Tech Talk Discuss PC Hardware, Software, Internet and Other Technology

Help, the Russians got me - again!

Old 12-09-12, 08:54 PM
  #1  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Help, the Russians got me - again!

Short background - a couple days ago a McAfee update caused me to lose my internet service. A known McAfee defect according to my cable company so uninstalled it to get my service back and did not reload the antivirus thinking I would get to it.

Apparently I didn't get to it in time.

A couple hours ago I had an "Adobe" update that must have been a Trojan. It cause my pc to lockup showing some "official" message saying I had porn or some other illegal downloads and must wire a fine of $300.

I rebooted into safe mode, found the Russian program in the startup folder, (in the Russian language) shut that down, uninstalled the "adobe" program and rebooted. The message reappeared. Back into safe mode.

A google attempt to get McAfee antivirus (or any other antivirus) produced google in the Russian language. That is a bit disconcerting.

I pulled the net connection from the pc and am now on a clean laptop.

The offending program is located in Vostro\users\appdata\roaming\microsoft etc, etc.

I can't find the \appdata\ folder. Suggestions?
kayak99 is offline  
Old 12-09-12, 09:49 PM
  #2  
DVD Talk Legend
 
Join Date: Apr 2002
Posts: 20,688
Re: Help, the Russians got me - again!

Before scanning:
get rkill to stop potentially compromised programs:
http://www.bleepingcomputer.com/download/rkill/

Microsoft Safety Scanner (stand-alone scanner, turn off mcafee).
http://www.microsoft.com/security/sc...s/default.aspx

Hope that scan finds and fixes some stuff.

Then run malwarebytes
http://filehippo.com/download_malwar..._anti_malware/

See how far you get with that...

I think this was the most recent malware thread if you or others feel like reading it:
http://forum.dvdtalk.com/tech-talk/6...-whatever.html
Ranger is offline  
Old 12-09-12, 09:59 PM
  #3  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Thanks, out of time tonight but I'll try tomorrow.
kayak99 is offline  
Old 12-10-12, 06:57 AM
  #4  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

New morning, new question.

Last I shut off the pc unchecking the offending entry in the startup folder. I rebooted this morning wanting to run the scans Ranger recommended. Still having the internet cable disconnected to the PC, the Russian program is back in the startup folder and trying to load and connect using Internet Explorer.

Is there a way I can stop Explorer from booting up or should I restart in Safe Mode, reconnect to the cable modem and connect to the scans that way.

Back later, thanks!
kayak99 is offline  
Old 12-10-12, 05:06 PM
  #5  
DVD Talk Special Edition
 
danwiz's Avatar
 
Join Date: Dec 2000
Location: Fairbanks, Alaska
Posts: 1,849
Re: Help, the Russians got me - again!

Format & use your latest mirror image to get things going again.
danwiz is offline  
Old 12-10-12, 05:35 PM
  #6  
DVD Talk Legend
 
gcribbs's Avatar
 
Join Date: Aug 1999
Location: Sacramento,Ca,USA member #2634
Posts: 11,963
Re: Help, the Russians got me - again!

If you have a flash drive you could try downloading the programs onto that and plugging that into the computer and see if you can install and run them without getting online.
gcribbs is offline  
Old 12-10-12, 05:41 PM
  #7  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by danwiz View Post
Format & use your latest mirror image to get things going again.
I ended up restoring the pc to an earlier point in time and the problem is gone. Damn Ruskies!

I think I would like to reformat and reload WIndows 7 fresh but haven't reformatted a pc in years. I tried this on a laptop and have to select Windows 7 or Windows 7 each time I boot up. Nope, not a typo!

What's the best way to reformat this Dell Vostro PC and install Windows 7 fresh? I don't have a mirror image but do have all files and programs backed up on an external drive!

Something I am concerned about in a reformat are my Outlook emails. I have a lot I need to save.

Thanks!

Last edited by kayak99; 12-10-12 at 06:02 PM.
kayak99 is offline  
Old 12-10-12, 05:46 PM
  #8  
DVD Talk Hall of Fame
 
Navinabob's Avatar
 
Join Date: Dec 2008
Location: Bay Area, California
Posts: 8,938
Re: Help, the Russians got me - again!

Originally Posted by Ranger View Post
Before scanning:
get rkill to stop potentially compromised programs:
http://www.bleepingcomputer.com/download/rkill/

Microsoft Safety Scanner (stand-alone scanner, turn off mcafee).
http://www.microsoft.com/security/sc...s/default.aspx

Hope that scan finds and fixes some stuff.

Then run malwarebytes
http://filehippo.com/download_malwar..._anti_malware/

See how far you get with that...

I think this was the most recent malware thread if you or others feel like reading it:
http://forum.dvdtalk.com/tech-talk/6...-whatever.html
I'm surprised this step didn't work. Here a few more tips:

http://www.techsupportalert.com/best...an-remover.htm

I also used the Malwarebytes, Threatfire & SUPERAntiSpyware to get rid of a hijack program before. Not fun. Good luck!
Navinabob is offline  
Old 12-10-12, 05:53 PM
  #9  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by gcribbs View Post
If you have a flash drive you could try downloading the programs onto that and plugging that into the computer and see if you can install and run them without getting online.
Good advice. I could have tried that.


