How to safely clean up a sick Win98 machine?

I'm the one with the "SpyBot killed my computer" thread going on. Assuming I
get things back to normal again (big assumption right now =:-O), then what?
This computer has not had virus protection for about 6 months on cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed on it,
they appear to never have been ran. How can I back up the system state in 98
so that I can avoid such a huge crash when removal tools don't work? Should
I run SpyBot again on it? Or switch to AdAware? Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better way?
I've never had so much trouble cleaning a machine, but I guess I've never
seen one so badly infected. :-(

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O), then
what?

OK, now that we know you got it back on its feet, it's time for the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed
on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?

By imaging the partition. There is no "System Restore" in Windows 98.
Scanreg saves a few critical configuration files (Registry, System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not Immunize or
Tea TImer, etc. But another person just posted who had the *exact* same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better
way?

You previously said that it had no AV installed. True? If so, then you
have to install *something*. AdAware and Spybot are *not* antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User

BTW, Gary do you suggest users clean the red, black and green findings from
Spybot -- Search and Destroy.

"Gary S. Terhune" wrote in message
...
: "SherryB" wrote in message
: ...
: I'm the one with the "SpyBot killed my computer" thread going on.
: Assuming I
: get things back to normal again (big assumption right now =:-O), then
: what?
:
: OK, now that we know you got it back on its feet, it's time for the "now
: what?"
:
: This computer has not had virus protection for about 6 months on
: cablemodem,
: and although it has SpyBotS&D and AdAware's latest versions installed
: on it,
: they appear to never have been ran. How can I back up the system
: state in 98
: so that I can avoid such a huge crash when removal tools don't work?
:
: By imaging the partition. There is no "System Restore" in Windows 98.
: Scanreg saves a few critical configuration files (Registry, System.ini,
: Win.ini and maybe MSDOS.SYS) but that is scant protection.
:
: Should
: I run SpyBot again on it? Or switch to AdAware?
:
: Spybot *should* be OK if all you run is a normal scan, not Immunize or
: Tea TImer, etc. But another person just posted who had the *exact* same
: problem you did after running Spybot, so I have to wonder. Did you
: *only* run the scanner and remove the items it suggested?
:
: AdAware is much safer than Spybot. Yes, I would run it.
:
: Should I run another
: antivirus scanner on it first? I also have AVG free edition, should I
: install that on there first and scan? Do you guys know of a better
: way?
:
: You previously said that it had no AV installed. True? If so, then you
: have to install *something*. AdAware and Spybot are *not* antivirus
: applications.
:
: I've never had so much trouble cleaning a machine, but I guess I've
: never
: seen one so badly infected. :-(
:
: See my articles:
:
: "Clean Boot--What it is and why you need it."
: http://grystmill.com/articles/cleanboot.htm
:
: "Security!"
: http://grystmill.com/articles/security.htm
:
: --
: Gary S. Terhune
: MS MVP Shell/User
:
:

I remove Red entries, I don't remove Green entries. I don't know what a
"Black" entry is.

But I also look at the items I remove as a sanity check. I don't let
*any* utility tell me what to do. I only let it *suggest* what to do.

--
Gary S. Terhune
MS MVP Shell/User

"Dan" wrote in message
...
BTW, Gary do you suggest users clean the red, black and green findings
from
Spybot -- Search and Destroy.

Good point! Also, a black entry is when certain files have been determined
to be missing by Spybot -- Search and Destroy.

"Gary S. Terhune" wrote in message
...
: I remove Red entries, I don't remove Green entries. I don't know what a
: "Black" entry is.
:
: But I also look at the items I remove as a sanity check. I don't let
: *any* utility tell me what to do. I only let it *suggest* what to do.
:
: --
: Gary S. Terhune
: MS MVP Shell/User
:
: "Dan" wrote in message
: ...
: BTW, Gary do you suggest users clean the red, black and green findings
: from
: Spybot -- Search and Destroy.
:
:

Hi Gary,

A couple questions before I attack this beast today:

1. How do I image the partition? Is there anything built in to Win98 to do
that, or any free tools to do it? I don't have Ghost, but I know it can do
that.

