Virus infection on a T60 ==> how best to reinstall Windows..

ship wrote:
> Well I spoke to Lenovo and they want to sting me for GBP 40.00 for an
> installation disk.
> I refuse point blank to do this partly as a matter of principle and
> partly because it will
> proably take a while for the CD to arrive by post.
>
> I have dug out the number from Control Panel > System > General Tab
> which looks like this
>
> 99999-OEM-9999999-99999
>
> (except with actual numbers instead of "9"s)
>
> I also spoke to Microsoft who were extremely insistent that using a
> different CD would
> definitely fail to work (I suspect that they are probably fibbing).
>
> Apparently I will to give them an "Installation ID" (9 groups of 6
> digits), and they will then need to give me
> a "Confirmation ID"
>
> I've not followed any of the links above yet - will they be able to
> generate a "Product Key" or
> "Confirmation ID" ?
>
> I am slightly hazy about what all these "IDs" and "Keys" are and where
> and when they are
> required by Windows XP. The spare CD I have comes from my old PC. It
> is definitely a
> genuine Windows XP Professional CD, and I have the product key for
> *it* (but I presume
> that it wont work...) Wait a minute - *yes* on the back of the Lenovo
> Laptop is indeed
> a "product key", and with 5 groups of 5 characters. Looks promising
>
> Is there anything else that I need to do ?
>
> i.e. do I still need the likes of
> [URL="http://magicaljellybean.com/keyfinder/"]http://magicaljellybean.com/keyfinder/[/URL]
> or do I now have the information that I need?
>
> * * *
>
> But as some of you imply, MAYBE there is not need to format the
> Windows installation partition.
> But just how hard can it be for a virus to write to a hidden
> partition? NOT hard I would imagine.
> If I was writing a virus that is exactly the sort of thing I would get
> it to do to ensure that it
> survived a re-formatting of the C: drive... but what do I know?
>
> Ship (OP)

Look at it like this.. if malware is written to the installation
partition, what would it matter unless there were a rootkit, or Windows
malware to address it. It could only be activated if you installed from
that partition. Then if you were to find malware on the new
installation, you could suspect something on the installation partition.

So just deal with your current infections.. heck, the CD's I suggested
probably check that partition anyway.
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

Elmo wrote:
> ship wrote:
>> Well I spoke to Lenovo and they want to sting me for GBP 40.00 for an
>> installation disk.
>> I refuse point blank to do this partly as a matter of principle and
>> partly because it will
>> proably take a while for the CD to arrive by post.
>>
>> I have dug out the number from Control Panel > System > General Tab
>> which looks like this
>>
>> 99999-OEM-9999999-99999
>>
>> (except with actual numbers instead of "9"s)
>>
>> I also spoke to Microsoft who were extremely insistent that using a
>> different CD would
>> definitely fail to work (I suspect that they are probably fibbing).
>>
>> Apparently I will to give them an "Installation ID" (9 groups of 6
>> digits), and they will then need to give me
>> a "Confirmation ID"
>>
>> I've not followed any of the links above yet - will they be able to
>> generate a "Product Key" or
>> "Confirmation ID" ?
>>
>> I am slightly hazy about what all these "IDs" and "Keys" are and
>> where and when they are
>> required by Windows XP. The spare CD I have comes from my old PC. It
>> is definitely a
>> genuine Windows XP Professional CD, and I have the product key for
>> *it* (but I presume
>> that it wont work...) Wait a minute - *yes* on the back of the Lenovo
>> Laptop is indeed
>> a "product key", and with 5 groups of 5 characters. Looks promising
>>
>>
>> Is there anything else that I need to do ?
>>
>> i.e. do I still need the likes of
>> [URL="http://magicaljellybean.com/keyfinder/"]http://magicaljellybean.com/keyfinder/[/URL]
>> or do I now have the information that I need?
>>
>> * * *
>>
>> But as some of you imply, MAYBE there is not need to format the
>> Windows installation partition.
>> But just how hard can it be for a virus to write to a hidden
>> partition? NOT hard I would imagine.
>> If I was writing a virus that is exactly the sort of thing I would
>> get it to do to ensure that it
>> survived a re-formatting of the C: drive... but what do I know?
>>
>> Ship (OP)
>
> Look at it like this.. if malware is written to the installation
> partition, what would it matter unless there were a rootkit, or
> Windows malware to address it. It could only be activated if you
> installed from that partition.

