Not Good : Reinfected!

Grazie wrote on 6/21/2004, 8:01 AM
After attemting to activate the remaining time on my NAV and NIS Syamntec prioducts and while being "asisted" by Norton over the phone, I appear to be reinfected by being "naked" on the Internet - and getting the downloads to make me safe . .. that's it . .I've had with Symantec ..

I am going away into a dark room and reconsider this virus checking stuff .. NOT go with Norton Internet Security ANYMORE . . I DID everything that was asked of me. Norton blocked me from getting on the Net to get acitivated; it then blocked me from getting the Uupdates I needed and now I'm reinescted.. Arrggghhh . . ANOTHER reinstall .. Sorry Joshua . . ALL I WAANA DO is edit video!!!

Anyways, I'm getting faster and faster at doing this .. not today though,

Grazie

Comments

jsteehl wrote on 6/21/2004, 8:11 AM
You keep saying "naked" on the internet. I'm confused. Are you running a hardware router/firewall? If not, why not? You can get them for about $30 or less!

I have a machine that has been on the net full time (that is 24/7) for about 1.5 years that has never gotten any viruses. That is because its address it 127.0.0.1 which is local and not addressable to the net. As long as you do not open ports or portmap you are shielded.

Just for the heck of it I also run Zonealarm.

jetdv wrote on 6/21/2004, 8:27 AM
My solution is simpler: I don't connect my editing machines to the internet at all. Registration of Sony's products is simple as I can take the "Register from another computer" option. Plus, there's no need to run anti-virus programs.

However, I agree that it should not be that easy to get infected. On the machine I use to access the internet at home, Zonealarm keeps be safe from outside attacks AND I don't open any strange e-mails (use MailWasher to delete most of them directly from the server).

Are you using that machine for internet access? If no, then you really don't need to do anything except install your editing programs. If yes, then check out Zonealarm and some of the other antivirus programs discussed in the other thread. A hardware firewall is useful as well.
smhontz wrote on 6/21/2004, 8:52 AM
My $0.02 - never use Norton anything, and McAfee isn't much better. I use Panda Antivirus and Sygate Firewall (ZoneAlarm got too squirrely for my tastes) and have a Netgear router in front of it all. I'm editing on a laptop with 5400 rpm drives and have never had a dropped frame from my av or firewall protection hogging resources.
Grazie wrote on 6/21/2004, 9:52 AM
1 - I had a Firewall. XPs and Norton Internet Security

2 - I had done a full virus scan. It did find viruses AND I cleatred them out

3 - With all this in place - dear friends - I then "attempted" to get onto the Internet to update and ACTIVATE my quickly vanishing Norton 14 days grace . yes?

4 - For some spectacular reason I was being "blockd" by my own machine.

5 - BT, my server/broadband service people CONFORMED that my connection was good to go. I was told by them to comntact Norton.

6 - Call Norton: 1 hour spent on 'You will need to scan your system if you find a virus use the dowloaded "updates" from your other machine and delete anything suspicious it comes up with." Yes there was and yes THIS I DID!

7 - Still couldn't get onto the Internet.

8 - Called back Symantec (Norton) .. another hour . . this time chap took me through all sorts of checks to ensure Norton was behaving itself . . "Please accessd the Internet" WHAT! I aint protected . . "Trust me!" . . I did .. He then askes me to try msconfig and safe mode . . nothing . . PC works but it is reinfected . . .arrggghhhh .. . "You wiil need to unistall Norton and reinstall" - Will you wait while I do this?" . ."No, becasue it will take too much time . . . " he goes. .Now I can't uninstall through remove software .. I'm screwed with a piece of s/w that is crook and a pc that is hanging together . .again . .

Now I want some form of scanning software that I can somehow get onto the pc - try AVG last time but the pc blocked me - so it can "scrub" the machine once and for all. From that point I'll ionly use that which people say . . Norton truly got in the wayn enough to ruin my setup .. the support team might have meant well but they have inadvertedly made things worse .. .

Not happy at all ..

