possible virus.... need help!

[Mr. Dude]

My nephew burned me a disk last night with some games on it and I was gonna try them out on my Cabinet.  Well, after installing them now my computer won't shut down.  When I try to shut down it gives me a ton of errors and I end up having to do a hard shut down.  Also, it won't let me open up MSCONFIG or REGEDIT... when I try to do either it opens it for a split second and closes the window.  So then I tried using spybot and it won't let me open that either.  Anyone have any ideas as to what is causing this?

[SirPeale]

Yup, you got something all right.

You tried booting in Safe Mode?

[pointdablame]

If you've got a Norton Antivisus CD around, boot with that, you can run a virus scan that way before the OS fully loads.  I'd assume other virus progams have a similar ability, but I'm only familiar with Norton.

Also try to boot up into safe mode as Peale suggested.  Run a scan from there, check what is starting up with MSCONFIG, check for unrecognized "programs" in add/remeove programs, and search your hard drive for folders you are unfamiliar with.  Be careful not to delete anything unless you know it's not needed.  My program/folder suggestion is moreso for spyware, but it may help out.

Hit F8 at bootup to boot into safe mode if you didn't know how to do that.  Good luck.

[Mr. Dude]

thanks for the replies guys.  I haven't tried booting from safe mode yet but I'll give that a shot when I get home from work today.  I checked in my add/remove programs section and didn't see any new programs in there.  I also hit ctrl+alt+del to bring up the list of running programs and I didn't see anything new in there.  Hopefully if I can boot to safe mode I'll be able to do a MSCONFIG.

[J_K_M_A_N]

Is your system connected to the network and have internet access? If so, maybe try to boot in safe mode with network support and go to housecall.trendmicro.com and search for a virus that way. Good luck.

J_K_M_A_N

[Mr. Dude]

Nope, unfortunately it's not connected to internet and it doesn't have a modem installed.  Although that site is good to know about, thanks for the tip.

[DrewKaree]

Thought I posted to here, but it must have gone Twilight Zone on me.

Anyhoo

After you've got everything back to normal and it's all bright and shiny again, get yourself a drive imaging program.  I prefer DriveImage, but Ghost will work as well (I believe so, anyway, with what I'm about to say).

Install DriveImage, create the rescue diskettes they want you to make, and then image your drive, making them CD sized if necessary.  Back up your drive this way so you can always go back to that point.

In my own use, virus programs slow my systems unacceptably, don't guarantee me protection from the newest viruses (in which case, I've paid for a program that is always "catching up"), and depending on the program, don't always catch even existing viruses.  They also cause wonky behavior with other programs, requiring me to go to lengths to make nice with the other progs.

I've imaged my drives and backed them up to another partition/drive and if it's a VITAL system, to removable media (CD).  

I've been hit by 2 viruses, numerous spamware/spyware/adware.  Each and every problem/nuisance is at most a 10 minute fix away from being back in the pristine state I chose to image.

Virus scanners suck.

(did I forget to mention the "pay for updates" annoyance that drive imaging doesn't require?)

That's my $.02 on what to do AFTER you are back to a state you like, and my advice for future PC setups.

[Mr. Dude]

aarrgghh...  I booted up in safe mode but it still won't let me open regedit, msconfig, regclean etc.  I tried installing spyhunter along with spy bot and it won't let me run either of them.  I'm with ya Drew I should have done a ghost on this thing a while back.  

[DrewKaree]

See what error messages pop up, write them down verbatim, and Google them  On the PLUS side, you can check the add/remove panel you said, so it's not THAT bad.  The REALLY bad ones don't let you even do THAT!

If you have a virus program on the pc you're working from, scan the CD you got to see if/what the problem is, then find a fix for it on the 'net and go about it that way.

Hope this story helps:  Buddy downloaded/installed several spyware progs and two viruses, to the point that he couldn't log onto the net with his ONLY computer, couldn't access the control panel to find out what's up, and it would try to connect to the net every 2 minutes, giving him an error message.  

I had to remove his hard drive completely from the machine, install it on mine, and format the drive there before re-installing and putting a shiny new OS on there for him.  


LAST possible solution I can offer you is this:  See if you can transfer the files you can't replace onto another PC, and format and start from scratch.  Not the first choice, I know, but if you can do that, you'll be able to get out of this pickle!

[daywane]

avg is a free antivirus program. can be booted from cd
I have used this many times.

[Mr. Dude]

DrewKaree you rock!  I never even thought of running a scan on the CD to find out what the virus was.  I found out that my computer has contracted the JEEFO.A virus.  It was from the game Crazy Taxi that my Nephew DL'd off of Kazaa .  Anyway, I'm still not in the clear.  I know what the virus is now I have to get rid of it.  It created a file SVCHOST.EXE in my Windows directory which is a virus copy of the real svchost.exe in my system folder.  I still need to find a way to delete the sucker!  With Regedit and everything else not working I can't delete it.  Plus if I right click the file and try to delete it it says that it's in use.  Anybody have an idea how to terminate this bastard!

p.s. would avg be able to kill this?  That's what I need is something like that I could boot from a CD or something.  Anyway, I appreciate you guys helping me stick it to this thing.

[fastredpacman]

Here is a link that describes the virus:
http://vil.nai.com/vil/content/v_100277.htm

Here is a link to a tool that removes the virus:
http://www.sophos.com/support/cleaners/jeefogui.com

And here is the main link with instructions for using the removal tool and getting it:
http://www.sophos.com/support/disinfection/jeefoa.html

Hope it helps. Just remember to deactivate the system restore function if youre using Me or XP. Or else youll get reinfected.

[Mameotron]

Virus scanners suck.

(did I forget to mention the "pay for updates" annoyance that drive imaging doesn't require?)

Couldn't agree more.  I had Norton's live update installed for a year.  Didn't catch any viruses (maybe I wasn't exposed to any), but then the stupid "subscription has expired" window pops up all the time, and you can't get rid of it unless you uninstall Norton.

So I bought ghosting software.  Screw Norton.  I hate pop-ups of any kind.

As for Kazaa, if you swim in the sewer, you're gonna get dirty.

[Mr. Dude]

Here is a link that describes the virus:
http://vil.nai.com/vil/content/v_100277.htm

Here is a link to a tool that removes the virus:
http://www.sophos.com/support/cleaners/jeefogui.com

And here is the main link with instructions for using the removal tool and getting it:
http://www.sophos.com/support/disinfection/jeefoa.html

Hope it helps. Just remember to deactivate the system restore function if youre using Me or XP. Or else youll get reinfected.

Thanks man!  I will use this when I get home today.  Thanks again for all your help guys!

[fastredpacman]

No prob if you have any other questions email me and ill help ya.