I'm pretty sure that that was Ship's point. A few people, including
yours truly, suggested he simply use the hidden restore partition. I
highly doubt that the malware writers targeted *his* particular PC
model. I am sure the partition is just fine! Also, he made another post
and I'm pretty sure there was no evidence his OS even had an infection;
that is, his AV program found suspect files in the the temp directory
and unopened e-mail attachments. I'm not convinced he has a problem at
all.
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

What's the "real truth" about pcbutts1? Read on...

.. Is he an MS MVP? No!
cf. [URL="http://mvp.support.microsoft.com/communities/mvp.aspx"]http://mvp.support.microsoft.com/communities/mvp.aspx[/URL]

.. If xxx.ms-mvp.org redirects to xxx.pcbutts1.com, why didn't he post that
link to begin with?

.. Is he a proven thief? Yes!
cf.
[URL="http://groups.google.com/group/microsoft.public.security.virus/browse_frm/thread/58e6c02dbc6279ad"]http://groups.google.com/group/microsoft.public.security.virus/browse_frm/thread/58e6c02dbc6279ad[/URL]
cf.
[URL="http://msmvps.com/blogs/hostsnews/archive/2006/11/10/pcbutts1-_2E00__2E00_.-the-saga-continues-_2E00__2E00__2E00_.aspx"]http://msmvps.com/blogs/hostsnews/archive/2006/11/10/pcbutts1-_2E00__2E00_.-the-saga-continues-_2E00__2E00__2E00_.aspx[/URL]
cf.
[URL="http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e"]http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e[/URL]
cf.
[URL="http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f"]http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f[/URL]

.. What do real experts have to say about him? It ain't pretty.

[URL="http://www.siteadvisor.com/sites/pcbutts1.com"]http://www.siteadvisor.com/sites/pcbutts1.com[/URL] (Reviews)

[URL="http://www.digg.com/security/PCButts1_Under_Attack"]http://www.digg.com/security/PCButts1_Under_Attack[/URL]

[URL="http://www.siteadvisor.com/sites/pcbutts1.com"]http://www.siteadvisor.com/sites/pcbutts1.com[/URL]

[URL="http://bughunter.it-mate.co.uk/PCBUTTS.TXT"]http://bughunter.it-mate.co.uk/PCBUTTS.TXT[/URL]

[URL="http://www.mywot.com/en/scorecard/pcbutts1.com"]http://www.mywot.com/en/scorecard/pcbutts1.com[/URL]

[URL="http://www.mywot.com/en/scorecard/www.ms-mvp.org"]http://www.mywot.com/en/scorecard/www.ms-mvp.org[/URL]

.. Does he have all his marbles?
cf. [URL="http://en.wikinews.org/wiki/NASA_van_rolls_off_California_mountain"]http://en.wikinews.org/wiki/NASA_van_rolls_off_California_mountain[/URL]

Ignore this MVP imposter! No one in their right mind (and Paddy isn't)
would tell you it's OK to have 2 anti-virus apps installed & loading at
boot.
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

> Also, he made another post
> and I'm pretty sure there was no evidence his OS even had an infection;
> that is, his AV program found suspect files in the the temp directory
> and unopened e-mail attachments.

How can I discover *for sure* whether I have an actual infection or
whether
the above a just viruses that have been lying dormant (e.g. in emails)
and which have never
actually been exectuted?

Ship (OP)
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

From carmel:
> It has some information that might prove useful to you. You might be
> interested in: DriverMax <[URL="http://www.innovative-sol.com/drivermax/"]http://www.innovative-sol.com/drivermax/[/URL]>
> also. It could save you a lot of time. Prior to running it, do insure
> that you have the latest drivers installed.

Driver max sounds like it allows you to upload your current drivers
onto
their website and then download them again into your freshly formatted
computer.

But surely this is extremely dangerous in my case where I have been
infected, because a virus could burn itself into one of my drivers and
would then be unwittingly re-installed, no?

Ship
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

On Jan 21, 12:48 pm, "FromTheRafters" wrote in message
>

>
> >> Also, he made another post
> >> and I'm pretty sure there was no evidence his OS even had an
> >> infection;
> >> that is, his AV program found suspect files in the the temp directory
> >> and unopened e-mail attachments.
>
> > How can I discover *for sure* whether I have an actual infection or
> > whether
> > the above a just viruses that have been lying dormant (e.g. in emails)
> > and which have never
> > actually been exectuted?
>
> The fact that they reside in temp files is no guarantee that they don't
> exist elsewhere as well.
>
> You can attempt to fix your computer by using the various antimalware
> programs available, but if you want to feel confident about the results
> it is best to restore to factory specifications and rebuild from there.
> My gut feeling, in view of how many things were reportedly found, is
> that safe practices were not in place on this computer - all the more
> reason to flatten and rebuild at this point.
>
> The lying thief "The Real Truth MVP" (even its moniker is a lie) may be
> right about the temp files. If you clear the temp files out, a
> subsequent scan may come up clean. If you are happy with that as a
> result, then so be it. Personally, I feel that you should familiarize
> yourself with the use of the restore partition and getting the updates
> installed.

