Virus Alert?

[randall_flagg]

No reason to panic, just wanted to give everybody a heads-up. I recently downloaded a tool with the name "han conv" (to convert simplified to traditional and vice versa) from a link that was posted here. I can’t seem to find that thread anymore, though. Anyway, I’ve been hit with a virus, and hit hard. Don’t know if that’s the source, but its one of the few options I can come up with. If you have this programme installed at home, maybe you should do a virus check?

AND: If you do find out that that is the source, could you please let me know?

Thanks. Randall

[roddy]

That program was added to the links directory by gougou - anyone else had any trouble? Have added a note to the entry for now. Randall, can you give any details on the virus or how you found it / what it does?

[randall_flagg]

I found out about the virus when Norton told me that I had a virus. First virus for me, ever! I thought Norton was going to take care of the problem, but it didn’t. The virus somehow disabled Norton. I don’t really know what the virus did, it didn’t delete any files, pretty sure about that (still doing damage assessment, though). But I couldn’t access Microsoft Word and whenever I went online, a XXX page popped up. Suddenly a programme I had never installed started scanning all my files telling me that my computer had a virus infection plus an adware infection and that I should go to this one particular page to download the spy-buster –> and pay with my credit card. Yeah, right, sure! I tried several anti-virus applications but could not run any of them, I guess the virus somehow disabled those. Only one programme by the name of avast! could be installed and after a few tries killed the virus. Or is still killing it, I should say. I know I am still infested, but I can’t seem to do anything permanent about it. Argh!

There are/were two types of viruses: “bloddhound2.0” and a “Trojan downloader” and whenever I do a virus scan, avast! finds a few new ones. Scary stuff!

I so hope it is not the application I mentioned above: I gave that programme to one of my instructors. Yikes!

Right now my computer is functioning just fine…except for that I can’t start the task manager. Ctrl+Alt+Del only tells me that the administrator has disabled the task manager. And that’s bull, cause I didn’t!

Hope everybody else is OK.

Randall

[roddy]

To be honest I really don't think it will be Hanconv - people have been recommending it on here for over six months, with no reports of any trouble. I've dropped notes to the author and gougou to make sure, but I am pretty sure you'll find your problems started elsewhere.

[nipponman]

If you have a virus, I suggest that you reboot your computer in safe mode (that will only run the files that are necessary for th OS) and then do a search (both in the computer and on google for some extra help) on the name of the specific virus files, the google search should provide you with extra names of files. Then when you've found them, you should be able to delete them because they shouldn't be running.

Hope it helps!

[Chinapage]

You may wish to try to detect it with the program winpatrol,

which is highly recommended by PC Magazine. I have

tried it and it does give more detail information than Norton,

which I also use.

They have a free version, and a pro version for $25. I would

try the free first. It is at www.winpatrol.com

Good luck.

Ming

[adrianlondon]

If you know what you're doing ...

Take everything unusual out of the autostart bits. I think there's actually a tool that can help you but if you do it manually, check

1. Start / Programs / Startup

2. C:autoexec.bat (if it exists)

3. The registry. The quickest way to do this is to run "regedit" and then search, keys only, for "runonce". Then look at the "run" entry above this. If you try to search just for "run" you'll be there for hours Export the whole "run" key before you much around wih this.

Then reboot and run your virus checker things.

Also check IE (tools / internet options / programs / manage-add-ons) and disabe the whole lot, putting them back one by one if they look ok. Or just delete them all and let the reload when necessary.

[selfconstruct]

http://www.icycloud.tk/

I've been using hanconv for a couple of years now without problem. Unless the site has been hacked, I doubt this is the source of the virus.

[randall_flagg]

OK, HanConv was probably NOT the source. Phew, good deal, that! Sorry if I scared you for no reason, but I thought better safe than sorry, right?

[roddy]

Ok, will remove the note from its entry.