Originally Posted by Navinabob View Post
I'm surprised this step didn't work. Here a few more tips:

http://www.techsupportalert.com/best...an-remover.htm

I also used the Malwarebytes, Threatfire & SUPERAntiSpyware to get rid of a hijack program before. Not fun. Good luck!

Problem was, each time I connected to the internet to go to those sites & programs this Trojan redirected me to the Russian website and my screen only showed that "official" fake message. I did what I could offline, went back in time, and now the problem is gone.
kayak99 is offline  
Old 12-10-12, 06:45 PM
  #10  
DVD Talk Limited Edition
 
Join Date: Feb 2000
Location: Sunny Hawaii
Posts: 6,622
Re: Help, the Russians got me - again!

Originally Posted by kayak99 View Post
I did what I could offline, went back in time, and now the problem is gone.
Windows Restore will only rollback system files. The actual malware files could still be present on your hard drive (just not being currently executed), so you should still take all necessary steps to do a full scan of your hard drive.
TheBang is offline  
Old 12-10-12, 06:56 PM
  #11  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by Todd B. View Post
Windows Restore will only rollback system files. The actual malware files could still be present on your hard drive (just not being currently executed), so you should still take all necessary steps to do a full scan of your hard drive.

That's why I have decided to reformat & reinstall Windows 7 fresh. Waiting on advice on best way to accomplish this. Thanks!
kayak99 is offline  
Old 12-10-12, 08:28 PM
  #12  
DVD Talk Legend
 
Join Date: Jan 2000
Posts: 16,173
Re: Help, the Russians got me - again!

Originally Posted by kayak99 View Post
That's why I have decided to reformat & reinstall Windows 7 fresh.
This would be my advice


Waiting on advice on best way to accomplish this. Thanks!
What part do you need guidance on?

Backup existing data (best effort to try and not backup the malware)

make a list of your installed programs (just so you know what to re-install and to find install sources)

I would then use something like DBAN to wipe the drive (no high security wipes, just the basic)

boot to your win 7 dvd and re-install

put your AV tool of choice on

Run windows update

install your apps

copy your data to the new OS
4KRG is offline  
Old 12-10-12, 08:42 PM
  #13  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by 4KRG View Post
This would be my advice




What part do you need guidance on?

Backup existing data (best effort to try and not backup the malware)

make a list of your installed programs (just so you know what to re-install and to find install sources)

I would then use something like DBAN to wipe the drive (no high security wipes, just the basic)

boot to your win 7 dvd and re-install

put your AV tool of choice on

Run windows update

install your apps

copy your data to the new OS
Not sure I can wipe the drive. The Windows 7 disk I have is a upgrade version.

I've backed up everything I want but the program I am concerned about if Outlook and the emails within. I'd like to retain those. Would I back those files up separately then download the latest Outlook and somehow restore those files or just restore the entire Outlook program with files?
kayak99 is offline  
Old 12-10-12, 09:31 PM
  #14  
DVD Talk Legend
 
Join Date: Jan 2000
Posts: 16,173
Re: Help, the Russians got me - again!

Originally Posted by kayak99 View Post
Not sure I can wipe the drive. The Windows 7 disk I have is a upgrade version.
read this, see if it makes sense to you

http://winsupersite.com/article/wind...e-media-128512


I've backed up everything I want but the program I am concerned about if Outlook and the emails within. I'd like to retain those. Would I back those files up separately then download the latest Outlook and somehow restore those files or just restore the entire Outlook program with files?
You need to search your hard drive for *.PST and copy off all the .PST files you find. This file (or files) will be in your user profile

read here (assume outlook 2010)

http://office.microsoft.com/en-us/ou...010354943.aspx

You are not going to download a new copy of outlook from anywhere legally. Hopefully you have an office install disk handy so you can re-install outlook.
4KRG is offline  
Old 12-10-12, 10:05 PM
  #15  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by 4KRG View Post
read this, see if it makes sense to you

http://winsupersite.com/article/wind...e-media-128512


Interesting article. I'll print it off tomorrow! Thanks!



You need to search your hard drive for *.PST and copy off all the .PST files you find. This file (or files) will be in your user profile

read here (assume outlook 2010)

http://office.microsoft.com/en-us/ou...010354943.aspx

You are not going to download a new copy of outlook from anywhere legally. Hopefully you have an office install disk handy so you can re-install outlook.

I do have a copy of Office 2002 someplace, thanks!
kayak99 is offline  
Old 12-11-12, 03:55 AM
  #16  
DVD Talk Special Edition
 
danwiz's Avatar
 
Join Date: Dec 2000
Location: Fairbanks, Alaska
Posts: 1,849
Re: Help, the Russians got me - again!