Ok... one thing though - what is to stop a virus from infecting all
your
previous restore points? (not to mention the restore process
itself...)

I am certainly leaning toward a complete flatten plus rebuild.

(I remain nervous that reinstalling msWindowsXP may prove hard even
though I have a valid Product Key on the back... but shall probably
risk it anyhow!)

Ship
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

"ship" wrote in message

>> Also, he made another post
>> and I'm pretty sure there was no evidence his OS even had an
>> infection;
>> that is, his AV program found suspect files in the the temp directory
>> and unopened e-mail attachments.
>
> How can I discover *for sure* whether I have an actual infection or
> whether
> the above a just viruses that have been lying dormant (e.g. in emails)
> and which have never
> actually been exectuted?

The fact that they reside in temp files is no guarantee that they don't
exist elsewhere as well.

You can attempt to fix your computer by using the various antimalware
programs available, but if you want to feel confident about the results
it is best to restore to factory specifications and rebuild from there.
My gut feeling, in view of how many things were reportedly found, is
that safe practices were not in place on this computer - all the more
reason to flatten and rebuild at this point.

The lying thief "The Real Truth MVP" (even its moniker is a lie) may be
right about the temp files. If you clear the temp files out, a
subsequent scan may come up clean. If you are happy with that as a
result, then so be it. Personally, I feel that you should familiarize
yourself with the use of the restore partition and getting the updates
installed.
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

I really think you are worrying yourself needlessly, ship!

More comments inline.

ship wrote:
> On Jan 21, 12:48 pm, "FromTheRafters" wrote:
>> "ship" wrote in message
>>
>
>>
>>>> Also, he made another post
>>>> and I'm pretty sure there was no evidence his OS even had an
>>>> infection;
>>>> that is, his AV program found suspect files in the the temp
>>>> directory and unopened e-mail attachments.
>>
>>> How can I discover *for sure* whether I have an actual infection or
>>> whether
>>> the above a just viruses that have been lying dormant (e.g. in
>>> emails) and which have never
>>> actually been exectuted?
>>
>> The fact that they reside in temp files is no guarantee that they
>> don't exist elsewhere as well.
>>
>> You can attempt to fix your computer by using the various antimalware
>> programs available, but if you want to feel confident about the
>> results it is best to restore to factory specifications and rebuild
>> from there. My gut feeling, in view of how many things were
>> reportedly found, is that safe practices were not in place on this
>> computer - all the more reason to flatten and rebuild at this point.
>>
>> The lying thief "The Real Truth MVP" (even its moniker is a lie) may
>> be right about the temp files. If you clear the temp files out, a
>> subsequent scan may come up clean. If you are happy with that as a
>> result, then so be it. Personally, I feel that you should familiarize
>> yourself with the use of the restore partition and getting the
>> updates installed.
>
> Ok... one thing though - what is to stop a virus from infecting all
> your
> previous restore points? (not to mention the restore process
> itself...)

If a person had an *actual* infection at one point in time (this is
_not_ the same thing as suspicious temp files and unopened e-mail
attachments), then using System Restore to go back to a point in time
when the infection was active would be a very bad thing to do! That is
why it is recommended to turn it off, then on again (this deletes all
the old restore points) once the infection is successfully removed. But
if you never had an infection, those points aren't necessarily
"infected." Still, it would be wise to clean house anyway (with regard
to System Restore).

> I am certainly leaning toward a complete flatten plus rebuild.

It may very well not be necessary, but at least you would finally have
peace of mind.

> (I remain nervous that reinstalling msWindowsXP may prove hard even
> though I have a valid Product Key on the back... but shall probably
> risk it anyhow!)

It depends on the method you use. If you use the hidden recovery
partition, there might not even be a need to enter a Product Key (I know
Dells work that way). If you obtain a generic OEM XP Pro installation
CD, then your Product Key from the COA sticker *will* work. If for some
reason, automatic activation over the Internet doesn't occur, simply
follow the prompts for telephone activation.

