Hi everyone, quite a long description here, trying to be thorough. Any assistance you can provide would be most welcome.
Last night I clicked on a link (nothing particularly dodgy), and my laptop froze for a minute, before McAfee brought up a message saying that one of my files had been infected with a virus it called New Win32. I immediately ran a scan and it found a few of my system files were infected (winlogon.exe, csrss.exe and a couple of others), so I put them into quarantine.
However, when looking through the files myself (I'm a computing student, so I know my way around a computer pretty well, but my knowledge of complex virus removal is pretty limited), I found that in the Prefetch folder there were a lot of system files mentioned, including regedit.exe, which I'll go into more detail about in a minute. Around this time it also brought up an advert for SysGuard, which I closed and removed the executable file behind it.
I found a few other virus executable files, all of which I deleted. Then I went into regedit to see if I could find any registry keys that shouldnt be there. I didnt find anything at first, but suddenly my laptop decided to shut down, without me having told it to.
I reloaded in safe mode, but when I'm in safe mode it doesnt show me the taskbar at the bottom, just my desktop icons. I also can't seem to run many programs. For example, McAfee VirusScan won't run at all, and SuperAntiSpyware starts to run but then nothing comes up (although it does sit in the processes running). I tried to get onto the internet, but even when running safe mode with networking, I couldnt get a connection. I did manage to run Spybot, and it found a lot of things, mostly tracking cookies, but a few virus files, including one that was something to do with a Sentry (I shouldve written them down, but was very angry at this point). Also in Spybot, I found that there was an entry in System Startup for sysguard.exe, so I removed it.
I later ran Spybot again after reloading (again to safe mode), and it found sysguard again in the startup list. However, I did then find another set of virus files I hadnt seen before and removed them, I think they were causing it.
Something that did puzzle me was that the processes such as , which on my main computer are listed as being part of winlogon.exe, are listed on my laptop as being from system.ini. Could this be the virus in action?
When trying to load Windows normally, it hangs on the welcome screen for a long time, then finally shows me a blank desktop. It gives me the impression that it is loading, just very slowly. However, I don't want to just leave it like that because it seems like it's a virus doing stuff in the background.
Basically, does anyone have any suggestions as to what I can do, other than wiping the disk? I should also mention that although I got a CD from Dell when I bought my laptop, I'm not sure where it is, so I don't have access to my original Windows CD.
Many thanks for any help you can provide.
Edited by garmanma, 20 March 2009 - 12:26 PM.