Quadricore, 8GB of RAM. Still 278GB of free space on my HD. Resources aren’t a problem.
Software: Windows 7 (64)
Antivirus: Microsoft security essentials.
Yesterday, I get a warning that there are trojans in my windows/temp folder. I run my antivirus for a quick scan over the whole computer and a custom scan over my temp folder.
Today, I start the computer. At first, programs are about as fast as they usually are. After a few minutes, everythin seems to freeze for long periods.
I get warnings that Windows has stopped responding. Microsoft security essentials has scanned 4 items in the last 40 minutes. Openingg the “Computer” folder is taking several minutes. Opening a normal sized picture takes several minutes. I cannot ctrl+alt+delete because it cuts to a black screen and then tells me if can’t get to that screen.
Try booting into Safe Mode and see if that makes a difference. If it does, run a complete scan (possibly with more than one program.)
If the scan comes up clean, make a list of the active tasks in Safe Mode vs. normal mode. You might have a hidden resource hog–sometimes they’ll chew up CPU but not RAM.
I don’t seem to be able to run it in any kind of safe mode. I can clearly see in the boot up screen that it’s giving me the option to boot up normally, in safe mode, in safe mode+ network in safe mode + something else. It tells me I only have to use the arrow keys but the arrow keys (and the numbers keypad) do nothing.
I have installed the updates, including one that concerned Microsoft security essentials.
You know those viruses I have that cause my programs to be “(Not Responding)”.
You know the antivirus software I’m using right now (Malwarebytes) to get rid of those viruses?
The viruses are causing Malwarebytes to be “(Not Responding)”.
Huh? The keyboard is clearly working as you have to hit F8 to get that menu. Try turning Num Lock off. Or are you using a laptop? In which case you may need to use Fn+some other key.
Open Task Manager (right click on time in lower right corner).
Select the processes tab, show processes from all users.
Click on the “CPU” tab to sort by CPU%, see which processes are chewing up the most CPU time.
Google that process. Do NOT kill any process you do not know what it is for.
If you hava runaway process (performance tab - 100% CPU) then something is wrong.
If you are not getting 100% CPU, then maybe it’s disk thrashing. There’s a whole art in looking for processes that chew up a lot of disk I/O, but the other thing is to see if you are running out of memory. (Seriously, if you have Win 7 and 8GB RAM, it’s not that unless you installed some seriously weird program!)
Try turning off antivirus - often, an AV will chug away testing everything your processes open and meanwhile scanning your disk. If it happens when you turn on the PC, try leaving it on all night. Maybe the AV schedules a full body scan for 3AM, so it starts it when you tunr it on because it’s past schedule.
(Only turn off AV as an experiment, not permanently!!!)
Or, do you accidentally have 2 AV’s working? They will work at cross purposes, each one insisting it scan a file before the other is allowed to look at it. (Control Panel tells you what programs are installed).
I get to that menu without pressing F8.
Thanks to everyone who helped. It seems to have worked. I had to do hard reboots but eventually, I got to the safe mode by using msconfig to restart in safe mode. Then I use malwarebytes. MB found more than 4000 viruses/trojans/etc.
Then I had both the updated Microsoft security essentials and Malwarebytes do full scans on my computer.
A question to prevent further such occasions:
It seems the problem is that some important Windows updates did not automatically download and install. How come some security updates automatically download and install and some don’t? Is the only way not to miss them to manually check everyday for windows updates?
Set your machine to update automatically, check every day at about 03:00, and leave it on overnight.
Also make sure Java, Flash, Internet Explorer (even if you don’t use it, other apps can use its DLLs) and Acrobat Reader are up to date. Set them - and anything else that has an auto-update facility - to automatically update if possible.
I have to say, given the number of virus that has been reported, I would be surprised if you have got them all.
Suggest that you also use Spybot as well.Make sure every program you have it up to the latest update.
Once you are confident of everything, delete your system restore backups and put in a new restore point. All sorts of nasties are known to hide in the restore files.
Most likely, the malware prevented the updates from installing. Some malware does this so that the security hole it uses won’t be fixed.
And 4000 malware probably includes such things as tracking cookies and other stuff that doesn’t really hurt you–it’s just used to, well, track you. Or at least that was my experience the last time I had that many.
There’s a school of thought that thinks that *any *compromised system should entail setting up a new clean system. I don’t belong to those, thinking that single virus intrusions sometimes can get rid of with the right tools. But I certainly wouldn’t trust a system where one single antivirus caught 4000 different security holes (as BigT mentioned, these probably include some rather innocuous things like cookies, but given the problems the machine had there surely was some nasty stuff).
I’d recommend a clean install before doing anything like logging into personal accounts, let alone banking.
I haven’t looked at each virus individually, but from what I saw or quickly going through the whole list, it was a trojan that replicated/download itself and similar malware. Likely because Microsoft security essentials hadn’t downloaded an update automatically.
There are several free AV scans - Malwarebytes, MS Essentials, Trend Micro Housecall among others. I would suggest you try every one, just in case one finds stuff the other does not.
If you deal with sensitive information at all (bank accounts, etc.) on that computer I’d suggest wiping the system and starting clean too.
If you get this straightened out I would suggest you do your web browsing in a sandbox program like Sandboxie. A sandbox will make your browser think it has normal full access to your computer but it’s actually confined to one protected folder, the contents of which can be deleted after each browsing session. For example, something exploits your browser to save a file to \windows emp, the file actually gets saved to \sandbox\c\windows emp and does not affect your Windows at all.
