SP2 udate and Virus

i have been working on this problem all week long, any help would be greatly
appreciated, my system is a dell optiplex gx 240. pc had a virus last friday
while i was out of town, virus was w32.conycspa.g@mm, after contacting norton
and removing the virus i then updated to norton antivirus 2006, then noticed
that this pc was still running sp1, then upgraded to sp2 and system seemed to
hang during install, deleted sp2 and then reloaded everything again, pc is
very unstable, ie locks up, task manager shows memory being almost all used
up, very unstable at this point and almost unusable, everytime a shutdown is
done i have to stop ie from running manually, any help will be appreciated,
thanks

From: "don" <>

| i have been working on this problem all week long, any help would be greatly
| appreciated, my system is a dell optiplex gx 240. pc had a virus last friday
| while i was out of town, virus was w32.conycspa.g@mm, after contacting norton
| and removing the virus i then updated to norton antivirus 2006, then noticed
| that this pc was still running sp1, then upgraded to sp2 and system seemed to
| hang during install, deleted sp2 and then reloaded everything again, pc is
| very unstable, ie locks up, task manager shows memory being almost all used
| up, very unstable at this point and almost unusable, everytime a shutdown is
| done i have to stop ie from running manually, any help will be appreciated,
| thanks

You really needed to determine that the PC was completely clean prior to installing SP2.
Often infectors work with peers.



If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/supe...freevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadge...4332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://harrisonrj.home.comcast.net/s...6_Getting_Help


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

1. Uninstall SP2 via Add/Remove Programs and reboot.

2. Run a thorough check for hijackware, including posting your HijackThis
log to an appropriate forum.

Check for Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis (http://aumha.net/downloads/hijackthis.zip)
is the preferred tool to use. It will help you to both identify and remove
any hijackware/spyware.

**Post your HijackThis log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html, http://aumha.net/viewforum.php?f=30 or
other appropriate forum for expert analysis, not here.**

3. Do not install SP2 until an expert gives your HijackThis log a clean bill
of health.

Also see:

What to Know Before Downloading/Installing SP2
http://www.microsoft.com/windowsxp/s...hattoknow.mspx

Installing SP2 Step-by-Step
http://support.microsoft.com/default.aspx?scid=fh;[ln];xpsp2insthowto

Troubleshooting Your Installation
http://support.microsoft.com/default.aspx?scid=fh;[ln];xpsp2insttshoot

WinXP SP2 FAQ: What to do after installing SP2
http://support.microsoft.com/default...xpsp2installed

Service Pack (any) Installation Checklist (MVP Jupiter Jones)
http://www3.telus.net/dandemar/spackins.htm

WinXP SP2-specific Page (MVP Jupiter Jones)
http://www3.telus.net/dandemar/xpsp2.htm

The hard disk space requirements for Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?kbid=837783
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), Aumha.org VSOP, DTS-L.org

don wrote:
> i have been working on this problem all week long, any help would be
> greatly appreciated, my system is a dell optiplex gx 240. pc had a virus
> last friday while i was out of town, virus was w32.conycspa.g@mm, after
> contacting norton and removing the virus i then updated to norton
> antivirus 2006, then noticed that this pc was still running sp1, then
> upgraded to sp2 and system seemed to hang during install, deleted sp2 and
> then reloaded everything again, pc is very unstable, ie locks up, task
> manager shows memory being almost all used up, very unstable at this
> point and almost unusable, everytime a shutdown is done i have to stop ie
> from running manually, any help will be appreciated, thanks