2. What happens to the trojan that Stinger supposedly removed and the first
few spyware/adware that SpyBot supposedly removed before the crash? Are
parts of them still there since the registry has been restored?

And a couple answers to your questions:

Yes, I only ran Spybot's normal scan and removed the items it suggested. No
Immunize, no Tea Timer. (That's why I was shocked when it did what it did.)
Although I use Immunize on my own 2 computers and have never had any trouble
with it.

By "another virus scanner", I meant besides Stinger.exe. This computer used
to have an old old McAfee with old old DAT files. A virus (I think) disabled
it, and a friend who knows less about computers than I do told him to just
delete some of its files. I think they finally got it uninstalled, because I
don't see it in Add/Remove Programs. Anyway, I suspected viruses might be
its worst problem that's why I started out with Stinger. I think I'll
install AVG on it and see what it finds too (plus show him how to get new DAT
files!!!)

Thank you so much for your help! :-)

"Gary S. Terhune" wrote:

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O), then
what?

OK, now that we know you got it back on its feet, it's time for the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed
on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?

By imaging the partition. There is no "System Restore" in Windows 98.
Scanreg saves a few critical configuration files (Registry, System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not Immunize or
Tea TImer, etc. But another person just posted who had the *exact* same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better
way?

You previously said that it had no AV installed. True? If so, then you
have to install *something*. AdAware and Spybot are *not* antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User

Well, I looked around and did not see any free fully functional partition
imaging products. So I went ahead and installed AVG. It found 2 different
boot sector viruses, but I could not clean them because I don't have an AVG
recovery disk. :-( What should I do about that? I chose "continue at my
own risk", which allowed it to continue booting up. It is running full scan
now, and so far has found 12 viruses. Its scaring me, I wish there were some
way to back it up before removing the viruses. It doesn't have a CD-RW, only
a diskette drive.
Should I cancel the scan?

"SherryB" wrote:

Hi Gary,

A couple questions before I attack this beast today:

1. How do I image the partition? Is there anything built in to Win98 to do
that, or any free tools to do it? I don't have Ghost, but I know it can do
that.

2. What happens to the trojan that Stinger supposedly removed and the first
few spyware/adware that SpyBot supposedly removed before the crash? Are
parts of them still there since the registry has been restored?

And a couple answers to your questions:

Yes, I only ran Spybot's normal scan and removed the items it suggested. No
Immunize, no Tea Timer. (That's why I was shocked when it did what it did.)
Although I use Immunize on my own 2 computers and have never had any trouble
with it.

By "another virus scanner", I meant besides Stinger.exe. This computer used
to have an old old McAfee with old old DAT files. A virus (I think) disabled
it, and a friend who knows less about computers than I do told him to just
delete some of its files. I think they finally got it uninstalled, because I
don't see it in Add/Remove Programs. Anyway, I suspected viruses might be
its worst problem that's why I started out with Stinger. I think I'll
install AVG on it and see what it finds too (plus show him how to get new DAT
files!!!)

Thank you so much for your help! :-)

"Gary S. Terhune" wrote:

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O), then
what?

OK, now that we know you got it back on its feet, it's time for the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions installed
on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?

By imaging the partition. There is no "System Restore" in Windows 98.
Scanreg saves a few critical configuration files (Registry, System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not Immunize or
Tea TImer, etc. But another person just posted who had the *exact* same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition, should I
install that on there first and scan? Do you guys know of a better
way?

You previously said that it had no AV installed. True? If so, then you
have to install *something*. AdAware and Spybot are *not* antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User

No, don't cancel the scan. If removing the virus trashes the system,
then it's trash already. Best thing to do if that happens is swap out
that hard drive, put in a new drive, use a floppy-based AV on the new
drive before installing a completely new system, protect that system to
the hilt, then put back in the old drive to copy off personal files. Run
AV scan on the old drive after putting it back in as slave, first, of
course.

