Topic: Male pc virgin needs help, im cluless!!

[pablo piccasso]

Hi Sandra

The problem with me going on line is that i dont know if im protected or not, my norton icon or firewall icon do not appear in the bottom right hand side but are still on my desk top? is there another way to find if im still protected??

By the way if thats your picture, your never 53!!
Paul piccasso.

[Serenity]

By the way if thats your picture, your never 53!!
Paul piccasso.

   Gawd Paul dont start telling her that!  I get enough of her droning on about her drop dead gorgeous looks as it is      by the way  

[Sandra]

Paul if you do Ctrl + Alt + Delete all at the same time it will bring up the task manager, you may have to do it a few times to bring it up.
That will list all the programs that are running at that time and hopefully will show your AV and Firewall progs are running.
I would think that whatever is affecting your pc though has stooped both your av and firewall from loading though  

Did you find out if you have Kazza installed or if your brother downloaded from it by the way ?

The camera never lies Paul, that was taken on the 21st of Feb this year, 2 weeks after my 53rd birthday thank you very much  

[pablo piccasso]

You will have to excuse my ignorance but what is kazza?

[Sandra]

Its a P2P (peer to peer) downloading program.
You "share" your music and other files with other people who have it installed but its notorious for causing problems for PCs either by the spyware that the program itself installs when you install it or by getting infected files from other pcs.
There are lots better P2P programs around but some people seem to like living dangerously and insist on using Kazza  

[pablo piccasso]

Hi Sandra

My computer is not linked up to anyone elses and im not sharing files either ive only had my pc for two months and everythings went t**s up!!do you think that it might be worth my while getting someone to visit my house and see what the problem is??

[Clive]

Try finding your Nortons AV on your desktop, or, if it's not there, under Start/ All programs.  Launch it and click on Options.  Click "enable autoprotect" and it should then be back in your list of start up progs.

[pablo piccasso]

Hi Clive

Tried that, as soon as i go into all programmes it comes up with the message about the c drive that i refered to a few e-mails ago and does not let me go any further, everything i go into referes to the c drive??

Pablo

[Clive]

Since you can get in the Internet, why not try downloading a free virus checker such as AVG, getting the updates, and running it from the net?

[joudi]

Hi Paul,

That?s what I could find and arrange for you from another forum (if you can do it) :

1.   Disable System Restore (Windows Me/XP).
2.   Remove from the registry (Regedit) ?svckernell.com? everywhere you find it.
3. Update the virus definitions. And follow the instructions here: http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.packed.html
4.   Restart the computer in Safe mode or VGA mode.
5.   Run a full system scan and delete all the files detected as Bloodhound.Packed.
6.   Clear the Temporary Internet Files folder, if required
7.   Restart Computer normally.
8.   Reactivate System Restore.
9.   If the problem is still there, passé AD-AWARE.

Hope it helps.    

[Simon]

Just to recap a little, Paul, can you get into Safe Mode, by continuously tapping the F8 key while your PC is starting?

If so, are you saying that you still cannot start any of your programs, even in Safe Mode?

It definitely sounds like you have been infected with a virus, and possibly more than one, but if you can get into Safe Mode, you should[/i] be able to launch your anti virus software from your desktop, and run a complete system scan.  Before you go into Safe Mode, assuming you have XP, you should disable System Restore by the method in the link in my earlier post.

1. Right-click My Computer (on your desktop), and then click Properties.

2. Click the System Restore tab.

3. Tick the "Turn off System Restore" tick box.

The only difficulty with the above is that your anti-virus protection may not be up to date, and as you can't launch it while you are online, that would be a bit tricky, but it should still find something, which might help a little, then we can progress from there.

[ketamininja]

I heard something about doing that to stop the timer from counting down from 60 seconds so he can at least get on line for a few hours until we can figure out how to sort him out permanently  

SASSER VIRUS!!

Just like the "BLASTER" Virus, the SASSER virus exploits an RPC, which means the PC shuts down in 60 secs.

=YOU CAN GET THE VIRUS FROM JUST BEING ONLINE!=

-Thats right, you don't have to check mail or anything - the virus spams random IP addresses with itself: FIREWALL'S REQUIRED TO STOP THIS!

Firstly, there are now 6 different versions of the virus.
sasser.a to sasser.e can be removed by using the removal tool from Symantec (Norton):
http://sarc.com/avcenter/venc/data/w32.sasser.removal.tool.html

IF you have sasser.f, read removal instructions here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.f.worm.html


Once you have removed the virus, GO TO THE WINDOWS UPDATE WEBSITE, to obtain the latest patch to fix the 60sec problem.


-edit-
The virus basically stops your computer from working, if you do have a firewall stopping it from getting out. Usually it starts the process SKYNETAVE.EXE at startup, which calls RARMON.EXE, and then executes FTP.EXE - can you guess what it's trying to FTP?