By Office 2002 I assume you mean Office XP, right? There was no Office 2002. By the way, on my computer (Office 2003) there is only one *PST file - named OUTLOOK.PST. Find that, save it to an external drive (or flash drive or whatever), note where it was installed and then put it back there after you reinstall Windows. Just by chance, it could end up being required in a different place, so maybe the best option after you reinstall Office would be to open Outlook one time to check e-mail and then after shutting it down, search for the new *.PST file and replace that one with the one you saved (above)
danwiz is offline  
Old 12-11-12, 04:39 PM
  #17  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by danwiz View Post
By Office 2002 I assume you mean Office XP, right? There was no Office 2002. By the way, on my computer (Office 2003) there is only one *PST file - named OUTLOOK.PST. Find that, save it to an external drive (or flash drive or whatever), note where it was installed and then put it back there after you reinstall Windows. Just by chance, it could end up being required in a different place, so maybe the best option after you reinstall Office would be to open Outlook one time to check e-mail and then after shutting it down, search for the new *.PST file and replace that one with the one you saved (above)


It's Office XP 2002 version.
kayak99 is offline  
Old 12-11-12, 05:37 PM
  #18  
DVD Talk Legend
 
Join Date: Jan 2000
Posts: 16,173
Re: Help, the Russians got me - again!

Originally Posted by kayak99 View Post
I do have a copy of Office 2002 someplace, thanks!
I was going to tell you to not load it because of it's age, BUT, I was shocked to see this

http://www.microsoft.com/en-us/windo...ofsupport.aspx

looks like it is a supported product until April 8, 2014

If it suits your needs, load away!
4KRG is offline  
Old 12-11-12, 05:55 PM
  #19  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by 4KRG View Post
I was going to tell you to not load it because of it's age, BUT, I was shocked to see this

http://www.microsoft.com/en-us/windo...ofsupport.aspx

looks like it is a supported product until April 8, 2014

If it suits your needs, load away!
On that PC I don't have much need for Office, mostly document use and rarely Excel. That's why I never upgraded the program. I'm having trouble finding that *.PST file. A search doesn't produce. That's the only thing keeping me from moving forward.
kayak99 is offline  
Old 12-11-12, 06:02 PM
  #20  
Premium Member
 
The Cow's Avatar
 
Join Date: Jan 2000
Location: Grazing in a field somewhere...
Posts: 20,642
Re: Help, the Russians got me - again!

The account settings in Outlook will tell you where the data file(s) is located.
The Cow is offline  
Old 12-11-12, 06:13 PM
  #21  
DVD Talk Legend
 
Join Date: Jan 2000
Posts: 16,173
Re: Help, the Russians got me - again!

Originally Posted by kayak99 View Post
On that PC I don't have much need for Office, mostly document use and rarely Excel. That's why I never upgraded the program. I'm having trouble finding that *.PST file. A search doesn't produce. That's the only thing keeping me from moving forward.
info here may help you to locate it (but read below, it may not let you get to it)

http://support.microsoft.com/kb/287070


in order to search (and maybe to get to the PST file at all)

you have to make sure show hidden files is enabled (and maybe even show system files is enabled, can't remember)

These choices will be in your "Folder Options"
4KRG is offline  
Old 12-12-12, 02:29 AM
  #22  
DVD Talk Special Edition
 
danwiz's Avatar
 
Join Date: Dec 2000
Location: Fairbanks, Alaska
Posts: 1,849
Re: Help, the Russians got me - again!

I use a program called ZTreeWin which I could not live without. It shows EVERY file on your computer except System restore files. You can find it at: http://www.ztree.com/. Seems that not so many people use (or even know about) this program, but if you turn off the "a" bit on files after backing them up it's very helpful for backing up files which have changed since you last backed them up. I personally do not have any document, excel, photo files or anything on the C: Drive so it's so easy to log my F: drive at the end of every day and back up what has been changed during the day.
danwiz is offline  
Old 12-13-12, 07:14 PM
  #23  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Got the PST file backed up. Now to reformat. The Russians, well it appears the Chechs, are still around. Even google comes up in their language and attempts to connect & download DBAN gets me redirected.

Given all this, how do you recommend I reformat or clean the drives before I reload Windows 7? I really want these people gone!
kayak99 is offline  
Old 12-13-12, 07:31 PM
  #24  
Senior Member
 
bippitty's Avatar
 
Join Date: Nov 2010
Posts: 958
Re: Help, the Russians got me - again!

When I upgraded to Windows 7, I also upgraded the hard drive. Windows 7 Upgrade installed to an empty hard drive without any difficulty.
bippitty is offline  
Old 12-13-12, 07:40 PM
  #25  
DVD Talk Special Edition
Thread Starter
 
Join Date: Mar 2004
Location: Western PA, Central Florida
Posts: 1,930
Re: Help, the Russians got me - again!

Originally Posted by bippitty View Post
When I upgraded to Windows 7, I also upgraded the hard drive. Windows 7 Upgrade installed to an empty hard drive without any difficulty.
That might actually be a good idea.
kayak99 is offline  

Thread Tools
Search this Thread

Archive Advertising Cookie Policy Privacy Statement Terms of Service

Copyright 2018 MH Sub I, LLC dba Internet Brands. All rights reserved. Use of this site indicates your consent to the Terms of Use.