Ctrl Alt Delete not working! Antivir not uninstalling!

[fraseyboy]

Well somehow i got a virus which had infected about 2000 files So i ran Stinger and healed them all. I did another check after restarting just to make sure i had removed it and it was all fine. A couple of weeks later a program was not responding so I did control alt delete and nothing happened! I even tried Run>>taskman and Run>>taskman.exe and still nothing happens.

Can anyone help?

The virus also munted my virus scanner, AntiVir, and now I cant uninstall because it says "the CRC sum of C:/Program Files/AVPersonal/AVWIN.exe has changed. This could be the result of a virus. Antivir is shutting down."

The name of the virus is W32.Parite

[fraseyboy]

I can't believe no-one knows the answer to this!!!

[JimmyLoveNYC]

Hello fraseyboy!

So i ran Stinger and healed them all.

It doesn't look that way to me!

You probably did rid your system of many monsters but I believe there are still some in there causing the issues your experiencing.

Perform an online scan and see what comes up. Here are a few sites you can choose from:

Panda - http://www.pandasoftware.com/activescan/co...n_principal.htm
TrendMicro - http://housecall.trendmicro.com/housecall/start_corp.asp
Bit Defender - http://www.bitdefender.com/scan8/ie.html
F-Secure - http://support.f-secure.com/enu/home/ols.shtml


Good Luck and post back if the problem isn't resolved and you need further assistance

[fraseyboy]

Thanks for that jimmylovenyc
Another thing I forget to mention is that it only seems to happen in my profile... In all the others on my computer ctrl-alt-dlt works just fine. I'm running the f-secure online check now. Hopefully it will uncover something...

About the AntiVir... I think it just corrupted my program so now I have lost trust in AntiVir and have switched to AVG
I don't know how to un-corrupt AntiVir... I could just delete it from the computer without uninstalling it but I think there is a reason for having to uninstall a program...

[JimmyLoveNYC]

About the AntiVir... I think it just corrupted my program so now I have lost trust in AntiVir and have switched to AVG

I don't think AntVir corrupted your program. The problems your experiencing is most likely going to have to do with spyware and the like.

I don't know how to un-corrupt AntiVir... I could just delete it from the computer without uninstalling it but I think there is a reason for having to uninstall a program...

No. You cannot "un-corrupt" AntVir. If you want to remove AntVir, it is best you either do so by going to "All Programs", "AntVir" and uninstall if option is given or the old fashion way: Control Panel Add/Remove.

If you try to delete an AntVir file, you'll just end up making a mess and then will have to find each and every file and manually remove them. Trust me, you don't want to go that route.

Let the scan run and see what comes up.

Good Luck, Good Night and God willing, tomorrow we (or someone else) will pick up were this has left off.

[fraseyboy]

C:\Documents and Settings\Fraser\Local Settings\Temporary Internet Files\Content.IE5\K1QZKHQN\page1[1].htm JS/Psyme.AB@dl

C:\Documents and Settings\Fraser\Local Settings\Temporary Internet Files\Content.IE5\KHYFS1MR\1[1].htm Exploit.HTML.Mht


Thats what it came up with in the F-Secure one. I tryed doing a search for the first one and came up with pratticly nothing but the second i see is an exploit. Im downloading the patch now.

I also tried a scan with AVG and found nothing. I thought i hade the latest update but i guess not...

Edit: Looking at the files i see its just in my temp so clearing them out should fix it i hope
Edit 2: Ran another scan after clearing out the temp. Found nothing!!

Thanks!!! But now it says 'task manager has been disable by your administrator' and that administrator is me but i didnt disable it! It must have been something the virus did....
How do I re-enable it?

[joypatra]

Read about the solution at:

http://windowsxp.mvps.org/Taskmanager_error.htm

[fraseyboy]

Thanks!!! Ctrl-alt-delete works fine now. Now to solve the AntiVir not uninstalling problem...

[JimmyLoveNYC]

The virus also munted my virus scanner, AntiVir, and now I cant uninstall because it says "the CRC sum of C:/Program Files/AVPersonal/AVWIN.exe has changed. This could be the result of a virus. Antivir is shutting down."

The name of the virus is W32.Parite

My Analysis: source: McAfee
I think you probably got mixed up with the name of the infection and what your system was infected with is the W32/pate Virus which is an encrypted parasitic file-infecting virus and network aware worm. The virus does not store the original file size, and hence cleaning of this virus will not leave the original executables at their original size. Theirfore, when you scanned your system using "stinger" (mentioned in your very first post) and you removed the Virus it changed the size of the executable thus you're unable to do anything with AntVir (Add/Remove).

Solution:
First go to Control Panel again to remove AntVir. If your still unable to remove it, try re-installing AntVir and then uninstall it.

My theory is, installing it over the present AntVir will replace the corrupted files, where then you'll be able to remove it properly.

Note: If you are unable to remove AntVir or should other programs start acting up, (ie giving you "error messages" similar to the one you just experienced), post a HijackThis log in the Cyber Safety Forum and be sure to link this post so that who ever assists you will know what has been tried thus far.

Good Luck and Be Well!

[fraseyboy]

i posted my HJ This log here:
http://www.cybertechhelp.com/forums/...252#post423252

I'll try reinstalling AntiVir
Thanks!

[JimmyLoveNYC]

Let me know what happens, O.K?

By the way, I was taking a look at your log and although I'm no expert reading them there is a program on your system called "tightvnc" which is an application that allows you to remote control your pc from another PC somewhere on the Internet.

So, tell me you downloaded that program.

[fraseyboy]

Originally Posted by JimmyLoveNYC

Let me know what happens, O.K?

By the way, I was taking a look at your log and although I'm no expert reading them there is a program on your system called "tightvnc" which is an application that allows you to remote control your pc from another PC somewhere on the Internet.

So, tell me you downloaded that program.

Yes, I downloaded TightVNC but it seems there is an error with it. Everytime I start up the puter theres an error about "_vwupsrv.exe". I'll try reinstalling TightVNC.
I'll let you know what happens when I reinstalling AntiVir.

[JimmyLoveNYC]

You should hold off for now and not do anything until the pro's from the Cyber Safety forum analyzes your HJT log. They'll know how to guide you and tell you what is wrong with your system do to Viruses that may be on board.

[pwrmngr]

Oh no look whos back Jimmy

[philip biggins]

patch for 6.0 powerdvd where is it on cyberlink