Computer issue

Kasey9fan · Post by **Kasey9fan** » Thu Oct 22, 2009 1:30 am

Hey guys, on Laptop. My regular computer has a big issue, I'm thinking it is a virus of some sort..

I really need some help though, this thing randomly started messing up a week ago. I was getting set up for a NR2003 funrace when all of a sudden it switched to the classic view mode, where all of the task bars and stuff are grey and classic style. I didn't know what the hell the issue was but I ignored it for a few, tried hosting the fun race and people couldn't connect to my IP.. Keep in mind 10 minutes before that I was hosting another race.. So I'm not sure what it was, I hadn't even downloaded anything the whole week... But anyways after people could not connect to my game, I tried switching back over to XP mode but there wasn't an option for it.. So I restarted the computer and that only made things worse as the next time I started it up I had no task bar, my icons weren't showing up and my games/internet were not loading.

I tried running my virus scan and firewalls and they would not even load either. I thought maybe the fan was hot or something so I cleaned the computer up a bit and that didn't help either.. So I'm led to believe that somehow a virus got into my computer and blocked off all my regularly used programs, now I got my taskbar to work and a few games but they will not connect online.. My icons also are coming up but my computer takes way long to load.

I tried doing a system restore but that also was not working correctly.. I tried safe mode but that also didn't help. So I'm either led to believe my computer is done for good, or I just don't know enough about what I am doing. Any help would be appreciated as I do not currently have a job and can't really afford a new computer.

Post by **Phineus** » Thu Oct 22, 2009 4:52 am

Windows XP ?

Go to this for all users...

C:\Documents and Settings\users\Local Settings\Temp

... and delete all files.

Also ...

C:\windows\temp

and delete all files. Then reboot.

That's the most basic thing.

In safe mode, run adaware, spybot, or whatever your favorite malware program is.

The desktop theme, whether classic 9x or xp, doesn't matter and should not affect major settings. So, don't trouble over that (yet).

If you cannot get anything to work after doing those few basics, then we need to look deeper.

What kind of computer, how old is it?

Kasey9fan · Post by **Kasey9fan** » Thu Oct 22, 2009 10:30 pm

Gonna try that real quick thanks Phin, also I apologize for not giving more information.

Yes I am on XP. I am using a Dell, stock computer if you will. 3 years old.

Also, it must be a really big virus because I can not access any of my spyware programs, or virus protection programs. Obviously they were blocked off by the virus. How I got one is beyond me as I only use the net for MTM2/NR2003, School work and a few sites like Yahoo, Myspace, facebook etc.

Kasey9fan · Post by **Kasey9fan** » Thu Oct 22, 2009 10:47 pm

Okay deleted what you said to, however.. There is one file in that windows/temp folder that wouldn't delete. It kept saying it was being used by the computer. No clue what it is, but it won't delete. The computer is still not working correctly so I'm not sure what the deal is.

I think that one file that keeps saying its already in use, that must be the corrupt virus that is causing these issues. I have no clue on how to delete it, I've closed out of all programs running and nothing

File name: Perfib_Perfdata_764

there is a few other ones like that but with different #'s, I deleted them but each time I rebooted they came back. They have to be it..

Post by **Phineus** » Thu Oct 22, 2009 11:30 pm

You should be able to delete anything while in safe mode.

But let's move forward...

In the "run" box, type msconfig, when it opens, goto the startup tab and uncheck everything. Click apply and reboot. You'll get a nag saying msconfig was run, just say ok to get past it - don't let the nag alter anything you've done. Then see how it goes.

> Myspace, facebook etc.

Those sites are not the most secure. You can use them, but don't trust them. So much crap is run through them it's incredible, and they are probably one of the number 1 sites responsible for spam. Most is harmless, but be wary just the same.

Kasey9fan · Post by **Kasey9fan** » Thu Oct 22, 2009 11:49 pm

Ok man my mistake, I wasn't in safe mode at the time. I got into safe mode and did delete those files, I am rebooting now to see if anything changed (hope so). If not, then I will do that next step that you said.

Kasey9fan · Post by **Kasey9fan** » Fri Oct 23, 2009 12:19 am

Arghh, files cameback after I restarted the computer (the ones I think are the virus's). I also did that msconfig thing you had mentioned, it didn't change anything.

Thanks for helping though Phin I appreciate it.

Post by **Phineus** » Fri Oct 23, 2009 12:36 am

If you do ctrl + alt + del what do you get in the processes tab?

Nascarfan15 · Post by **Nascarfan15** » Fri Oct 23, 2009 12:41 pm

Here's some info on those Perfib_Perfdata files:

http://www.bleepingcomputer.com/forums/ ... 54540.html

http://www.tech-archive.net/Archive/Win ... 00130.html

http://www.google.com/search?hl=en&clie ... f&oq=&aqi=

So after reading those it seem's to be made by a service that is on the system that is required(but you can disable it)...and they are not the virus...[;)]

If you can try to find a free online virus scanner. Those usually work...

try one of these:

http://housecall.trendmicro.com/

www.bitdefender.com/scanner/online/free.html

www.kaspersky.com/virusscanner

http://www.google.com/search?hl=en&clie ... er&spell=1

I hope this helps some!

