NWA-PCUG Newsletter Article, June 2006
Crisis With A Virus
By Dean BergLund
From the 05/06 Journal of The Computer Club, Inc.

I wrote an article for my local computer club that I belong to here in Milwaukee named Milwaukee Computer Society and thought your members might also enjoy reading it. Post it if you wish. I’m a subscriber of your newsletter from The Computer Club in Sun City Center.

For the last couple of months now, my computer has been slowing down. At first I thought it’s probably because my hard drive is getting past its half full stage but it seemed to he getting much worse as time went on.

I decided to run all three of my adware or malware scanning applications. I ran Lavasoft’s Ad- Aware SE, Spybot Search and Destroy, and Microsoft’s Antispyware applications. Of course, I downloaded all the updates and all three applications found something different. I then decided to run a full Virus scan on my machine using Norton’s Virus Scan. Again, I downloaded the latest virus data files. I do have my system set up to automatically check for and download updates from Microsoft and Norton on a regular basis. That’s why I was surprised to see Norton found a file containing a virus lurking in my Windows/System32 folder.

I wondered why the Symantec product didn’t recognize it sooner when it infected the folder in the first place. It seemed Norton had been doing a great job of detecting viruses as I download them from various shareware sites etc. and it warns me immediately and deletes the file.

Norton couldn’t repair or delete the file right away and directed me to Symantec’s site for getting the correct removal instructions. Once there, I read the removal instructions and printed a copy to follow. First, I was told to temporarily Disable Windows XP Restore, then update virus definitions, then run a full system scan and delete all infected files, then delete any values added to the registry.

Of course they do recommend backing up the registry before making any changes to it. (Good advice any time you make any changes to the registry.) They also gave detailed directions to the possible bad registry values to delete. This all sounded very easy.

Wait a minute, I have to laugh here... All is not as easy at it seems. Once I disabled System Restore, the “FUN" just begun. I had to reboot the system and now my machine was at a crawl that reminded me of doing defrag on a 286 machine with a full hard drive. Norton kept popping up saying it can’t verify itself running. Windows kept popping up a message about my machine not being safe because there was no virus protection and decided to turn on its own firewall because it didn't see Zone Alarm running.

Of course it couldn't. Zone Alarm wasn’t configured to start up anymore for some reason. Wben I tried to run Norton Antiviris, it wouldn’t start up. I deleted the infected file in the witidows/system32 folder as directed and rebooted again. I figured I’d head over to Google and do a search for Free AVG. My machine was so sluggish; I couldn’t get it to load the Google page correctly.

I decided to use another computer to download AVG Free from http://free.grisoft.com. I burned it to a CD and then decided to install it on my sick computer using “Safe Mode.” Interestingly enough, I couldn’t install AVG in safe mode. So, I had to install it in regular run mode which took 2 tries and about 15 re-boots of the computer. I had to do things in steps because I couldn’t run Windows for more than about 4 or 5 minutes without it freezing up on me and requiring a hard reboot.

Once I finally got it installed, I ran a scan of the Windows folder to see if there were any more infected files. Yup! AVG found the 2 remaining files that were associated with the original virus file that were screwing around with my machine and quarantined them. 1 re-booted and now the machine seemed to be working properly again. I was finally able to run Regedit and delete the bad registry values. I then downloaded the updated virus definition files and decided to do a full scan of my computer using Free AVG and it found a total of 8 files that were infected! I wrote the names and locations of these files down (they were all zipped up files so they weren’t active viruses on my machine).

I then uninstalled Free AVG and restarted Norton anti-virus. It seemed to work ok so I ran a full scan of my computer using Norton anti-virus. It reported, “No viruses found.” At that point I uninstalled Symantec System Works and reinstalled Free AVG along with the updated virus definitions and set it up to run on my system to include e-mail scanning too. I’ve lost all faith in Symantec’s Norton Anti-Virus and am now suggesting to all my friends and relatives to check out Free AVG. Now I have to look around for a good program to manage the rest of my computer like Norton System Tools did.

Click here to return to top