Unfortunate situation

[Aulirophile]

Recently someone apparently took issue with my posts on Enworld because they, somehow, installed some kind of virus on my computer that every few hours retypes my posts. As you can imagine, with the random inputs, mouse movements, clicking, typing, etc., it makes the computer unusable.

I'd really like to ask that person to help me in removing this virus. I've tried and, barring assistance, I intend to reformat... which will cost me many hours of work.

I had actually intended to stop posting on Enworld because I was generally not being well received, and this situation has dragged me back.

I'd like to ask the mods not to move this post, because obviously whoever did this posts or lurks in 4e discussion, as that is the only place I posted.

Sorry to bother those who are not involved.

 

[Eridanis]

Aulirophile - I'm sorry to hear your system got tagged with malware, but you haven't posted here since the 13th and I don't see any duplicate posts from you. Do you have a specific example you can link to?

(In the meantime, I'd recommend running two freeware apps, Malwarebyes and SuperAntiSpyware, for starters, to try to clear your system. Clean your cache as well. If you have Windows 7, you can download MS Security Essentials, which I've found very good. Win XP has its own problems, of course...)

 

[Aulirophile]

Aulirophile - I'm sorry to hear your system got tagged with malware, but you haven't posted here since the 13th and I don't see any duplicate posts from you. Do you have a specific example you can link to?

I don't mean on Enworld. I mean the virus literally has an input loop of my posts in them and types them. So if I'm in, say, a text editor program working on document, suddenly it'll start typing something I posted on Enworld. And that is the key bit, 95% of the text is Enworld posts I made, so it seems like a reasonable assumption that it came from here.

EDIT: To address your addition, for which I thank you, I have run every single major AV on the market and several minor ones. Spybot, Malware Bytes, CCleaner, both of the windows tools, and updated everything... and it hasn't gotten rid of it. I'll try SuperAntiSpyware as I haven't yet.

 

[malraux]

I don't mean on Enworld. I mean the virus literally has an input loop of my posts in them and types them. So if I'm in, say, a text editor program working on document, suddenly it'll start typing something I posted on Enworld. And that is the key bit, 95% of the text is Enworld posts I made, so it seems like a reasonable assumption that it came from here.

EDIT: To address your addition, for which I thank you, I have run every single major AV on the market and several minor ones. Spybot, Malware Bytes, CCleaner, both of the windows tools, and updated everything... and it hasn't gotten rid of it. I'll try SuperAntiSpyware as I haven't yet.

I use avast on my windows partition, but no idea how good it is.

All that said, its hard to specifically say it was someone from enworld. It could be just some weird trojan/keylogger that isn't working right and is trying to report back its data incorrectly. Or some weird windows driver spazing out.

I'd go with a fresh install regardless because I'd never trust the system again.

 

[Aulirophile]

I use avast on my windows partition, but no idea how good it is.

All that said, its hard to specifically say it was someone from enworld. It could be just some weird trojan/keylogger that isn't working right and is trying to report back its data incorrectly. Or some weird windows driver spazing out.

I'd go with a fresh install regardless because I'd never trust the system again.

Since viruses can hide in nearly anything, especially if you don't know which virus you're looking for, that would mean I couldn't necessarily trust any files I tried to save, some of which are irreplaceable. So while a complete reformat without knowing the actual virus would fix the problem... it'd also result in losing things I can't actually replace, if I wanted to be thorough.

I ran Avast. And Norton, Zonealarm, BitDefender... dozens of them. If it was in the top20 in C.net in the last three years. I've spent days dealing with this, so far. Which is the reason I believe it is an individual, viruses that you can just pick up are well known and removable.

 

[Colmarr]

FWIW, Aulirophile, you have my thoughts.

This is a horrible way to treat a forum poster, and I hope you get it sorted as quickly and painlessly as possible.

 

[storm_wolf]

Have you tried the scans in safe mode under a different user account? I have found that you will get much better results if you do. Also, if you have a wireless keyboard have you tried pulling the batteries from it and putting them back in?

 

[RLBURNSIDE]

Time to re-format, dude

It only takes an hour or two for most casual PCs. I bet you have a boatload of apps installed that have been used once, as do I and everyone else on the planet. 99% of the time is spent in 1% of your apps (probably a browser or word processor, judging by the sounds of it).

That said, reformatting is not necesserily going to prevent you from getting re-infected. I'd boot from a live CD and scan from there. Nuke the pests from orbit, only way to be sure

 

[Aulirophile]

It only takes an hour or two for most casual PCs. I bet you have a boatload of apps installed that have been used once, as do I and everyone else on the planet. 99% of the time is spent in 1% of your apps (probably a browser or word processor, judging by the sounds of it).

That said, reformatting is not necesserily going to prevent you from getting re-infected. I'd boot from a live CD and scan from there. Nuke the pests from orbit, only way to be sure

No, I have less then a dozen things installed... I uninstall things I don't use. But viruses can hide in files. I can spend a couple of hours reformatting and not erase any of my personal files... but the odds are pretty good I'd just be reinfected by them, since this thing is obviously tenacious. And those files are not replaceable. So.

I've done safe mode scans (dozens of them). Not under a different account, but I can try that I suppose. Not a wireless keyboard (though I'm not sure how that'd matter... some hundred lines of text are way over the memory buffer).

Booting into an OS from a CD and running a scan from there isn't a bad idea.

 

[Obryn]

I ah... Don't know how anyone would have targeted your machine with a virus. That's usually not the sort of thing you can target at someone without, say, directly sending you an infected file. (In which case, you know who sent it.) And if virus scanners aren't picking it up, someone went to a ridiculous amount of trouble to do it. Which I think is unlikely.

If Windows antimalware solutions aren't picking anything up, you can always try a scanner which runs under Linux. ClamAV is one example.

My guess is that there's something else going on with your PC, and that nobody specifically has it out for you. I could be wrong, but this sort of thing isn't generally possible. And it sounds like it'd take more work than a random dude on a messageboard is usually worth.

Reformatting isn't that big a deal. While a virus could, in theory, "hide" in a random file, odds are you wouldn't run into any real problems if you copy your entire filesystem over to a new install of Windows. Make sure your OS, Java and Adobe are updated to the most recent possible, and you have blocked out 99% of the attack vectors possible.

-O