Kasey9fan · Post by **Kasey9fan** » Fri Oct 23, 2009 1:38 pm

Phin, for some reason I am getting 35.. One thing I have noticed in the past few days, is when I do the ctrl alt delete, my user name does not come up in the username tab. It usually does, with this there is absolutely no users coming up, nothing. It's never done that, and when I log off or restart it says something about "closing network connections" then it "saves my settings" and logs off.

-edit, ONE program that is working to its fullest extent is MFR, and for whatever reason after you told me to delete some of those files, it has been running extremely smooth. Usually when I mess with MFR its always really choppy and the FPS aren't all that good.. MFR is the only program that has been remotely working since the virus. So I'm a bit confused right now as to how its randomly working good.

I've never seen either of those two things occur before.

And Shawn, thanks for tips. I don't think those files are the virus's but it is still weird when I delete those they magically return.

I would love to download those spyware programs and what not as you listed, but again I'm on a friends laptop. My regular computer is the one with issues and I can not access any of my internet options, or any programs. Including all my spyware, and virus protection programs.

Mat-Allum · Post by **Mat-Allum** » Fri Oct 23, 2009 7:26 pm

If you have a USB flash drive, try DL'ing the antispyware/antivirus programs onto that, then just transfering it to the affected system. After the programs are installed, I'd suggest wiping the data off the flash drive in case portions of the virus happened to sneak onto it.

Post by **Phineus** » Fri Oct 23, 2009 9:16 pm

re: MFR

Well, apparently there was something running that was interfering with it. We could only guess what it was.

re: ctrl + alt + del

The user issue is a concern. Can you goto the control panel > user accounts and see what's going on in there. Before you do, however, check this list... This is what I have when I start up.

csrss.exe
explorer.exe
lsass.exe
services.exe
smss.exe
spoolsv.exe
svchost.exe (8 of these)
system
system idel process
taskmgr.exe (the thing you open to see this list)
wdfmgr.exe
winlogon.exe

You can highlight anything else but those and click the end process button. You should note what you turn off. That won't restore your internet, or at least it shouldn't, but it should allow other programs to run. Hopefully an anti-spam/ad/ware program. If you find a specific program that is locking things up, and ending it frees them up, then we can talk about how to get rid of it - yes, it can be done.

The good news is that if MFR runs, then the computer hasn't copped it yet. It's just a matter of tracking down the problem and fixing it.

A USB memory stick is a good idea, if your friend is willing to help with downloading the programs, if he hasn't got them already.

Slayer · Post by **Slayer** » Fri Oct 23, 2009 9:22 pm

Avira, Spybot and malwarebytes is all you really need to get started.

If its really really bad, you can use tools like Hirens boot CD to boot up mini XP and virus scan your system

Kmaster · Post by **Kmaster** » Sun Oct 25, 2009 11:14 am

Yep, get malwarebytes, it helped me removing a nasty rootkit I had

TlathamXmahtalT · Post by **TlathamXmahtalT** » Mon Oct 26, 2009 5:00 pm

Kasey9fan wrote:Yes I am on XP. I am using a Dell, stock computer if you will. 3 years old.

I have the same exact computer, I saw a picture of yours a while ago. What happened to me is the desktop kept not showing up. I just downloaded Malwarebytes, fixed the PC when the desktop would finally show up after 10 times, and downloaded Avira AntiVir for my AntiVirus/Malware needs.

Kasey9fan · Post by **Kasey9fan** » Sun Nov 08, 2009 2:40 am

Got er fixed guys thanks!

Nascarfan15 · Post by **Nascarfan15** » Sun Nov 08, 2009 1:17 pm

Good to hear!

Kasey9fan wrote:Got er fixed guys thanks!

Post by **Phineus** » Sun Nov 08, 2009 7:06 pm

What was the ultimate cause of this problem? What fixed it?

Kasey9fan · Post by **Kasey9fan** » Fri Nov 20, 2009 6:27 pm

It was a virus caused by a NR2003 website that I frequently visited..

Quite a few others have had the same virus from that site so needless to say I don't go there anymore lol.

I appreciate the help you guys.

Nascarfan15 · Post by **Nascarfan15** » Sat Nov 21, 2009 2:51 pm

Is it NNR? i got a "rootkit" tonight (I removed it i think with my spyware remover program) and i'm guessing that's where i got it from.

Kasey9fan wrote:It was a virus caused by a NR2003 website that I frequently visited..

Quite a few others have had the same virus from that site so needless to say I don't go there anymore lol.

I appreciate the help you guys.