Internet history

[Guest]

Just a curiosity question....everyday when my computer is is turned on, in
the internet history there is an unusual site address that comes up:
b.whataboutadog (b.whataboutadog.com). If I click on it, I get a blank page.
I have no idea what this is. Can anyone tell me?

 

[John John]

A quick search on the internet reveals this to be added by a trojan, run
an up to date antivirus scan on your machine.
http://vil.nai.com/vil/content/v_143361.htm

John

 

[Guest]

Hi John!
I am running Symantec and just did a live update. What's next?

 

[John John]

Try another AV program or try an online scan from another AV vendor.
Try the instructions here:
http://www.upgradenrepair.com/software/mcafeeonlinescan.htm

If you have a current Symantec/NAV subscription submit a request to them
for assistance.

John

 

[Guest]

I ran Trendmicro Housecall and it did not detect a trojan. I was doing some
research and found that it is suggested to disable the System Restore Utility
as an infected file could be stored in the backup file and a virus scan will
not catch it. When I go to disable, a message comes up that all restore
files will be deleted. This makes me nervous!! Can I get rid of this
problem if I restore from a date prior to when I noticed this problem?

I really appreciate your help!

 

[Guest]

Also, do you advise to delete temp files? If so, do I delete all, some, etc.?

 

[George]

Becky,

Whenever you get infected with a bug you should always turn off Sytsem
Restore to get rid of any bugs inside of those files and then once you do
that just simply turn it back on.

George

 

[Unknown]

Turning off system restore deletes all restore points. Don't you think it
advisable to try some early restore points before deleting them?

 

[Ken Blake, MVP]

Becky,

Whenever you get infected with a bug you should always turn off Sytsem
Restore to get rid of any bugs inside of those files and then once you do
that just simply turn it back on.

I strongly disagree with that advice. For the future, note three
things:

1. An infection in a restore point is completely innocuous *unless*
you restore to that restore point.

2. If you turn off System Restore, you lose *all* restore points, not
just the infected one, and it's possible that you may want or need to
restore to a restore point created before becoming infected.

3. You may even sometimes need to restore to an infected restore
point. Although that's not normally desirable, it can at least give
you the opportunity to remove the infection; without the restore
point, you may have no options at all. As others have said, a leaky
boat is better than no boat at all.

 

[John John]

There is no single AV program that recognizes and deals properly with
all of those pests. When I did my quick search I could only find
information on the trojan on the McAfee site, that is why I suggested
that you try the online scan at the McAfee site, maybe it can find and
repair the infection.

I would not try going back to a restore point if it is much older than
one week. It may not fix anything at all and it may just bug up things
more. If you cannot resolve the problem with the McAfee online scan you
should post to one of the many groups or forums that deal with virus and
AV software, the experts in these groups may be able to help you remove
the trojan manually. The folks at places like TomCoyote or CastleCops
may be able to guide you or suggest other places where you can get more
help.

John

 

[George]

I strongly disagree with that advice. For the future, note three
things:

1. An infection in a restore point is completely innocuous *unless*
you restore to that restore point.

Yes, you should try to guess which one is infected that will work.

2. If you turn off System Restore, you lose *all* restore points, not
just the infected one, and it's possible that you may want or need to
restore to a restore point created before becoming infected.

How do you know which one is infected?

3. You may even sometimes need to restore to an infected restore
point. Although that's not normally desirable, it can at least give
you the opportunity to remove the infection; without the restore
point, you may have no options at all. As others have said, a leaky
boat is better than no boat at all.

A boat with a leak eventually SINKS!

 

[Ken Blake, MVP]

Yes, you should try to guess which one is infected that will work.

How do you know which one is infected?

If you know that your virus problems started last Wednesday, the
restore points from Monday or before are safe to use.

A boat with a leak eventually SINKS!

You miss the point entirely. Having a boat with a leak is better than
no boat at all. Having time to fix the leak is far better than
drowning immediately.

It is foolhardy to discard a restore point that *may* be able to help
you, especially when there's no danger in keeping it. There's plenty
of time to discard it later, *after* the underlying problem has been
solved.

 

[Unknown]

That's like cutting off your hand because of an infection on a finger.
Besides, boats with a big enough pump won't sink.

I strongly disagree with that advice. For the future, note three
things:

1. An infection in a restore point is completely innocuous *unless*
you restore to that restore point.

Yes, you should try to guess which one is infected that will work.

2. If you turn off System Restore, you lose *all* restore points, not
just the infected one, and it's possible that you may want or need to
restore to a restore point created before becoming infected.

How do you know which one is infected?

3. You may even sometimes need to restore to an infected restore
point. Although that's not normally desirable, it can at least give
you the opportunity to remove the infection; without the restore
point, you may have no options at all. As others have said, a leaky
boat is better than no boat at all.

A boat with a leak eventually SINKS!

 

[George]

Yes, you should try to guess which one is infected that will work.

How do you know which one is infected?

If you know that your virus problems started last Wednesday, the
restore points from Monday or before are safe to use.

A boat with a leak eventually SINKS!

You miss the point entirely. Having a boat with a leak is better than
no boat at all. Having time to fix the leak is far better than
drowning immediately.

It is foolhardy to discard a restore point that *may* be able to help
you, especially when there's no danger in keeping it. There's plenty
of time to discard it later, *after* the underlying problem has been
solved.



Ken,

I guess we will have to agree to disagree as if I had a virus on my system
and I knew it could be hiding in my system somewhere I will remove a few
restore points to do so.

I do understand your point as well!

Unknown,

If I knew my infection in my finger was going to cost me an arm or hand you
better bet I will cut it off!

George

 

[Unknown]

But, you don't know if a week old backup is corrupt and you don't know if
the infection will cause you to lose your hand.
I.E. Don't act till you're sure. (don't be rash).

 

[Guest]

Well.....I did run 3 different virus scans with the System Restore off prior
to the many replies (I wanted to get this resolved as quickly as possible and
was a little impatient). Not on of these scans showed any problems. I
googled "whataboutadog" and ran a scan from Paratologic and that showed
Trojans and several severe problems. Why doesn't the regular anti virus
scans pick up on this?

 

[Guest]

Here's where I'm at...I ran THREE different anti-virus scans (Trend
Housecalls, Symantec & McAfee) and none of them showed anything.
Unfortunately or not, I ran these with the System Restore off. However, I
did run a scan from Partologic.com and that showed a bunch of problems. It
won't fix the problems unless I buy their product. But, my big question
is.... why didn't the the other scans show anything? They were all updated
versions.

 

[George]

don't buy it.

Here's where I'm at...I ran THREE different anti-virus scans (Trend
Housecalls, Symantec & McAfee) and none of them showed anything.
Unfortunately or not, I ran these with the System Restore off. However, I
did run a scan from Partologic.com and that showed a bunch of problems.
It
won't fix the problems unless I buy their product. But, my big question
is.... why didn't the the other scans show anything? They were all
updated
versions.