--
Gary S. Terhune
MS MVP Shell/User

"SherryB" wrote in message
...
Well, I looked around and did not see any free fully functional
partition
imaging products. So I went ahead and installed AVG. It found 2
different
boot sector viruses, but I could not clean them because I don't have
an AVG
recovery disk. :-( What should I do about that? I chose "continue
at my
own risk", which allowed it to continue booting up. It is running
full scan
now, and so far has found 12 viruses. Its scaring me, I wish there
were some
way to back it up before removing the viruses. It doesn't have a
CD-RW, only
a diskette drive.
Should I cancel the scan?

"SherryB" wrote:

Hi Gary,

A couple questions before I attack this beast today:

1. How do I image the partition? Is there anything built in to
Win98 to do
that, or any free tools to do it? I don't have Ghost, but I know it
can do
that.

2. What happens to the trojan that Stinger supposedly removed and
the first
few spyware/adware that SpyBot supposedly removed before the crash?
Are
parts of them still there since the registry has been restored?

And a couple answers to your questions:

Yes, I only ran Spybot's normal scan and removed the items it
suggested. No
Immunize, no Tea Timer. (That's why I was shocked when it did what
it did.)
Although I use Immunize on my own 2 computers and have never had any
trouble
with it.

By "another virus scanner", I meant besides Stinger.exe. This
computer used
to have an old old McAfee with old old DAT files. A virus (I think)
disabled
it, and a friend who knows less about computers than I do told him
to just
delete some of its files. I think they finally got it uninstalled,
because I
don't see it in Add/Remove Programs. Anyway, I suspected viruses
might be
its worst problem that's why I started out with Stinger. I think
I'll
install AVG on it and see what it finds too (plus show him how to
get new DAT
files!!!)

Thank you so much for your help! :-)

"Gary S. Terhune" wrote:

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going
on.
Assuming I
get things back to normal again (big assumption right now =:-O),
then
what?

OK, now that we know you got it back on its feet, it's time for
the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions
installed
on it,
they appear to never have been ran. How can I back up the
system
state in 98
so that I can avoid such a huge crash when removal tools don't
work?

By imaging the partition. There is no "System Restore" in Windows
98.
Scanreg saves a few critical configuration files (Registry,
System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not
Immunize or
Tea TImer, etc. But another person just posted who had the *exact*
same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition,
should I
install that on there first and scan? Do you guys know of a
better
way?

You previously said that it had no AV installed. True? If so, then
you
have to install *something*. AdAware and Spybot are *not*
antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess
I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User

Thanks, it made it and is still booting up ok. I'm going to connect it to
the internet now and get AVG updates and run it again. (It wasn't obvious
how to manually update AVG's DAT files and those were from 6/2004.)

"Gary S. Terhune" wrote:

No, don't cancel the scan. If removing the virus trashes the system,
then it's trash already. Best thing to do if that happens is swap out
that hard drive, put in a new drive, use a floppy-based AV on the new
drive before installing a completely new system, protect that system to
the hilt, then put back in the old drive to copy off personal files. Run
AV scan on the old drive after putting it back in as slave, first, of
course.

--
Gary S. Terhune
MS MVP Shell/User

"SherryB" wrote in message
...
Well, I looked around and did not see any free fully functional
partition
imaging products. So I went ahead and installed AVG. It found 2
different
boot sector viruses, but I could not clean them because I don't have
an AVG
recovery disk. :-( What should I do about that? I chose "continue
at my
own risk", which allowed it to continue booting up. It is running
full scan
now, and so far has found 12 viruses. Its scaring me, I wish there
were some
way to back it up before removing the viruses. It doesn't have a
CD-RW, only
a diskette drive.
Should I cancel the scan?

