trojan invasion - nothing helps at all

Last saturday I was hit by a very serious trojan that brought in a whole volley of other trojans, backdoors
and worms.

trojan-downloader.win32.small.bho 2x
trojan-downloader.win32.small.agg - 7x
backdoor.win32.dumador.ds - 3x
trojan-downloader.win32.small.big
trojan-downloader.win32.small.aux - 4x
trojan-dropper.win32.agent.ro 2x
unknown virus 6x
trojan.proxy.win32.lager.x 4x
email-worm.win32.bagz.j
worm.zotub

spybot search and destroy found these trojans over and over again.
They always come back whenever i reboot - are they perhaps hidden in the startup menu?
Running Spybot Search & Destroy for 7 hours, running scans with Fsecure and freeAV, my firewall,
NOTHING helped or helps!
The audio and video players are distorted, I am sometimes thrown off line, taskmanager is shut down
and very disturbing, page-wide popups appear that cannot be clicked away at once.
This screenshot of windowssystem32 shows what has been added to the system since the trojan struck
Some 0exe files (trojans) I have already shifted to a temp folder. Is it safe to delete these files, and if so,
which files can/should be deleted?
Further concerns I have:
Can briefcases and ftp servers be contaminated by uploading material from trojan-infected computers?
If this is not advisable, should I reinstall windows or even get a new harddrive?

Did you try starting in Safe Mode and running those programs? That often helps. How to start in Safe Mode?

Whatever is in temporary files, feel free to delete.

Check back after the safe mode test and we'll see how much is left to be done.

Try to download Microsoft anti spyware which will delete all unwanted exe s and in memory processes , this is helpfull for this kind of problem.

I'm no "tech wiz" but ever since I've been using Symantec Norton Internet Security I havent had a problem with any trojans.

Here is my recommendation...Try Ad-Aware...there is a free version to be found here.

Yes, ad-aware is great...necessary even. But with many of these trojans you are going to need to do manual editing unfortunately. Google each one that you find and follow the manual steps they recommend. Even with updated trojan scanners, you are often still stuck. Many of them are better as preventatives than as remedies.

FYI: when we set up an office in Delhi last year, they had an infestation of trojans within 30 minutes of going online. I don't know whether it came from not using a firewall or from the software they had installed. In either case, though, the days of using software from unknown sources or connecting to the internet without a solid firewall are over.

I did a clean install of Windows and made the mistake of connecting online before installing a Firewall. I just wanted to go and grab the latest version, download it, install it, and then install the latest patches to Windows. Alas, within five minutes my PC was fully engaged as a spam relay. Or was it one of those DDOS worms going around. 30 minutes is already a pretty good accomplishment.

Thank you all for your helpful reactions. I still have these two urgent questions:

1. Can briefcases and ftp servers be contaminated by uploading material from trojan-infected computers? I dont dare to upload anything to my website now.
2. If this is not advisable, should I reinstall windows or even get a new harddrive?

1. If the files on your hard drive are infected and you upload them, then yes, if you upload such files, you may spread the infection.

2. Reinstalling Windows every now and then is in general a good idea. If your PC is infected through and through and you feel there isn't much you can do about it, then it's a good idea indeed to consider which of the two routes may be the easier one.

I swapped to Avast a while back - A free virus scanner worth a try. AntiVir worked fine for me, too, but I found Avast's features, in particular the automatic updates, more appealing.

Sometimes you need to literally hunt viruses. Spot them in the TaskManager. Open the folder where the infected file is. Kill the process from the TaskManager and delete the file quick. (Sometimes they re-launch themselves!) And remember, doing this in Safe Mode is a good idea.

The two routes are - reinstalling windows or buying a new harddrive?

The e-mail worm is intercepting e-mails or so? One friend reported not receiving an e mail from me.

holy moses...........

Getting a new hard drive is a bit extreme, as it's a software issue. The drive isn't physically infected. Of all the dozen good reasons why you should get that new, bigger hard drive, this isn't one of them.