I'm sure your recovery partition is fine. I doubt very much that the
malware writers were targetting *your* particular make and model of PC!
If you're truly that paranoid, take out the hard drive and obliterate it
and purchase a new one. (Then again, you might start worrying about
your CMOS chip being infected... )

But seriously, stop being so nervous!
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

ship wrote:
> On Jan 21, 12:48 pm, "FromTheRafters" wrote:
>> "ship" wrote in message
>>
>
>>
>>>> Also, he made another post
>>>> and I'm pretty sure there was no evidence his OS even had an
>>>> infection;
>>>> that is, his AV program found suspect files in the the temp directory
>>>> and unopened e-mail attachments.
>>> How can I discover *for sure* whether I have an actual infection or
>>> whether
>>> the above a just viruses that have been lying dormant (e.g. in emails)
>>> and which have never
>>> actually been exectuted?
>> The fact that they reside in temp files is no guarantee that they don't
>> exist elsewhere as well.
>>
>> You can attempt to fix your computer by using the various antimalware
>> programs available, but if you want to feel confident about the results
>> it is best to restore to factory specifications and rebuild from there.
>> My gut feeling, in view of how many things were reportedly found, is
>> that safe practices were not in place on this computer - all the more
>> reason to flatten and rebuild at this point.
>>
>> The lying thief "The Real Truth MVP" (even its moniker is a lie) may be
>> right about the temp files. If you clear the temp files out, a
>> subsequent scan may come up clean. If you are happy with that as a
>> result, then so be it. Personally, I feel that you should familiarize
>> yourself with the use of the restore partition and getting the updates
>> installed.
>
> Ok... one thing though - what is to stop a virus from infecting all
> your
> previous restore points? (not to mention the restore process
> itself...)

Most a/v software checks the restore point files for malware and deletes
infected dates.

> I am certainly leaning toward a complete flatten plus rebuild.
>
> (I remain nervous that reinstalling WindowsXP may prove hard even
> though I have a valid Product Key on the back... but shall probably
> risk it anyhow!)

Just disinfect, check with other software listed below, and trust that
the malware was removed by the software designed to remove it.

Malwarebytes© Corporation
[URL="http://www.malwarebytes.org/mbam/program/mbam-setup.exe"]http://www.malwarebytes.org/mbam/program/mbam-setup.exe[/URL]

SuperAntispyware
[URL="http://www.superantispyware.com/superantispywarefreevspro.html"]http://www.superantispyware.com/superantispywarefreevspro.html[/URL]
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

From: "ship"

| From carmel:
>> It has some information that might prove useful to you. You might be
>> interested in: DriverMax <[URL="http://www.innovative-sol.com/drivermax/"]http://www.innovative-sol.com/drivermax/[/URL]>
>> also. It could save you a lot of time. Prior to running it, do insure
>> that you have the latest drivers installed.

| Driver max sounds like it allows you to upload your current drivers
| onto
| their website and then download them again into your freshly formatted
| computer.

| But surely this is extremely dangerous in my case where I have been
| infected, because a virus could burn itself into one of my drivers and
| would then be unwittingly re-installed, no?

| Ship

What viruses ?

NONE were viruses in your log excerpts !

Therefore -- NO!
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows.. 

"ship" wrote in message


FTR said [some stuff]

[...]

> You can attempt to fix your computer by using the various antimalware
> programs available, but if you want to feel confident about the
> results
> it is best to restore to factory specifications and rebuild from
> there.
> My gut feeling, in view of how many things were reportedly found, is
> that safe practices were not in place on this computer - all the more
> reason to flatten and rebuild at this point.

[...]

> Personally, I feel that you should familiarize yourself
> with the use of the restore partition and getting the
> updates installed.

....and then you - "ship" said...

Ok... one thing though - what is to stop a virus from infecting all
your previous restore points? ...

***
Don't confuse "Restore Points" with the EISA restore partition. These
are totally different things.
***

.... (not to mention the restore process itself...)

***
This is known to have happened (not infection specifically, but
interference nonetheless).
***

I am certainly leaning toward a complete flatten plus rebuild.

(I remain nervous that reinstalling msWindowsXP may prove hard even
though I have a valid Product Key on the back... but shall probably
risk it anyhow!)

[...]

***
After several attempts to install and dual boot Linux/Windows XP on this
laptop, I finally gave up. I figured I'd just use an XP Pro CD that I
had to reinstall XP. I discovered the "Access IBM" button brought up the
option to restore from the hidden partition.

Easy as falling off a log - as they say.

Afterward, to avoid having to go through the update process (service
packs) in the future, I imaged the harddrive (with MaxBlast - powered by
Acronis) so I could recover more easily the next time. I *still* have
the EISA partition intact even though I probably won't need to use it
again.
***
 >> Stay informed about: Virus infection on a T60 ==> how best to reinstall Windows..