Graham Bernard
Spot|DSE wrote on 6/21/2004, 10:03 AM
I'll expose myself for the fool many think me to be, Grazie. I don't run ANY antivirus. I'm just exceptionally careful about what I download, keep System Restore updated, keep the firewall on. I don't browse through sites like Kazaa and other known sites that can install malware, so I guess I'm lucky. Those chain mails that people send are immediately deleted, as are jokes and most similar types of mails. I also don't run outlook on my travel computer, I use webmail. On my office editing machine, I don't even have Office installed, though it is on the network. Running Trendmicro from online once in a while, I don't ever find anything.
Maybe I'm just lucky.
Norton and other virus protection tools make editing harder, you need to disable them for editing...Sucks, but it's the way it is.
Can't you just do a rollback?
GlennChan wrote on 6/21/2004, 10:04 AM
Can you burn AVG antivirus free onto a CD?

2- Norton seems to give people problems. It's also bloatware and one of the slowest at scanning. I would try NOD32 (commercial), the free AVG, or alternatives (not connect your computer to the net... or a get a dual G5 Mac with Final Cut ;) ).
dvdude wrote on 6/21/2004, 10:13 AM
>"I'll expose myself for the fool many think me to be, Grazie. I don't run ANY antivirus. I'm just exceptionally careful about what I download, keep System Restore updated, keep the firewall on. I don't browse through sites like Kazaa and other known sites that can install malware, so I guess I'm lucky"

Same here - I run the demo version of anti-virus products now and then, just to be sure, but this policy has not shown a single occurence of any nasties on my machine. My wife's machine, on the other hand, is armed to the teeth with anti-virus stuff, and still gets infected from time to time. Because of the strategy I used when I built the machine though, I can recover the OS-only C: partition in about 10 minutes.
Grazie wrote on 6/21/2004, 10:23 AM
Spot, thanks for the "moral" support .. Rollback? I'll give it go and I'll also try System restore .. but on my previous "experience" this aint gonna be avaialbel .. I really don't use my lovely MONSTA! for anything but NLE work and graphics generation .. I don't idly use it for the internet . .I've too much invested with my own time and clienbts work to be doing that .. so no .. I don't surf and burf with it. The only and only ting I was going to do was to make sure Norton was activated and so that I could get past the 14 days . .then it was gonna be hey ho and off we go with editing - what I really like DOING! ! !

glennchan - The last time, 7 days ago I think, this happened , I did download AVG and attempted to put this onto the infected machine - it wasn't possinble to either, copy of load it on .. can't quite remeber .. but it was sometihng stopping me get it to run. It was then I had to do my C: reformat as I copuldn't get AVG on .. . Did the reformat and immeadiately reinstalled Nortion. All went well. Itr found and deleted viruses . .hey ho off we go .. the days start ticking down . . . so Grazie thinks, Hmmm, need to get this puppy actuivated. That was like 7 hours ago .. and as they say, reader, the rest you know . ..

Grazie
jetdv wrote on 6/21/2004, 11:02 AM
If the machine is NOT going to be connected to the internet, I wouldn't put ANYTHING on it. No firewall, no antivirus, no anything. Just get the applications you need up and running. No need to check for viruses if you are not adding anything to it. If you are simply capturing video or creating artwork, you don't need to worry about viruses anyway.
Zulqar-Cheema wrote on 6/21/2004, 11:08 AM
Same here Spot, keep them eye's pealed, or just say NO
only run Zone Alarm and been free since I have been on line, 2 days so far, only joking, at least 3/4 years now.
BillyBoy wrote on 6/21/2004, 11:31 AM
To get you over the hump, what exactly is the message you getting when you say you're prevented from getting on the Internet?

Is it Windows? Norton? A firewall?

If you are infested with certain types of virus, some worms or torjans you CAN'T remove them while you're running Windows. You may need to do specific steps OUTSIDE of Windows.

If Norton is saying such and such virus or whatever is the problem then says what the name is, someone MAY be able to give you specifc steps to get rid of it.
RexA wrote on 6/21/2004, 12:12 PM
Maybe you are tired of this conversation by now, but this confuses me...

