October 17, 2004
Advice Needed I

My sparse production over the last few weeks is mostly because of computer problems, specifically a virus that seems to have infected my machine late on September 8th, though most of the damage was done on the 9th. (I blame Dan Rather!) Here are some questions some of you may be able to help with:

  1. One of the earliest files to arrive was named DyFuCa -- I forget the file-type. Would that be pronounced "Die, Fucka'!"? That's certainly how I feel about the virus, it's creator, and everyone involved in its delivery.
  2. Is there any reason why I shouldn't delete every file and directory in the /Windows/Temp and /TemporaryInternetFiles directories? I don't care if the latter slows down my browsing. I'm just worried that some of the subdirectories may be required somehow.
  3. What good is Norton software? Their virus sweep takes 10 hours to run, finds anywhere from 907 to 1438 infected files each time, and then invariably reports that it is unable to delete a single one of them. When I delete them by hand using the instructions on their website, they are all back the next day. (Actually, there are always two I'm unable to delete, since they are apparently running all the time, but Norton gives no hint as to how to kill the processes so I can delete them.) Meanwhile, Norton's virus sweep has slowed down my system pitifully: it used to take 3 1/2 minutes to load Word (mostly for the Greek keyboard and PDF plug-ins) and 2 seconds to open a Word file. Now it takes a ridiculous 8 minutes and 30 seconds respectively. Should I ask for my money back?
  4. The virus seems to be trying to communicate behind my back. Whenever I boot up I get a popup telling me that my log-on has failed and asking if I want to 'work offline', when I haven't tried to log on yet. I use dial-up and very much object to having my machine try to log on before I tell it to. When I do log on, Internet Explorer keeps opening itself and popping up windows trying to sell me stuff: this is particularly annoying since I'm mostly using Opera now. I would deinstall Explorer and stick with Opera, but (a) I've heard that IE is so tightly integrated with Windows that that might cause other essential software to stop working, and (b) some sites don't work on Opera. Examples of point b are Sgt. Stryker, where the text column is only an inch wide, and Tim Blair, where I can't even read the comments, much less add one of my own. I suppose I need to get hold of Firefox.
  5. If some kind of keystroke logging is going on, can it log keystrokes that are provided as defaults? I mean if a site has given me a 'remember password' option so that I never have to type it in again, can I safely go to such a page and log on with a button, without revealing it to a keystroke-logging virus? I'm using that method with Movable Type right now, but have been afraid to do it with any site that has my credit card information, such as Amazon or eBay.

By the way, please do not recommend any of the following:

  1. Buying a new computer. I'm between jobs, so unless you're planning to send me the money for a new one, this is not an option in the near future.
  2. Reinstalling Windows 98. I don't have the installation disks: I stupidly forgot to ask the dealer why they weren't included when I bought the machine six years ago. I also have no way of backing up everything essential: not enough Zip drives and some files are too large for them anyway. Even if I could back everything up, I would probably be backing up some of the virus files, which would defeat the purpose of the exercise. Should I upgrade to Windows 98 SE? That would allow me to buy a back-up device that I could later use with my next machine, either a CD writer or a peripheral hard drive, neither of which works with Windows 98 non-SE. Do they even sell Windows 98 SE any more? If so, is it inexpensive? Most important, would it take care of my problems?
  3. Reformatting my hard drive. See previous point.

I'll have more questions soon, so if anyone is feeling helpful and well-informed, please check back. I'm also working on another spin-off website that many of you will find interesting. More on both topics soon.

Posted by Dr. Weevil at October 17, 2004 10:45 PM
Comments

I just downloaded some anti-spyware to my bosses' computer (he is.... ummm... technology challenged. With a great deal of coaching, he can be brought to tell the difference between a phillips head and a straight blade screwdriver.) which was afflicted with a plague of popups and god knows what else. Try www.download.com, and the free version of Ad-Aware SE Personal. It runs a very effecient search, and once I had everything quarantined and deleted--- a perfectly amazing amount of cookies and other nasties--- it fixed a lot of problems with speed and intrusive ads.

Posted by: Sgt. Mom on October 18, 2004 05:47 PM

Doc,

Some things I'd recommend:

1) That Ad-Aware as above -- it's at lavasoft.de. Good stuff. Run it first.

2) Also, SpyBot Search & Destroy @ spybot.info. Similar to Ad-Aware, has a real-time module to prevent future infections. Run it second.

3) Try running both of the above, and Norton, in Windows Safe Mode. SpyBot can actually override all start parameters and attack spyware / viruses at startup time. Very slick.

4) Try finding Win98, 2000, or XP at a used bookstore for the re-install. It's an option, at least.

5) I don't know how to disable IE completely in W98 -- that was the most irritating feature of W98.

6) Can you use Task Manager to kill the offending processes? Right-click on Start Bar for TM.