"SherryB" wrote:

Hi Gary,

A couple questions before I attack this beast today:

1. How do I image the partition? Is there anything built in to
Win98 to do
that, or any free tools to do it? I don't have Ghost, but I know it
can do
that.

2. What happens to the trojan that Stinger supposedly removed and
the first
few spyware/adware that SpyBot supposedly removed before the crash?
Are
parts of them still there since the registry has been restored?

And a couple answers to your questions:

Yes, I only ran Spybot's normal scan and removed the items it
suggested. No
Immunize, no Tea Timer. (That's why I was shocked when it did what
it did.)
Although I use Immunize on my own 2 computers and have never had any
trouble
with it.

By "another virus scanner", I meant besides Stinger.exe. This
computer used
to have an old old McAfee with old old DAT files. A virus (I think)
disabled
it, and a friend who knows less about computers than I do told him
to just
delete some of its files. I think they finally got it uninstalled,
because I
don't see it in Add/Remove Programs. Anyway, I suspected viruses
might be
its worst problem that's why I started out with Stinger. I think
I'll
install AVG on it and see what it finds too (plus show him how to
get new DAT
files!!!)

Thank you so much for your help! :-)

"Gary S. Terhune" wrote:

"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going
on.
Assuming I
get things back to normal again (big assumption right now =:-O),
then
what?

OK, now that we know you got it back on its feet, it's time for
the "now
what?"

This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions
installed
on it,
they appear to never have been ran. How can I back up the
system
state in 98
so that I can avoid such a huge crash when removal tools don't
work?

By imaging the partition. There is no "System Restore" in Windows
98.
Scanreg saves a few critical configuration files (Registry,
System.ini,
Win.ini and maybe MSDOS.SYS) but that is scant protection.

Should
I run SpyBot again on it? Or switch to AdAware?

Spybot *should* be OK if all you run is a normal scan, not
Immunize or
Tea TImer, etc. But another person just posted who had the *exact*
same
problem you did after running Spybot, so I have to wonder. Did you
*only* run the scanner and remove the items it suggested?

AdAware is much safer than Spybot. Yes, I would run it.

Should I run another
antivirus scanner on it first? I also have AVG free edition,
should I
install that on there first and scan? Do you guys know of a
better
way?

You previously said that it had no AV installed. True? If so, then
you
have to install *something*. AdAware and Spybot are *not*
antivirus
applications.

I've never had so much trouble cleaning a machine, but I guess
I've
never
seen one so badly infected. :-(

See my articles:

"Clean Boot--What it is and why you need it."
http://grystmill.com/articles/cleanboot.htm

"Security!"
http://grystmill.com/articles/security.htm

--
Gary S. Terhune
MS MVP Shell/User

SherryB
With regards to anti-virus utilities, most in these Newsgroups would
recommend either :
Avast http://www.avast. com
AVG http://www.grisoft.com
While both of the above are free, I prefer Avast because it also
provides customer service for the free version. If you want to pay for
a product, then I believe eTrust's EZ Armor may be one of the best out
there.I think it may still be available free for one year until
January 31, after which I think the annual subscription is $25-$30.

Over and above AVAST, I run AdAware and Spybot S&D and while I note
that Gary has recommended against it, I do in fact use the IMMUNIZE
option and have had no known trouble doing so over the last year or
so. I would be curious as to the reason for not using it.



"SherryB" wrote in message
...
I'm the one with the "SpyBot killed my computer" thread going on.
Assuming I
get things back to normal again (big assumption right now =:-O),
then what?
This computer has not had virus protection for about 6 months on
cablemodem,
and although it has SpyBotS&D and AdAware's latest versions
installed on it,
they appear to never have been ran. How can I back up the system
state in 98
so that I can avoid such a huge crash when removal tools don't work?
Should
I run SpyBot again on it? Or switch to AdAware? Should I run
another
antivirus scanner on it first? I also have AVG free edition, should
I
install that on there first and scan? Do you guys know of a better
way?
I've never had so much trouble cleaning a machine, but I guess I've
never
seen one so badly infected. :-(