Help I've Got A Virus

[Noodles]

Today i started up my comp and realized many things had gone wrong. It said it couldn't open the selected patch or load any of my drivers. So I immediatly installed norton antivirus 2002 and got the live updates. Then I restarted my comp and norton poped up and said that I had some virus called backdoor or optix or something I can't really remember and now it won't let me load Norton back up so I really am comfused and need help. Also I can't load any application thats y I am using the other comp in my house.

ps. When I goto run any application it gives me an error saying: Windows cannot access the specified device, patch, or file. You may not have the appropriate permissions to access the term.

HELP MEEE!!!

[Deadlus]

Boot up DOS and delete the virus file through there. In the worst scenario, reinstall windows.

[Aman]

Unfortunately, you may just have to reinstall windows or even format :eek: - If you don't know the filename or can't figure it out then you are lost, and the same thing could happen when you reinstall windows. Most likely, this file is being stored in the windows folder. So all you have left is to reinstall windows, and don't worry you won't lose any information that way.

[NorthViking]

try and use the norton emergency disk, boot it in dos.

[Noodles]

alright i'm back online after all the suggestions you guys gave me I believe it is gone. I now have norton running 24/7 and I am running fine. And I found out the name of the virus, it was called backdoor.optix.1.2 and this thing was killer and i'm still worried about it coming back at me. On the norton website it said that the hacker gets my ip address and can access my files from his comp, any suggestions on how to lock my comp up from this guy hacking back in?

[WorlWydeHusla]

get a firewall to lock your ports BUT this could mean doing extra work to open them up for playing games online but i forgot what kinds you can download i think zonealarm is great

[Aman]

Try to get more info on it and delete the file.

If that doesn't work, get a hardware firewall (such as one found on a linksys router) and set it up. Yes, this would mean that you cannot host servers. You would have to forward each port, but bah that is easy don't worry about that.

[Noodles]

Well the virus is back some how this *instert curse word here* got into my comp again and now I can't run apps again. This is really pissing me off. IF ANYONE HAS HEARD OF THE backdoor.optix.12 VIRUS GIVE ME DETAILS ON HOW TO COMPLETELY REMOVE IT. PPPLLLLLEEEEEAAAAAAAAAASSSSSEEEEE

edit: Ok I have figured something out after many system restores and installing norton. When I instal norton it does all the live updates and what not, but then I have to restart my machine, which seems normal. But when my comp rebots I get all these warnings about there being this virus on my comp. This only seems to happen when I have norton installed. The wierd thing is that I have it installed on my other comp and it seems to work fine. I'm wondering if the live update somehow has hacked into and was given a virus that was sent to me. has anybody ever had this happen to them with norton anti virus 2002?

[-$LaY3!2-]

Noodles:
Consider Checking This out:
http://vil.mcafee.com/alphar.asp

To DEactivate and Delete any File in Use
Click Start>Run> and Type
"regsvr32 c:\windows\FileName.file -u" (without the "")

Reb00t your PC, then you can Delete The Deactivated File.
It May just work for your case.

[NorthViking]

check it up from symantec list.
http://www.symantec.com/avcenter/venc/auto/index/indexB.html

then follow the instructions.

[Noodles]

No that won't work when I try to run any type of program It will give me the crappy error that I has said earlier

Edit: I've been trying the various online virus detection progs because those for sum reason will run. I have found 7 infected files and were able to delete them, I hope they weren't important.

But i'm constantly banging my head against the monitor but it doesn't seem to be working!

another edit: also Molle I have tried the instructions from thier website but they really don't seem to know what this virus really is because it wants me to load up thier live update but with this virus you can't run any prgrams except for explorer(for some odd reason).

[NorthViking]

check if you have InternalSystray %System%\kernel32.exe in your registry.

Backdoor.OptixPro.12

The Trojan creates the value

InternalSystray %System%\kernel32.exe

in the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

so that the Trojan starts each time that you start Windows.

The Trojan attempts to disable antivirus and firewall programs by terminating the active processes.

removal instructions

NOTE: These instructions are for all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.


1. Update the virus definitions.
2. Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: Stop the Trojan process that is running.
3. Run a full system scan, and delete all files that are detected as Backdoor.OptixPro.12.
4. Remove the value

InternalSystray %System%\kernel32.exe

from the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

[Noodles]

like I said before I CAN'T LOAD ANY PROGRAMS, NOT EVEN THE REGISRTY EDITOR. I CAN't RUN REGEDIT.exe or LIVE UPDATE.

edit: I know I have to do that stuff but I am running under xp and it isn't easy to get into safe mode.

[NorthViking]

restart your computer in safe mode, that might help.

press F8 while booting.

[Noodles]

Yes, but how do I do that with xp?

edit: there is no option to press f8 with mine because I have a dell machine and the only things I can do is see the bios or the setup menu which will boot up the drive that I select

[NorthViking]

Click Start, click Shut Down (or Turn Off Computer), in the drop-down list, click Restart, and then click OK (or click Restart).

Use the F8 key. On a computer that is configured for booting to multiple operating systems, you can press F8 when you see the Startup menu.

Use the arrow keys to select the appropriate Safe mode option, and then press ENTER.

just try keep pressing after the memory screen.

[Noodles]

ok but you said something about "On a computer that is configured for booting to multiple operating systems", I only have one operating system on my comp and thats xp. Will f8 still work for me?

edit: well here goes nuthin i'm on my other comp and now i'm restarting the infected comp in safe mode so i can try restoring it to an earlier time, but the f8 option only brings me to the operating system startup menu and then there is no safe mode option after that. So i got into safe mode the hard way, by killing the power when it was starting up windows. It takes way to long to load up safe mode but it eventualy will startup.

[NorthViking]

yes it will still work, i don't have multi boot and F8 works for me.

the info was taken from microsoft site.

[Noodles]

read above edit statement

and the f8 doesn't give me a safe mode option.

[TwoZigzagColt45]

Originally posted by Noodles
so i can try restoring it to an earlier time,

XP has a habit of backing up trojans in the super hidden folder

C:\System Volume Information

every time you do a restore the deleted trojan is put back

its possible to delete restore points but not individual files

you may have to delete all your restore points

:(

[Noodles]

edit: Well now after 12 HOURS of struggling with this virus I believe it is finally gone. I have reinstalled windows and all my files are where they should be and everything is ok. Now thank you all for the help and if you ever need help just drop me a line. Thanks again.