Malware remnants

[Brian in Vegas]

I recently did battle with some fake virus alert malware, and after
successfully eradicating them, I find that my C: drive and my ZIP (D drive
are no longer listed in the My Computer Folder. How do I get them back in
there. I currently have created shortcuts on my desktop so I can still
access them but can't seem to figure out how to restore them to the My
Computer folder. Also, I still have a "VIRUS ALERT!" message displayed next
to my clock in the taskbar on my desktop and have no idea how to get rid of
that either.

THe malware popups ahve ceased and everything else is working just fine.

HELP!

Thanks in advance,
Brian

 

[Ronaldo]

"Tweak UI" under My Computer\Drives, check the boxes nest to the drive
letters.

Microsoft PowerToys for Windows XP
http://www.microsoft.com/windowsxp/Downloads/powertoys/Xppowertoys.mspx



OR... Open a command prompt window (Start\All Programs\Accesories\Command
Prompt)

In the command window:
Type: DISKPART
Next to DISKPART> type; "LIST VOLUME" and hit Enter
A list of volumes or drives appears with volume number and letter (or
probably no letter on the system drive in your case)...

Next to DISKPART> type: "SELECT VOLUME #" (the number that corresponds
to
the system drive) and hit Enter
Now type: "ASSIGN LETTER C" and hit Enter, and type EXIT.

To put it simple... just open a command window and type five small commands

DISKPART
LIST VOLUME
SELECT VOLUME #
ASSIGN LETTER C
EXIT

 

[Malke]

I recently did battle with some fake virus alert malware, and after
successfully eradicating them, I find that my C: drive and my ZIP (D
drive
are no longer listed in the My Computer Folder. How do I get them back in
there. I currently have created shortcuts on my desktop so I can still
access them but can't seem to figure out how to restore them to the My
Computer folder. Also, I still have a "VIRUS ALERT!" message displayed
next to my clock in the taskbar on my desktop and have no idea how to get
rid of that either.

THe malware popups ahve ceased and everything else is working just fine.

If you still have the message displayed in the Notification Area, your
computer is not clean.

Because you didn't give me the name of the program that is trying to get you
to buy it, I can't point you to specific removal steps. Look for them here:

Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html ]

If you have XP Antivirus 2008/09, here are removal steps:

http://www.bleepingcomputer.com/malware-removal/uninstall-antivirus-2009
http://www.bleepingcomputer.com/forums/topic154529.html (earlier versions)

These may work for you and all may be well. However, in many cases the
computer will also be infected with Zlob and/or Vundo trojans and protected
by a rootkit. These machines are extremely difficult to clean.

If your machine is one of these cases, either get guided help at one of the
specialty forums below OR back up your data and do a clean install of
Windows. It is your choice. If you are unsure how to back up your data or
how to do a clean install, you can take your machine to a local computer
professional. I don't recommend using BigComputerStore/GeekSquad types of
places.

PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS.

http://aumha.org/downloads/hijackthis.zip
http://aumha.net/ - Click on the HijackThis forum. Read the announcement and
the stickies *first*.
http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/
http://www.thespykiller.co.uk/index.php?board=3.0
http://forums.subratam.org/index.php?showforum=7

If you have already gone through the above steps but did not register at one
of the forums to get guided help, that would be your next step.

Malke

 

[The Real Truth MVP]

Use my Remove-it software, it will remove the rest of that malware from your
system choose yes for all options when prompted. Also use the Explorer shell
fix tool from the same page. Download it here
http://pcbutts1.com/downloads/tools/tools.htm

 

[PA Bear [MS MVP]]

Ignore this MVP imposter, Brian!

For some background on this well-known thief, see David Lippman's posts in
this thread:
http://groups.google.com/group/micr..._frm/thread/5172ca5571f3e54f/656904085932c872

Specifically
http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e
and
http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f

 

[David H. Lipman]

From: "Brian in Vegas" <Brian in (e-mail address removed)>

| I recently did battle with some fake virus alert malware, and after
| successfully eradicating them, I find that my C: drive and my ZIP (D drive
| are no longer listed in the My Computer Folder. How do I get them back in
| there. I currently have created shortcuts on my desktop so I can still
| access them but can't seem to figure out how to restore them to the My
| Computer folder. Also, I still have a "VIRUS ALERT!" message displayed next
| to my clock in the taskbar on my desktop and have no idea how to get rid of
| that either.

| THe malware popups ahve ceased and everything else is working just fine.

| HELP!

| Thanks in advance,
| Brian

I haven't seen that one in a couple of months.

Go to; Control panel --> Regional and Language Options

Choose; Customize... --> Time

Find; "Time format:"

Change; h:mm:ss tt Virus Alert !
to; h:mm:ss tt

Click on "Apply" and the "Ok"

 

[David H. Lipman]

From: "PA Bear [MS MVP]" <[email protected]>

| Ignore this MVP imposter, Brian!

| For some background on this well-known thief, see David Lippman's posts in
| this thread:
| http://groups.google.com/group/microsoft.public.security.homeusers/browse_frm/thread/
| 5172ca5571f3e54f/656904085932c872

| Specifically
| http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e
| and
| http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f
| --
| ~Robear Dyer
| MS MVP-IE, Mail, Security, Windows Desktop Experience
| https://mvp.support.microsoft.com/default.aspx/profile/robear.dyer


Thanx Robear!

 

[Ronaldo]

Download a VBS script from Kelly's Korner that removes all past icons from
the notification area.

Scroll down to line 53.. and dowload file; "Remove Past Items From
Notification Area"
http://www.kellys-korner-xp.com/xp_tweaks.htm


----------------------------------------------------

 

[PA Bear [MS MVP]]

From: "PA Bear [MS MVP]" ...

Ignore this MVP imposter, Brian!

For some background on this well-known thief, see David Lippman's posts
in
this thread:
http://groups.google.com/group/microsoft.public.security.homeusers/browse_frm/thread/
5172ca5571f3e54f/656904085932c872

Specifically
http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e
and
http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f

Thanx Robear!

YW. It's my newest PCButts1 canned response! Thanks for posting that
background.

 

[David H. Lipman]

| YW. It's my newest PCButts1 canned response! Thanks for posting that
| background.

I'm sending you an email.

 

[The Real Truth MVP]

The only truth in any of those links you posted is that Ian's site was taken
down because the thief David's stolen software. And the fact that David
admits to being a troll. More truth about him and his ways can be found here
http://pcbutts1-therealtruth.blogspot.com/ and it was the technology that I
created that was sold not a batch file like David wants everyone to believe.


--
Ignore any posts made by the Stalker Leythos, he's still in love with me.
He started stalking me after I spurned his advances towards me.
He said he would stop Stalking me If I stopped mentioning his name.
As you can see that does not work. He is a sick obsessive STALKER.

 

[The Real Truth MVP]

I know what you are planning David and it won't work. When you fail again I
will post it here.


--
Ignore any posts made by the Stalker Leythos, he's still in love with me.
He started stalking me after I spurned his advances towards me.
He said he would stop Stalking me If I stopped mentioning his name.
As you can see that does not work. He is a sick obsessive STALKER.