WWA Info Exchange

Duane's computer is infected with Win32/nuqel.E and it's "friends" I thought we had Malwarebytes on his machine but we don't

It will not allow Internet Explorer to open, therefore I can't download anything, me in my great wisdom tried to email him a link for Malwarebytes thinking maybe that would get thru, but nope no go.

We have Avast and can run it and it showed 12 viruses and got rid of them but it will not work on the malware.

I can reboot and get off and on, plus I can reboot in safe mode, I just have no idea where to go from here.

One thought I had was to purchase a Malware disk and see if it would let it run.

Also while I was running a virus scan a Viagra webpage and a "p o r n" one were popping up, so that might be another issue.

He is totally computer illiterate and I am only a little better, he said that yesterday while he was clicking on bear pictures (yes bear, not bare) on a hunting website is when he first noticed the fake warnings popping up. Also he thought he might have seen one pop up when he was on Facebook, I just signed him up there yesterday, so I think the problem just started.

Anyway-----any clues???

Vicki

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

Ouch. Sorry he/you got tagged. Facebook and other social networking sites have become popular attack vectors lately, and the badguys are getting better at their craft. Can't help solve it for you, but Microsoft has some info on their site that might help. Just search for the Win32/nuqel.E in the security section.

PS: Just thought of something. Don't know if this will work, but maybe you could make a bootable CD with Malwarebytes on it, and run that on his machine on boot up. You should be able to install a new copy of it on CD during the setup when it asks you for what directory/drive you want it on.

_________________
I bring to life, I bring to death:
The spirit does but mean the breath:
I know no more. (Tennyson, In Memoriam)

Gene, I downloaded to a zip drive and tried to install on his computer, but as soon as it starts running the malware zaps it.

Vicki

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

I don't think you understood what I was suggesting. You shouldn't need to "install" it on his PC. Just run it as a standalone program from a boot disc. Used to be able to do this with Norton and other security software anyway. That way the program should be able to protect itself, especially if you can make the disc read only.

_________________
I bring to life, I bring to death:
The spirit does but mean the breath:
I know no more. (Tennyson, In Memoriam)

All I can say is Google is your friend. I have fixed all the viruses that I have come across, (mine and friends that ask me to help) by just using Google. Type in your exact virus or error message and you can usually find a solution.

_________________
Dan

No matter where you go, There you are.

If you can run in safe mode with internet, try the free scan offered by Microsoft. http://onecare.live.com/site/en-us/default.htm. Do the full service scan. This will take care of most problems like this. It works with either XP or Vista, maybe 7 also although I have not tried it with 7.

If you can't run safe mode with networking (internet), try the command prompt and then "msconfig". Go to Startup and disable everything listed. Restart the computer. This should temporarily disable the virus, and enable you to make the internet connection to the Microsoft site above. Do the scan.

If this doesn't work, download CCleaner on another computer, burn it to a disk and load it on the infected computer. The virus will usually not have CCleaner blocked and you will be able to access the Startup with it. Disable Startup and do the Microsoft scan as above.

After everything is fixed, go back to Startup with the command prompt and enable whatever you want. I keep this to a minimum. Only Avast is really necessary.

_________________
Jess
my gallery
more photos

Sorry, link should be:

http://onecare.live.com/site/en-us/default.htm

_________________
Jess
my gallery
more photos

Can you hear me screaming?????

I have tried everything and now think that I really have it screwed up.

Jess, nothing worked, finally got it "tricked' into letting CC Cleaner run, it kept saying it was a virus, anyway got to msconfig, got that going, then a program that I put on yesterday that was suggested on a google search HItman pro finally ran, said it found various things, told me to hit continue or whatever and restart.

It would still not let an internet connection connect so could not download no matter what.

Anyway I restarted the computer and all I get is windows starting and then the plain screen, no icons, nothing. Tried in safe mode, it too stays plain.