>>
It was then I had to do my C: reformat as I copuldn't get AVG on .. . Did the reformat and immeadiately reinstalled Nortion. All went well. Itr found and deleted viruses . .hey ho off we go .. <<

Are you saying that after you reformatted and reloaded your system, you installed Norton and it found viruses?? I don't see how that can happen unless you restored some files that were already infected.
DavidMcKnight wrote on 6/21/2004, 12:25 PM
Let me second the motion of a hardware-based firewall. Even if you only have one PC and are not using a small LAN, I think it is generally considered better to use a hardware firewall vs. the one built into XP. I don't have hard facts to prove this, I can find them if you want, but I will say that it is what I use and I haven't had a problem. The machine does NOT have any AV on it, and I hate anything else by norton - system mechanic and all that crap - but I do like their AV. I just don't have it installed on my editing box. I also don't go out onto the net very much from that box. But, even on my other 3 machines, with a hardware firewall and norton AV - no problems after 2+ years.

Side note - there was a short period of time when I had to use broadband with no hardware firewall in place - I think this was when broadband was being installed in my new house - and I got several popup msgs - totally unsolicited, I didn't even have a browser open - but because I had a pc directly connected to the cable modem I got those windows messaging messages.

Anyway - try a hardware firewall. A common one is here

Keep us posted - sorry you're having issues!!

David
mark2929 wrote on 6/21/2004, 1:56 PM
Grazie Sorry to hear about this VirusProblem... I can Imagine the Frustration..

Anyway :) Iwould like to say a few words In defence of Norton... For me anyway... The first is.." One occasion when CERTAIN Spam has Managed to convince me it may be real..Not Likely BUT... MyNorton virus checker has Informed me that I cannot download a Virus ridden Email.... Also I dont download emails Unless they are a known Source and Only If I need to.... Also Your Virus checker can Pick up A virus that is In your Temporary Folders Which Cant be deleted But you just delete your temporary Folders ie cache.. Also I run Zone Alarm and dont let anything In or out... Except what I want...

Even Bona fide Programs can be used by spyware or even other programs to squeeze out there little double agent intentions... Dont let them... Its WAR.. I Lost my Internet connection the other day... I thought I had a virus... But Both My Machines had the same symptoms... I later realised that my Broadband Supplier who Likes to transmit Little emails every now and then... Which I have prevented had now decided to disrupt My computer... Stop my internet connection.. needless to say I allowed it to transmit its little packets of Info on me and all was well (Probably only verifying that Im legit anyway)

Thankfully Viruses can usually be Avoided or deleted BUT Having said that Our computers ARE probably Spying on us Anyway and some Clever Informed people Just cruise around getting into the Workings Unhindered AHA I could make a film about that ...Oops its been done enough already..

Hope you Manage to Come through it OK.......

bEST Mark2929
farss wrote on 6/21/2004, 2:10 PM
Grazie,
a few have picked up on how come after a rebuild your machine was infected, I'm no expert here BUT unless you reformat the drive(s) boot sector viruses will still be there I think.
Randy Brown wrote on 6/21/2004, 3:53 PM
>>"I use Panda Antivirus... "<<

Another vote for Panda...no problems in the 2 years I've been using it; however on my main NLE machine I don't use internet.
Randy
craftech wrote on 6/21/2004, 6:20 PM
Grazie,
What happened to all those other suggestions I gave you in the other thread you posted? Why did you download AVG? It doesn't detect viruses properly.
While I don't recommend their software for the reasons I stated in the other thread I think that Panda Activescan works OK as an online scanner. You will have to allow Active X for it to run, but give it a shot and see if it can detect the virus. You may have to remove it manually though.
One more thing. You said you had OE hacked. Go into Regedit and search "Internet Account Manager" and see who is listed for the User. If it is some strange name, delete it.
To reset password for OE6 in Windows 2000/Windows XP.
OPEN REGEDT32.exe
Go to HKEY_CURRENT_USERSoftwareMicrosoftProtected Storage System Provider<CLASS/USER SID>, which is in grey color (because you don't have access to that item.
Select from the Menu ToolBar->Security->Permissions and add the current user (i.e. Administrator) to have Full Control over this registry key and subkeys.
Expand this registry key and go to Data subkey. Here you can find more subkeys. Find one that is similar to your MS OE6 Identity CLSID and go to the IdentityPass subkey and Delete it.
You may change permissions back to previous security settings

John
BillyBoy wrote on 6/21/2004, 7:47 PM
John on a related topic, something I've seen pop up the last couple weeks maybe you know.

