How I got rid of the SS virus

[DRUGABUZINGANGSTALOL]

I, like a few of us here, were some how fucking retarded enough to download 4chan fandango, and even MORE RETARDED to click the fucking OK button at start up. Well here is how I got rid of it. I don't know 100% for sure if it's all gone, but my computer seems to be fairly normal.

Here is a nice little list of how I approached this problem.
1. Said "FUCK" and facepalmmed.
2. clicked ok (if you haven't done that THEN DON'T)
2.1 went to start-up and deleted "WinUsrDat32" or something similar
2.2. Shut off the computer right away when the background changed(just held the power button)
3. Reinstalled windows/system restore (from startup, f10 for me)
4. Made a linux live CD of Ubuntu
5. backed up my files to my USB through ubuntu
5.5. deleted "4chan fandango" from C:/program files
NOTE: If you can't get Ubuntu, then press f8 a whole shit load on start up, and select safe-mode and do all this instead.
6. Logged on with an administrative account
7. Copied important documents from the old account to some folder on C:/
8. made a new account(admin account)
9. Deleted the old one (I clicked delete the files, just to be safe)
10. Went onto the new account and ran a virus scan with the Norton 60 trial I got, (updated it first though)
11. Went to tools->folder options->view tab and uncheck "Hide hidden files" and "Hide system files"
12. (shift+del)Deleted Star.ico, hacked.swf,5 .vbe files(close.vbe,etc.) from C:/
13. Ran CCleaner
13.5 Deleted ALL files made on Jul/13/08 or modified.
14. Checked for updates at http://update.microsoft.com

And I think that's it. If I remember something, I'll post it. I still can't use System Restore though so I don't know what the hell is up with that, so I may still have it.

[DRUGABUZINGANGSTALOL]

*** Start-up is located in Start->Programs->Start-up incase you're wondering.

[DRUGABUZINGANGSTALOL]

*** scratch off the modified part on 13.5
Only deleted files that say they were modified the day of download, but if the creation date is older (i.e March 24 2005) I recommend keeping the file.

[kr0kz]

thanks!!

[DRUGABUZINGANGSTALOL]

At 7/15/08 01:08 PM, DRUGABUZINGANGSTALOL wrote: *** scratch off the modified part on 13.5
Only deleted files that say they were modified the day of download, but if the creation date is older (i.e March 24 2005) I recommend keeping the file.

God dammit, I fail at wording, let me retry.
Delete all files created or modified on the same day of the virus. However, if the file's modified or creation date is older than the virus (march 25 2005 for example) then I recommend keeping it, as deleting is could cause bad shit to happen.

I still don't know why I can't system restore though... it gives me "Blah blah blah please restart" still, so maybe I didn't get all of it, but this list should still help.

[PBass]

At 7/15/08 01:13 PM, DRUGABUZINGANGSTALOL wrote: I still don't know why I can't system restore though... it gives me "Blah blah blah please restart" still, so maybe I didn't get all of it, but this list should still help.

It might be because vista is a bitch. Try it in safe mode. That might work, though it didn't for me.

[Thimbles]

At 7/15/08 01:21 PM, PBass wrote:

At 7/15/08 01:13 PM, DRUGABUZINGANGSTALOL wrote: I still don't know why I can't system restore though... it gives me "Blah blah blah please restart" still, so maybe I didn't get all of it, but this list should still help.

It might be because vista is a bitch. Try it in safe mode. That might work, though it didn't for me.

Oh right, because when a user downloads and executes a virus, the only thing to blame here would be the Operating System.

Go fuck yourself.

I'm getting this T-shirt.

[NraButtons]

The virus fucks with the System Restore program; you have to delete the current version of your Restore folder; look for it in C:\Windows and delete it. It'll re-create itself somehow, it did for me.

[m4x0]

goldencat himself sent me the cure :)

[Kenshi]

I didn't DL it, so IDK, but did the virus do something to your CPU, like deleting system32

Or what?

[NraButtons]

If that's true and you're not just dragging some of the people here by the short hairs, could you provide a download for it? It seems to be making a small comeback, and it would be appreciated.

[DRUGABUZINGANGSTALOL]

At 7/15/08 04:25 PM, kenshi2 wrote: I didn't DL it, so IDK, but did the virus do something to your CPU, like deleting system32

Or what?

It's just a virus that'll mess with your system, it won't delete anything that I know of though, just don't download it. I've heard it has A.) a keylogger, and B.) It changes your background, system sounds, and saves a lot of SWFs of some flash movie to your desktop. I only had the background problem, but I shut it down as soon as it changed my background.

That's just some of the things I've heard though, so idk.

[doberman7]

Or instead, take it to a computer shop and get it checked rather than being fucked up with more programs?

[DRUGABUZINGANGSTALOL]

At 7/15/08 04:41 PM, doberman7 wrote: Or instead, take it to a computer shop and get it checked rather than being fucked up with more programs?

Or this :\.

[NraButtons]

Quick update: To get rid of the boot message on XP, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi ndows NT\CurrentVersion\Winlogon and clear the "legal notice" keys.

[Bolo]

I actually downloaded it, and I didn't receive any malicious viruses.

You know, hearing about how the virus makes Firefox redirect anyone who tries to access Newgrounds to the NAACP's site makes me almost wish I had a PC, so I could try it out.

[Thimbles]

At 7/15/08 04:25 PM, kenshi2 wrote: I didn't DL it, so IDK, but did the virus do something to your CPU, like deleting system32

Or what?

http://www.google.com/search?hl=en&safe=
off&rlz=1B3GGGL_enCA283CA283&sa=X&oi=spe ll&resnum=0&ct=result&cd=1&q=define%3A+c pu&spell=1

A central processing unit (CPU), or sometimes simply processor, is the component in a digital computer that interprets instructions and processes data contained in computer programs. ...

[NraButtons]

It doesn't really make itself known until you restart your PC after you run the "game", so it's best if you can delete the offending files before you restart. Best thing to do would be to not download it at all, but there's a sucker born every minute.

[Blob1994]

i got rid of it by kicking it and smashing it.

But then I couldn't turn it on >:(

But in all seriousness, good job with that.

[Sensationalism]

1. Log off
2. Go to System Restore
3. Go back a week
4.????!
5. Profit

[squidly]

How do you copy the files on your computer?

[Rebel-V-Elite]

At 7/15/08 08:40 PM, squidly wrote: How do you copy the files on your computer?

This, I want this shit off