7) Get one of the newer free AV programs. CNet has a list of them.

Hope that helps...if you can't upgrade the PC or one of the newer Win OSes, then Linux is definite option. It runs real well on the older platforms, and they have done a good job of making the desktops Windows-user friendly. The installs are even not that tough, but they can be initimidating if you're not a Unixy guy.

Posted by: Scott Chaffin on October 18, 2004 06:44 PM

I agree with the above posters - adaware and spybot for the spyware, perhaps AVG antivirus (free!) as a backup to Norton, and running this stuff in safe mode since fewer background processes mean a quicker scan.
That said, have you defragged recently? A fragmented disk can make a really performance big hit on older hard drives and processors. Do a scandisk first.
Win98 doesn't really require much in the way of backgroud processes - you can kill almost everything without stopping the system.
Start Up stuff - try here, they've quite a list of win98 tips, including dialup control:
http://www.isctex.com/support/win98tip.htm
Finally, are you SURE you don't have the OS? Some pc's come with a copy on a separate 'hidden' partition on the disk. If you've the serial MS may send you new disks for 'media cost' ($25, hah!)
Yard Sales are a great resource for os'es at $10 a pop, by the way.
Generally I've found that 'bit rot' ruins a heavily used win98 install in about 18 months or so...

Posted by: ed on October 19, 2004 10:22 PM

Pretty much agree with the above - you should not have to wipe your system, reboot windows, or g-d forbid buy a Mac or shift to Linux.

Three useful ideas that have worked wonders for my own merry nest:

1) Ad-Aware and Spybot S&D are excellent, if what
you have is spyware (and it sounds very much like
it). These will get the bloody thing off your box in the first place, so that you can move on to...

2) Stop using IE and Outlook Express - there are free alternatives downloadable from the web that just do not fall for this crap. I use Mozilla Firefox/Thunderbird for web/mail. Opera is also very good. They have a lot more built-in protection against loading virii and pop-up windows than IE or Outlook.

3) Norton is utterly useless, in my experience. Buy something else. I use Trend Micro Internet Security, downloadable, and you can obtain a [paid] license on-line in no time. It is fast, effective, unobtrusive, and updates its library two or three times a day, or whenever it suits you.

Hope that helps, and you can fix your box quickly.

Posted by: Fcb on October 20, 2004 12:58 AM

Sounds like you've got a big pile of spyware running as well as a virus or three.

Very first thing you want to do is boot into Safe Mode before running Norton (or AVG), followed by Ad-Aware and SpyBot Search & Destroy (SpyBot & Ad-Aware find different things, so running them both is useful.)

Safe mode only loads the bare essentials of Win98, so the infected programs (with luck) won't be running, and gives your virus scanner a head start.

Posted by: Eric on October 21, 2004 11:49 AM

You can delete the contents of the Temporary Internet Files folder from Control Panel/Internet Settings/Delete Files.

In general, you can delete anything in Windows/Temp with a date stamp before your last bootup.

Posted by: CGHill on October 21, 2004 09:23 PM

If you can update to Windows 98SE it will help with the stability of your system; when you're virus free, if you do the 'Windows Update' thing, it should update it if it's still available (can't remember if Microsoft actually went through with their 'we will no longer support' it thing); barring that, I'm going to be doing a pile of installations of Windows SE when a certain tech guy sends me the disk. Drop me a line if you need the 'last resort' treatment. Definitely get (and run) Ad Aware; definitely get (and run) Spybot. Run Norton, quarantine/delete what you can, but take note of which virus it claims is coming up. Run Norton again and if it comes up again, search on the web for a 'removal tool'. If viruses keep coming back, it's usually because some change has been made to a registry item or that there's some program loading at startup which reloads the virus -- Ad Aware should catch this sort of thing, but you never know.

Posted by: rogueclassicist on October 22, 2004 05:36 AM

A few months ago I had to help someone remove a worm from their machine. I can't remember what OS they were running (probably XP).

I recall having to shut off a certain type of DCOM service to disable the critter, via an option about 15 layers deep in the Control Panel. Then I could kill a certain process, manually remove some registry keys that caused it to start automatically, blah blah. Sorry but my memory is hazy.

Just for grins why not check out this webpage: http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html I'm not claiming that it's the right answer, but the right answer is probably something similar.

And while you're at it, see if you can account for everything that's running automaticallly in Windows - check your registry for keys like HKEY_CURRENT_USER\Software\Microsft\Windows\CurrentVersion\Run.

Doing a ctl/alt/del will bring up a list of processes in Win98 if I recall correctly. You can probably Google every process on it to see what's running and what might be fishy. If nothing else you'll learn a few things about how Norton and Win98 work, anyway.

Good luck!

Posted by: J Bowen on October 29, 2004 02:32 PM