However if you're re-installing Windows, it's of course a good opportunity to do it on a fresh new hard drive once you're at it.

I wouldn't put intercepting mails beyond viruses. I doubt they actually intercept mails per se, but they do interfere with normal program functions, possibly causing mails to not get delivered.



No - I meant, 1) Hunting down all those trojans and trying to clean it up, and 2) Re-installing Windows. Buying a new hard drive means you'll install Windows in any case, it's not exactly an either/or situation you have there.

The 567 Mhz Intel Celeron processor I have now will be able to handle a 40 GB or 80 GB drive? Or do I need to get a stronger processor for such size HDs too?

Yes, that'll handle it just well. Hard drive size is pretty much independent of CPU power. You may run into some motherboard limits on older PCs when you go beyond the ~130GB mark per drive though, in that the whole capacity may not be available.

If you're looking at upgrading both the CPU (AMD Sempron - 60€) and the hard drive (Samsung 80GB - 60€), you'll also need to upgrade the motherboard (~70€) because of the CPU upgrade, and most likely you'll also need new RAM (512MB DDR - 50€). It's not just a CPU-upgrade... Then again, your old PSU (power supply) may not have enough juice or suitable plugs for the new setup, so you'll need to upgrade that too, and you can get them in cheap bundles with low-end cases (60€). And look at that, it's actually a brand new PC you're looking at for 300€.

PCs sans monitor arent quite that cheap around here. But if i settle for a 40 or 80 gb drive i wont need to upgrade everything else wont I?
meanwhile i ran spybot again - not in safe mode yet though - and though f secure found a whole battery of trojans, unable to remove them, spybot says good day everything is fine, cant understand that.

That unfortunately didnt work. After running spybot, antivir, fsecure (failed to run)in safe mode, and rebooting, the same story still....

That SEEMED to work very well, 60 problems were found and I placed them in quarantine (though I am unable to locate the quarantine zone on my PC nor do I know what to do with the quarantined files). Unfortunately after rebooting another Trojan downloader popped up. It must be hidden somewhere in the startup menu perhaps. So this also is not 100% successful. Arent these downloader trojans able to install and exec all the other trojans again as well ?
PS I did regain control of task manager though.....

Obviously what's happening here is there's a mother trojan somewhere that mutates and you are only killing the mutations.

At this point I would go for the re-format.

Yes you are right. I am losing control of this machine. This is getting worse all the time, despite all best efforts. But how do I re-format when I have only a copy of XP? I heard only holders of original versions can re-format?

Depending on your Windows backup CD, it may or may not be bootable. If it's bootable, you can just stick it in and boot from it, and reinstall Windows from a scratch. If it isn't, then you'll need to get the original you can boot off from.

When you do boot from the CD, you can choose to re-format the partition you'll install Windows on. Then, of course, all data on the drive will be deleted.

Let me get this straight - I heard that if you do that, you will have 2 windows XPs on your harddrive, something I cannot afford with just 2.7 GB left in free diskspace.



I vaguely recall that we removed the partition on my harddisk and it is just one whole....

OK. If you re-format the entire drive, you won't have two Windowses there. If you just install on top of the previous one, you may end up with two if you're talented enough. I heartily recommend a "clean install", meaning including a reformat of the hard drive, for the best result.

OK How do I go about making a clean install, step-by-step?

I'd like to remind one more time that all data on your hard drive will be erased if you do this - be sure to take any and all necessary backups.

There are already loads of good step by step tutorials on doing a clean install of XP, Microsoft offers one. The only the tutorial doesn't mention is that you should select "Full Format" instead of "Quick Format" when you format the hard drive. It's all clearly enough visible on the screen and explained when it comes to that.

If you have some real mother of a virus, you can also delete the partition and recreate it to be on the safe side. With 99% probability not necessary though. If you do want to do that, however, it's again real easy: It says on the screen which button you have to press if you want to delete a partition or create a partition, when it comes to that point in the boot of the Windows installation.

Good luck, lots of patience.

Preparing for the big operation, Q1: If I burn a CD of all the not-yet-backed-up music on my HD, will the CD on which I burn it become contaminated and then again contaminate the PC when I play it after re-installing windows?

Trojans and the such rarely latch onto media files. Just do a virus scan through the media you backed up before trying to open the files after the re-install.

How about Mozilla Firefox for safer surfing? Would that make IE unnecessary, or is IE irreplacable? Will I remain vulnerable if I keep IE but actually access the web via Mozilla?

Hmm.. this is actually a good question. I have personally been using Firefox exclusively for a while, and have encountered very, very minor problems. However, your milage may vary. Depends on the sites you visit & what you need to do. If you do, say, online banking or some such 'specialized' web app, then IE may be the only one that works.

I did have an instance with some spyware that attached itself to IE, and although every scan I would do would show a clean system, once I started IE, the spyware would try to install. However, using IE as little as possible will offer some protection.

You can not (as far as I know) remove IE from your system.

Then, if IE is compulsory, and internet banking can only be done through it, is one ever safe and secure while going on the internet? And indeed, is there then any use of running Mozilla? Or is one only exposed to threat while actively surfing via IE?

To be honest, I try to use IE once on a new install; to download firefox. Even my bank has become compatable with firefox, so I really never use IE at all.

When you install XP anew, download firefox & then run IE only when you absolutely need to. This will majorly reduce your risk. Also, after getting firefox, download the spyware scanners that have been recommended in this thread. Get Ad-Aware & the Microsoft Spyware Tool & have the MS Tool run at startup. It gives you warning notices when you install software, so as you put new stuff on the machine (or even just put the stuff you had back on) you will get tons of notices, but you know whats going on your machine & it does a pretty good job catching bad software before it installs.

Thanx a lot DC



How do I do this?



Speaking of ad-aware, I noticed its scanning process is shut down just before it finished scanning the disks, and no removal of viruses is possible. Are these trojans so smart that they can do such mean things?

Its an option in the install. Just make sure you don't uncheck it

With a full install it doesn't matter... however, hypothetically they could interfere with its running, but it could be a 100 other things. Who can say?

On backing up your machine, make sure you save your email (if you download it to your machine), your address book & your Internet favorites/bookmarks! These are probably the things most forgotten by people I've dealt with.

Please explain....



How do I do that?

"With a full install it doesn't matter" => Full re-install of Windows, he means. The trojans can't interfere with that.

If you read your mails online, as I believe you do, there are no mails or address books you need to backup. To backup your favorites, just backup the folder C:Documents and SettingsAdvaitadasFavorites, or whatever your username is.

Strange, I cant find the folder Favorites here .....

Also, I stopped making backups of anything since the Trojans struck. Would such a backup not bring the infection over to the clean, new windows install?

Not My Documents. Just C:Documents and SettingsAdvaitadas.

Uh, well I just found that folder and was going to report it here when your answer came in.

Still, the question remains:



Its not too much trouble for me to copy the 36 urls on my Favorites list on a piece of paper, rather than risking the same nightmare all over again on my new windows.....

Favorites rarely contain trojans. Unless you have a bookmark for a site where you downloaded a file you got it from. However, whatever suits you - if you want to play it super safe, why not print them out.

Q 1 - So what does a Trojan infect then? The web browser, docs, pdfs, the windows system? Anything else?
Q2 - If I had accidentally uploaded an infected file to my website, my website becomes a hijacker and spam-conduit?

There are so many different types of viruses, and a 'trojan' is just one of them. Trojan comes from Trojan Horse, that famous sneaky Greek trick. It usually involves downloading a virus disguised as some other kind of file. Other viruses infect system files, or set themselves up as system files, hide in your registry & hundreds of other tricks to avoid detection.

Viruses are not to be confused with spyware, which while virus-like, works to not disrupt your system but to collect 'marketing' information & send it back to companies without your knowing. Spyware has morphed into 'annoy-ware' however, where you are barraged with pop-up adds & the like.


Most virus files need to be executed to infect a system. Of course, they can use tricks to infect, such as replacing system files that are automatically executed. If you are only uploading html files and the like, I would highly doubt you infected the system. When you get a clean install, just download a copy of your site & run a virus scan on it.

All my scanning work with antivir, spybot and ad-aware showed I have the whole lot on board:

Backdoors
Worms
Diallers
Hijackers
Trojans
Spyware

It involves going online when I want to stay offline and vice versa, popups I wouldnt want my Guru to see etc. What else are the above bugs doing?

Frustrating, isn't it?

One thing they are doing is hiding from your cleaning software. This is primarily why you need to reinstall your copy of XP. Just wipe them from the machine & start anew. Some times you just need to cut your losses & start fresh.

Diallers are devious pieces of software. I knew of a case (father-in-law) where a dialer was calling out through his modem to some number in Africa & running up his phone bill. This is not to say that yours is doing that, but its something they do. You may want to call your phone company & see if there has been any change in your usage recently (calls outside your normal area). Usually if you call them before you get the killer phone bill you can argue the virus point i.e., you are not trying to cover up a large bill you just got with some virus excuse.

Backdoors and diallers can be used to launch attacks on other machines using your machine, and to gain access to your machine to get sensitive personal files. Basically, you need to back up your important files & reinstall. Scan the backup files with a virus scanner when you get the new system install up & going.

When I reinstall a system, here's my usual order of things:

1. Reinstall Windows
2. Install virus scanner
3. Install MS Spyware Software
4. Update Windows with latest patches
5. Install Firefox
6. Start installing other software

Hope that helps a bit.

They can do that with any type of modem? I have an ADSL modem. Is that safer?

This was a telephone. ADSL would be safe from this kind of dialler.

No firewall? On my list, it is #2 or #3.

I am now studying the link Madhava gave about the clean install of XP.
First questions about the manual:

“ Jot down your network configuration. If you're computer is already connected to the Internet, record your network configuration so that you can easily configure Windows XP to connect to the Internet.”

Q: Is that necessary for me and if so, what do I do?

Boot from the Windows XP CD
“The simplest way to perform a clean install of Windows XP is to start the computer using your Windows XP CD. Don't blink during startup though, because you'll briefly see a message that says, "Press any key to boot from CD." Miss this opportunity, and the computer will continue to start from the hard disk. If you don't see this message, your CD-ROM isn't bootable or you must configure your computer's basic input/output settings (BIOS) to boot from a CD. BIOS settings are specific to your computer, so I can't give you step-by-step instructions for configuring yours to boot from the CD. Consult your computer's manual or the motherboard or computer manufacturer for help in enabling your BIOS so you can boot from a CD.

Q: This sounds a bit above my level. What do I do if my CD isnt bootable?
I get the impression this manual is for those who install XP over an older windows version. It is dated October 2002, when XP was young. How do I install XP while one is already running? Do I erase or uninstall my current XP first and if so, how?

Sorry... running Linux firewall on a seperate machine, so no personal firewall. Whadda ya think, I'm a chump Plus, I've got a modded firmware for my wireless router that lets me fiddle with some security as well...

Anybody?

You're on broadband - no, not really. If there is any one thing I would do, I would disconnect the modem and only reconnect it after installing a virus killer and a firewall after the fresh install.


Usually you'll see, when the PC starts up, a note to press F2 or some other key to enter "Setup" or "BIOS". Over there somewhere there's a tab where you can change the boot order, it's rather straight-forward.

If you do find out that your CD isn't bootable, drop me a PM.

Will I still be able to do that then? I mean, is the old windows xp still running at that point?

If it won't boot from the CD, then nothing happens, so yes, the old Windows will still be very available.

