antispyware utilities while disconnected from the internet. Then, make a pristine backup of your entire hard drive. Then if you ever have this problem again, you will be able to restore your system to its pristine condition quickly. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [March 16, 2005, 1:32pm UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/10 "2005-03-16T13:32:04Z")
There rarely any need to reformat a hard drive for a virus. It’s just a shortcut that eliminates the need to diagnose, but takes longer, is more work, and is more likely to mess up data. I’ve never found a spyware infected computer where it was necessary, and it’s only necessary for viruses like Michaelangelo that trash your hard drive anyway. It sounds like you have a variant of CoolWebSearch, with the CWS Smartkiller, which prevents you from getting to antivirus sites and closes down programs. Download the [Smartkiller cleaning to](http://www.siena.edu/antivirus/spyware/cws.asp)ol (the first download on the site) and fix it. Once this is fixed, hijackthis should run. You should also be able to download programs like Microsoft Antispyware that can deal with CWS. I agree that RegstryManage.exe is probably spyware: the name does not show up anywhere on a Google search, a solid indication of spyware/viruses. MS64.exe also seems to be a virus. But you need to clean up CWS first. ---
**Author:** ![threemae](https://avatars.discourse-cdn.com/v4/letter/t/5f9b8f/32.png) [@threemae](https://boards.straightdope.com/u/threemae)\ **Post date:** [March 16, 2005, 8:11pm UTC](https://boards.straightdope.com/t/i-seem-to-have-a-virus-problem-yes-i-have-consulted-the-stickies/294615/11 "2005-03-16T20:11:00Z")
Okay thanks, I’ll get right on this and report back. I really appreciate your help; hopefully I can avoid a reformat. Thanks again.