Tuesday, November 02, 2010

Virus "HDDdefragmenter" found: open post

One of my computers has been infected with the HDDdefragmenter virus. It's a big pain! As I kill it off, I'll take notes here on how I did it.

First hint: if you get a message from ANYTHING called "HDDdefragmenter", you've got a problem. Do NOT cooperate with it. Fragmented drives ARE a problem, but this species of malware takes advantage of your natural and prudent desire to do something about it.

Steps I'm taking:
  • I googled for information.
  • I downloaded and ran StopZilla. No noticable effect except Stopzillan works the "dogpile toolbar" is infected; I authorized its recommended procedure. On reboot, same thing, that is, no progress..
  • I downloaded and ran AVG Identity Protection and ran it.
  • Scan is in progress
  • AVG reports some corrupted files and asked whether to quarantine or ignore. I'd prefer to have the option "squish messily dead" but settle for "quarantine".
  • I reboot machine.
  • Problem is still there: HDDdefragmenter gives me more fake warnings.
  • I open AVG dashboard, download virus updates, and run full scan. This took about half an hour, and found no problems. At the same time, HDDdefragmenter continues to send phoney error messages.
  • The computer is no longer connecting to the internet. Perhaps it's time to fry it and rebuild.
  • I left the machine unattended for a while and now it can't access the internet. Multiple boots, same problem.
  • I try purging old files, emptying wastebasket, reloading Windows 7
  • (Did I mention I have all my datafiles backed up to Carbonite? This gives me some confidence I'm not completely toast. Also, I have been relying on the cloud for file storage ... several email accounts have all my work)
  • Now Windows 7 is installed, but it doesn't connect to the wireless network. The network is fine (this laptop is accessing it) but the reloaded computer doesn't see it
  • I call the Costco Concierge (one of the benefits of buying the computer at Costco). They walk me thru a procedure for getting the drivers that are missing. I have to hook the computer up to the modem directly via cable, but otherwise it's just a question of point/click/wait over and over, until done.
  • The machine seems back to normal, except I need to reload my data from Carbonite. I don't want to do a full restore because I suspect at least one file is infected with that HDD thing (above). But I don't see a way to do this. Will it all be for naught?
  • After half a day, Carbonite has restored only about 800 files, less than 2%. And I'm concerned that it'll just restore the virus. So I stop the scan. I need to work
  • I reload Microsoft Office
  • I look for an antimalware solution, settling on Norton as being highly rated, and offering a 3-license pack, enough for the active machines in the house
  • When I try to buy Norton, it tries to peddle otherstuff by offering me a deal - two years at 220% or the price, with Norton Utilities 14.0 thrown in for free (I'm not I was paying $49.95 for one year and they offered two years at $115.95!) I remember Norton Utilities being really nice Way Back When so I was going to go for it, when my B.S. detector ran. In a separate window I research N.U. and didn't like what I found. I don't blame people for upselling but it is ELIMENTARY that the upsold product should be BETTER!
  • As I took the next step in the buying process, Norton threw something into my cart called "Download Insurance". WTF? I looked it up, and it was an even bigger scam than NU 14.0  Under ordinary circumstances, I would have cancelled the transaction right then, but, well, the malware protection I was buying *was* well-rated and the price was right (...now we know why!) so I went ahead. But I'm not impressed.
  • The download was quick enough and I manually started a scan, then went to go make dinner.
  • When I came back, the screen was dark; when I tappd the mouse to see what's up, it was a Blue Screen of Death. WTF?
  • Restart, let Windows do its restore thing, now I'm back to a desktop. Dare I run Norton again?
Windows has been asking for n activation key for several days now, but it didn't accept the key on the sticker on the back of the machine. This is not entirely irrational bcause the Win 7 disk I got from MS for the laptop came as windows 7 pro whereas the computer came as windows 7 home premium.
I tried the Gateway Operating System Disc that came with the machine, putting it into the disc drive and running "setup"; it asked me if I wanted to reinstall the op[erating system and I said yes; it then said I did not have enough space on the system disc.
What appears to be the system disc is the E drive, which is "only" 100 MB, not enough to say "hello world!" with today's bloatware.
I noticed the os disc says it's windows vista, so I assume the product activation key wouldn't work anyway.

suggested http://www.malwarebytes.org/

No comments: