How to safely clean up a sick Win98 machine?
 

I'm the one with the "SpyBot killed my computer" thread going on. Assuming I
get things back to normal again (big assumption right now =:-O), then what?
This computer has not had virus protection for about 6 months on cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed on it,
they appear to never have been ran. How can I back up the system state in 98
so that I can avoid such a huge crash when removal tools don't work? Should
I run SpyBot again on it? Or switch to AdAware? Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better way?
I've never had so much trouble cleaning a machine, but I guess I've never
seen one so badly infected. :-(

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O), then
what?

OK, now that we know you got it back on its feet, it's time for the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed
on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?

By imaging the partition. There is no "System Restore" in Windows 98.
Scanreg saves a few critical configuration files (Registry, System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not Immunize or
Tea TImer, etc. But another person just posted who had the *exact* same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better
way?

You previously said that it had no AV installed. True? If so, then you
have to install *something*. AdAware and Spybot are *not* antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User

SherryB
With regards to anti-virus utilities, most in these Newsgroups would
recommend either :
Avast http://www.avast. com
AVG http://www.grisoft.com
While both of the above are free, I prefer Avast because it also
provides customer service for the free version. If you want to pay for
a product, then I believe eTrust's EZ Armor may be one of the best out
there.I think it may still be available free for one year until
January 31, after which I think the annual subscription is $25-$30.

Over and above AVAST, I run AdAware and Spybot S&D and while I note
that Gary has recommended against it, I do in fact use the IMMUNIZE
option and have had no known trouble doing so over the last year or
so. I would be curious as to the reason for not using it.



"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O),
then what?
This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions
installed on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?
Should
I run SpyBot again on it? Or switch to AdAware? Should I run
another
antivirus scanner on it first? I also have AVG free edition, should
I
install that on there first and scan? Do you guys know of a better
way?
I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

BTW, Gary do you suggest users clean the red, black and green findings from
Spybot -- Search and Destroy.

"Gary S. Terhune" wrote in message
...
: "SherryB" wrote in message
: ...
: I'm the one with the "SpyBot killed my computer" thread going on.
: Assuming I
: get things back to normal again (big assumption right now =:-O), then
: what?
:
: OK, now that we know you got it back on its feet, it's time for the "now
: what?"
:
: This computer has not had virus protection for about 6 months on
: cablemodem,
: and although it has SpyBotS&D and AdAware's latest versions installed
: on it,
: they appear to never have been ran. How can I back up the system
: state in 98
: so that I can avoid such a huge crash when removal tools don't work?
:
: By imaging the partition. There is no "System Restore" in Windows 98.
: Scanreg saves a few critical configuration files (Registry, System.ini,
: Win.ini and maybe MSDOS.SYS) but that is scant protection.
:
: Should
: I run SpyBot again on it? Or switch to AdAware?
:
: Spybot *should* be OK if all you run is a normal scan, not Immunize or
: Tea TImer, etc. But another person just posted who had the *exact* same
: problem you did after running Spybot, so I have to wonder. Did you
: *only* run the scanner and remove the items it suggested?
:
: AdAware is much safer than Spybot. Yes, I would run it.
:
: Should I run another
: antivirus scanner on it first? I also have AVG free edition, should I
: install that on there first and scan? Do you guys know of a better
: way?
:
: You previously said that it had no AV installed. True? If so, then you
: have to install *something*. AdAware and Spybot are *not* antivirus
: applications.
:
: I've never had so much trouble cleaning a machine, but I guess I've
: never
: seen one so badly infected. :-(
:
: See my articles:
:
: "Clean Boot--What it is and why you need it."
: http://grystmill.com/articles/cleanboot.htm
:
: "Security!"
: http://grystmill.com/articles/security.htm
:
: --
: Gary S. Terhune
: MS MVP Shell/User
:
:

SherryB, I use AntiVir and I have found it to be okay but I am planning on
taking advantage of E-Trust's special deal for $12.45 of antivirus and
software firewall before January 31, 2005 for their deluxe package.

"SherryB" wrote in message
...
: I'm the one with the "SpyBot killed my computer" thread going on. Assuming
I
: get things back to normal again (big assumption right now =:-O), then what?
: This computer has not had virus protection for about 6 months on
cablemodem,
: and although it has SpyBotS&D and AdAware's latest versions installed on
it,
: they appear to never have been ran. How can I back up the system state in
98
: so that I can avoid such a huge crash when removal tools don't work?
Should
: I run SpyBot again on it? Or switch to AdAware? Should I run another
: antivirus scanner on it first? I also have AVG free edition, should I
: install that on there first and scan? Do you guys know of a better way?
: I've never had so much trouble cleaning a machine, but I guess I've never
: seen one so badly infected. :-(

I remove Red entries, I don't remove Green entries. I don't know what a
"Black" entry is.

But I also look at the items I remove as a sanity check. I don't let
*any* utility tell me what to do. I only let it *suggest* what to do.

--
Gary S. Terhune
MS MVP Shell/User

"Dan" wrote in message
...
BTW, Gary do you suggest users clean the red, black and green findings
from
Spybot -- Search and Destroy.

I don't recommend the Immunize function because I don't trust it. Also
because it's damned difficult to undo. It bit me once, and that's the
only chance it gets. I use Spyware Blaster, instead.

--
Gary S. Terhune
MS MVP Shell/User

"Dapper Dan" wrote in message
...
SherryB
With regards to anti-virus utilities, most in these Newsgroups would
recommend either :
Avast http://www.avast. com
AVG http://www.grisoft.com
While both of the above are free, I prefer Avast because it also
provides customer service for the free version. If you want to pay for
a product, then I believe eTrust's EZ Armor may be one of the best out
there.I think it may still be available free for one year until
January 31, after which I think the annual subscription is $25-$30.

Over and above AVAST, I run AdAware and Spybot S&D and while I note
that Gary has recommended against it, I do in fact use the IMMUNIZE
option and have had no known trouble doing so over the last year or
so. I would be curious as to the reason for not using it.



"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O),
then what?
This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions
installed on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?
Should
I run SpyBot again on it? Or switch to AdAware? Should I run
another
antivirus scanner on it first? I also have AVG free edition, should
I
install that on there first and scan? Do you guys know of a better
way?
I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

Good point! Also, a black entry is when certain files have been determined
to be missing by Spybot -- Search and Destroy.

"Gary S. Terhune" wrote in message
...
: I remove Red entries, I don't remove Green entries. I don't know what a
: "Black" entry is.
:
: But I also look at the items I remove as a sanity check. I don't let
: *any* utility tell me what to do. I only let it *suggest* what to do.
:
: --
: Gary S. Terhune
: MS MVP Shell/User
:
: "Dan" wrote in message
: ...
: BTW, Gary do you suggest users clean the red, black and green findings
: from
: Spybot -- Search and Destroy.
:
:

Thanks Gary.
Followed the related thread below and was once again impressed with
yet another success story. Looks like SherryB has got that monster up
and running again.

"Gary S. Terhune" wrote in message
...
I don't recommend the Immunize function because I don't trust it.
Also
because it's damned difficult to undo. It bit me once, and that's
the
only chance it gets. I use Spyware Blaster, instead.

--
Gary S. Terhune
MS MVP Shell/User

"Dapper Dan" wrote in message
...
SherryB
With regards to anti-virus utilities, most in these Newsgroups
would
recommend either :
Avast http://www.avast. com
AVG http://www.grisoft.com
While both of the above are free, I prefer Avast because it also
provides customer service for the free version. If you want to pay
for
a product, then I believe eTrust's EZ Armor may be one of the best
out
there.I think it may still be available free for one year until
January 31, after which I think the annual subscription is
$25-$30.

Over and above AVAST, I run AdAware and Spybot S&D and while I
note
that Gary has recommended against it, I do in fact use the
IMMUNIZE
option and have had no known trouble doing so over the last year
or
so. I would be curious as to the reason for not using it.



"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going
on.
Assuming I
get things back to normal again (big assumption right now =:-O),
then what?
This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions
installed on it,
they appear to never have been ran. How can I back up the syste
m
state in 98
so that I can avoid such a huge crash when removal tools don't
work?
Should
I run SpyBot again on it? Or switch to AdAware? Should I run
another
antivirus scanner on it first? I also have AVG free edition,
should
I
install that on there first and scan? Do you guys know of a
better
way?
I've never had so much trouble cleaning a machine, but I guess
I've
never
seen one so badly infected. :-(

Hi Gary,

A couple questions before I attack this beast today:

1. How do I image the partition? Is there anything built in to Win98 to do
that, or any free tools to do it? I don't have Ghost, but I know it can do
that.

2. What happens to the trojan that Stinger supposedly removed and the first
few spyware/adware that SpyBot supposedly removed before the crash? Are
parts of them still there since the registry has been restored?

And a couple answers to your questions:

Yes, I only ran Spybot's normal scan and removed the items it suggested. No
Immunize, no Tea Timer. (That's why I was shocked when it did what it did.)
Although I use Immunize on my own 2 computers and have never had any trouble
with it.

By "another virus scanner", I meant besides Stinger.exe. This computer used
to have an old old McAfee with old old DAT files. A virus (I think) disabled
it, and a friend who knows less about computers than I do told him to just
delete some of its files. I think they finally got it uninstalled, because I
don't see it in Add/Remove Programs. Anyway, I suspected viruses might be
its worst problem that's why I started out with Stinger. I think I'll
install AVG on it and see what it finds too (plus show him how to get new DAT
files!!!)

Thank you so much for your help! :-)

"Gary S. Terhune" wrote:

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O), then
what?

OK, now that we know you got it back on its feet, it's time for the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed
on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?

By imaging the partition. There is no "System Restore" in Windows 98.
Scanreg saves a few critical configuration files (Registry, System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not Immunize or
Tea TImer, etc. But another person just posted who had the *exact* same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better
way?

You previously said that it had no AV installed. True? If so, then you
have to install *something*. AdAware and Spybot are *not* antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User