I must have the screen of death, I don't know what all is on it but sure have no idea what to try now with nothing but a plain screen.

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

Does the screen show any writing, or is it blank? What color?

An interrupted startup sequence (blue screen) will usually show writing. It is normally triggered by a registry or hardware problem. Repeatedly trying to restart might get it going, but the problem would still be there.

I am unclear on the sequence of events you tried. You mentioned CCleaner and msconfig. Both of these are separate ways of accessing the Startup screen and disabling programs that start when the machine is turned on, hopefully including the virus program. Were you able to reach the Startup screen with either of these methods? If you did, did you disable everything and then restart the machine?

After you get the blank screen, have you tried Ctrl-Alt-Delete to bring up the task manager window? If you can get task manager, Go to Applications/New task and enter Explorer.exe

The problem could be caused by overheating. Can you hear the fan running?

_________________
Jess
my gallery
more photos

Viagra and then a porno pop sounds so familiar!

That one got me when I forgot to re-initiate Norton after an update from Windows. But when I ran a scan, Norton zapped it. Got the infection at Woodworkers' Forum, apparently. He go there?

Norton did not give it the same name, but the coincidence of the popups seems too great. Don't know what it does for IE, because I mostly use Firefox. Have to keep IE on the machine, even though it's not default browser, because MSoft ware wants it for updates.

Sounds like you're crunched by now. I think that one might proliferate with repeated reboots, like some others.

Jess, I tried your steps, could not get into internet explorer, it said that there was no internet connection. Then tried msconfig, it told me it was infected with a virus and wouldn't let me proceed.

then I downloaded CC Cleaner to a zip and installed on his computer, after many reboots and fast finger action==seems like if you are quick enough you get ahead of the thing and managed to run CC Cleaner. That allowed me to do msconfig and I unchecked everything under start up and restarted. Then I kept getting a message about changing startup, it finally seemed to reboot. Before I had a chance to try the page you suggested, HITMAN PRO which was suggested on Google (I had managed to download it off my zip the night before seemed start running and said it found several things and "click here" to get rid of them and restart. So I did, got more messages about messing with startup, then just when I thought it was all good, the dang screen.

The Screen I get is a green screen with a crossbow target crosshairs in it---It is Duanes background, he has no idea how he got it, but has had it for a year or so, probably clicked something on a hunting page that made it his background.

It has no desktop icons, and there is no tray at the bottom or any toolbars on the top.

I can start in safe mode but it just goes to the same screen.


I'm thinking take it to work and let the guys run over it with the big excavators or something

Vicki

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

I seem to be stuck, I still can get no internet connection, I was able to get the icons back by doing C/Alt/Del.

Startup only has avast checked, but can't do anything without internet, I don't know if it is the malware/virus or if there is actually a problem with his internet connection, as you can see it is fine on my end.

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

Hummmm, I think Jess should call Vicki, or Vicki should call Jess........landline or cell.....or even use the Chat feature on the WWA to commuicate real time (on Vicki's computer, not Duane's).

I can certainly understand Vicki's frustration, but I sure don't know how to help.

Verna

What operating system are you running on the infected computer (XP, Vista, Windows 7)?

Do the following (probably repetition here from before)

1. Turn off the machine, unplug it from the wall. Wait at least one minute.
2. Turn on the machine.
3. Start CCleaner
4. On the left side of CCleaner opening screen, click on TOOLS, then STARTUP
5. In the STARTUP list, disable everything except Avast.
6. Close CCleaner. Ignore any messages about the Startup.
7. Shut down the computer. Wait one minute
8. Start the computer. Let it finish whatever it is doing until it stops.
9. If it does a normal Start, Click Internet Explorer and enter the link indicated in previous message in the address location. Run the scan. May take 1-2 hours.
10. If you get the blank screen again instead of the normal start, do the Ctrl-Alt-Delete and see if you get the normal icons. Click Internet explorer, enter the link, and do the scan.
11. If you don't get the normal icons, type and enter Explorer.exe (NOT Internet Explorer). This should give you regular program listing. Find and start Internet explorer. Enter link. Run scan. Follow instructions.

To summarize: The idea is to isolate the virus from STARTUP, allowing you to go to the Microsoft link and do the scan which will remove the virus (we hope).

If, after all the above, you still cannot access the internet, it means your connection has been disabled some way. Probably not the virus because most virus's I have experienced have not yet blocked CCleaner, and many virus's are structured to use the internet. It is possible this is a hardware problem and none of the above will help.

However, the above is worth a try. Let me know.

If CCleaner will not start, you can go through the same process above, but using COMMAND PROMPT/MSCONFIG/STARTUP instead of CCleaner to access the STARTUP screen.

_________________
Jess
my gallery
more photos

I forgot to add that the COMMAND PROMPT/MSCONFIG approach is often blocked by the virus which is why CCleaner is a better choice to access the STARTUP screen.

_________________
Jess
my gallery
more photos

Jess, Windows XP I will try this again when I get a chance.

Thanks tons

Vicki

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

Vicki -

This is a long shot and may not apply since I'm on dialup and have to configure DUN for my connection to, uh, connect. Recently I had a bogus file identified by the computer tech where I took the machine for maintenance. He installed the update to the OS (Windows XP Home Edition) which wiped out my dialup configuration. The icon was still on the desktop but nothing happened when I clicked on it. Ended up deleting the old network connection for the dialup and creating a new one then I was off to the races once again. I have no idea how broadband Internet connections are configured but perhaps the answer lies therein??

_________________
Nullum Gratuitum Prandium

Cheers - Dennis

Vickie,

Since Duane has XP, go to start, run, type in mrt dot exe, using the appropriate symbol for dot. It will take a minute or so to pop up. It is set for quick scan. Let it run. When it has located all of the baddies, it will have you restart (I think), and then it will have you run a complete scan. The complete scan will take a couple of hours + to run. BTW, mrt dot exe is located in the system 32 folder. You can also click on it from there.

Another thing that you can do, but is somewhat risky, is to turn off system restore - from the system folder in control panel. Then do a reboot, and turn it back on. Everything that is in system restore, will come back each time the computer is turned on. Avast and the others usually cannot touch stuff in system restore. Thus, turning it off temporarily, gets rid of all the stuff that needs to go bye bye.

Good luck. Hope this helps.

Trisha

_________________

~First light brings a new day, new hope, new wisdom, & a chance to start fresh again-JSM
~Welcome to all new members! & welcome back to the others!
~He is most powerful who has power over himself - Seneca

Well, yesterday I tried again.

Jess, I got as far and #9--when I click on Internet Explorer it comes up but grinds away and then I get the message no connection, also in the bottom task bar the little computer icon thingy shows no connection.

Dennis, we are having that looked into today Duane called our local small telephone office, who handles our internet, and they are trying to see if it is computer related or just something not right.
I tried unplugging everything and restarting but get the same no connection.

Trish, I will have to try that if we can't get anything figured out.

It is sooo frustrating.

Vicki

_________________
Whoever said nothing is impossible, never tried slamming a revolving door....

My impression, somehow, is that you have two computers there, both supposed to have the same internet connection (home network). One will connect, but not the other (Duane's). Is this correct?

Apparently, you are able to run CCleaner. Try doing it's scan (Paintbrush looking icon highlighted, click on "Run Cleaner" lower right). When that finishes, highlight "Registry" on left, click on "scan for issues", then fix all). Also, try running the scan Trisha suggested (mrt.exe).

There is also always the possibility that the actual internet connection is messed up, and not simply blocked by a virus.

Can you reach the restore screen? (Accessories/System Tools/Restore). If so, try a restore point prior to the problem appearing.

_________________
Jess
my gallery
more photos