What seems like out of the blue Microsoft's Media Player just stops working. It won't play any file. I have many players so its an annoyance more than anything. Here's the part that got me stumped. Whenever I see Media Player hang when I try to shut down that evening Windows typically is sluggish in closing down or hangs. Somtimes something called DDE server is the reason. Have any idea what that is, and what it does? The name suggests its some kind of hook that could be used for malicous things. Just got me curious.
stepfour wrote on 6/21/2004, 10:42 PM
I had virus attacks on my computer this weekend and in 2 worrysome hours had (and got rid of) 14 viruses/ loaders and trojan crap.

The free verison of AVG spotted them and helped me clean or put them into what it calls the virus vault. Still, they came back. I ran a complete scan with AVG four times and each time they came back. There was some kind of batch file running over and over and I had to find it myself to finally get free from the virus junk reloading itself. Whatever site I had gone to had dumped a bunch of little executables on my drive.

First I ran AVG, then Adaware from Lavasoft. Then I painstakingly went through Windows explorer date-sorted and looked in all the key directories to find files dated same as the attack date. I deleted the ones that looked suspicious, including one little dos type batch file that was probably one of the main triggers. I even found several small programs on add/remove in control panel that had magically gotten loaded on my system. I deleted the ones I could but some would not allow delete. Later I found that I had to kill their process in Task Manager and then go back to add/remove and get rid of them. Being familiar with what your Task Manager is supposed to have on it can help you spot suspicious stuff quickly.

I keep a pretty clean system but I learned that it only takes a few minutes of random surfing and clicking this link and that to foul up a system. One thing I am glad about is that I saved my system. Didn't have to wipe it or reload operating systerm or anything and never had to mess with the registry except the work Adaware and AVG did in it. The people who write this crap are getting slicker and slicker. Your virus scanner will find the virus but not always the innocent looking .exe that calls back home and gets the virus again.
kentwolf wrote on 6/21/2004, 11:00 PM
For what it's worth I run Norton Internet Security and Antivirus; have for several years and have never had a problem.

But...

I do very good tape backups as well as backing up operational OS disk partitions that I can recall at any time, which has proven to be a real life saver.

...but that's just me.

>>Norton and other virus protection tools make editing harder, you
>>need to disable them for editing

I have never had to disable anything for editing.
kentwolf wrote on 6/21/2004, 11:05 PM
>>...unless you reformat the drive(s) boot sector viruses will still be there I think.

They will still be there even after reformatting the drive.

You really need antivirus software to get at these.
craftech wrote on 6/22/2004, 6:11 AM
BillyBoy,
The DDE Server is the Dynamic Data Exchange protocol which is Microsoft's communication protocol that enables all applications in Windows to send and receive data. It can act as a client or a server application. It has been around since the 1980s. It is a control like ActiveX geared toward VB apps in particular, but since the DDE call is popping up the problem could be coming from practically anything. Do you have DDE listed as a protocol in the Media Player Options?
Start the Microsoft Management Console. Launch it through Control Panel or click Start -> Run, type services.msc and click OK. The console will display all services in alphabetical order; select one to see its description in full on the left. The Status column informs you which services are running now, and Startup Type will show how each one is configured to run.
If you’re not connected to a network then you can safely disable services including Alerter, Messenger network and Network DDE. Right-click each service then in the Startup type drop-down box, select Disabled then click Apply and OK. Network DDE. Provides network transport & security for Dynamic Data Exchange. Set this to Automatic if you use DDE connections (More than likely you won't need this unless using certain legacy applications). You could also choose Manual instead of disable.
The other possibility is a configuration problem with the default file types for the media files. Check the icons to see what the file associations are.

John
Erk wrote on 6/22/2004, 6:33 AM
>>...unless you reformat the drive(s) boot sector viruses will still be there I think.
They will still be there even after reformatting the drive.
You really need antivirus software to get at these. <

I thought a full reformat erased everything off a drive, restoring it to factory-shipped plus any partitions you created. No?

Greg
DavidMcKnight wrote on 6/22/2004, 7:02 AM
My recommendation - not that anyone asked - is as follows:

1. Use XP. Boot from the Microsoft-supplied CD.
2. You will be given several options to format, partition, etc. Delete all partitions and do a low-level format NTFS - not a Quick Format.
3. Create a new partition and reinstall XP.
4. Immediately after Windows, install Norton or the virus scanner of your choice.
5. Get the latest virus updates
6. Do a full system scan including RAM.

I don't see how, after following this procedure, that a virus could remain on the system.

DM