I have some questions about Avast! It seems to be a nice program at first sight - I had it scan all my drives and it said nothing was contaminated (the scanning is really slow though). But afterwards I ran ad-aware, which said that 23 new critical objects were recognised, amongst which 18 files! Does that mean that avast is somehow not working (perhaps because I also run Fsecure), or do I misunderstand what ad-aware means with 'recognising 23 new critical objects'?

They are programs of different genres. Avast keeps tabs on viruses, it doesn't scan every other cookie and possibly adware program you may have installed. What exactly does AdAware report?

In general, you shouldn't be running two antivirus programs at the same time. At least, every antivirus program seems to be in the habit of warning about that.

See in the image in my previous post.



..that was going to be my next question - Is Avast as up to date as Fsecure is? They dont seem to like each other. Is it safe to uninstall and delete Fsecure and let the Avast shield, which isnt working as long as Fsecure is there, come into place? This attached message says something like 'Incompatible AV software is active - the access path to the scanner module of this program (probably fsecure) and the side-access path of avast cannot work simultaneously. As a result the access path scanners of avast - standard shield, p2p shield and instant messaging shield - have been switched off.' Does this mean I am unprotected at the moment?
So is it safe to take out fsecure and totally switch to avast?

Advaitadas-ji:
Have you reinstalled XP yet? It seems like you have not. Are you having problems getting XP to reinstall? From the sounds of it you are having problems booting from the XP CD? Is this correct? If so, then:

1. Restart computer.

2. On the screen that first comes up, you should see an instruction like 'Press F2 for Setup'. Whatever the instruction, press that key. If you get to the 'Starting XP' screen, you didn't press it in time. Restart & try again.

3. Once you get to the 'Setup' screen (this is really the BIOS Setting screen), you usually use the left and right arrow keys to move around the menu items on the top of the screen. Look for one called 'Boot' & arrow to it.

4. Using the up & down arrow keys to move around in the 'Boot' page, look for an item called 'Boot Order'. Hightlight it & hit 'Enter'. This list the order devices on your machine are checked for a bootable system. Read the instructions and move 'CD Rom' to be the highest device (device checked first).

5. Exit the BIOS Setup (usually last menu item on the right) saving your changes.

6. Insert the CD in the machine & restart. It should come up to the XP install. You can cancel the install early & restart without the CD to go back to your normal XP install to get back to GD.

Let us know what stage you are at so we can help.

No I havent reinstalled it, since there are signs of great improvement these days. Its possible that Avast threw out all the bugs. If you please answer my questions in my previous post I might not have to reinstall XP, at least not urgently. My mother passed away on Sunday and I am leaving for India in 3 weeks so I would rather just keep the PC as it is right now, but I would like to know about the above mystery between Avast and Ad Aware, so that I am sure that my system is safe again. So kindly have a look at my queries above. Thanks.

As Madhava said, anti-virus software and anti-spyware software are two different things. You should run both AV & anti-spyware software. You can run multiple kinds of anti-spyware software, but should run one AV software. I don't know which is better of the two you use, as I use Norton's Corporate AV, as directed by my company, and have been very happy with it. It costs $$ however. Find one piece of AV software and stick with it. Check a site like cnet.com for reviews of the different names. Maybe someone here can recommend a good one?

As for anti-spyware, I recommend Ad-Aware and the Microsoft Anti-Spyware app. Run them both, as they both have their strengths and weaknesses. Ad-aware does a good job finding & removing spyware, and the MS product is great at blocking the stuff from getting on your system.

Does this help?

I'm very, very sorry to hear about your mother. My thoughts are with you.

Thank you for your sympathy.

Yes I think I understand. So if ad-aware finds 23 new critical objects, what does that say about the prospects of uploading html and pdf files to my website? Is it safe? What does it mean anyway 'finding critical objects'?

Ad-Aware is finding spyware components. While annoying, these have nothing to do with viruses, and do not 'infect' files. If the only issue with your system is some spyware, I don't think there will be any problems with your website. Ad-aware should get rid of the spyware tho.. is it not doing so?

Dear Advaitaji,

Just to tell you that the mails that you sent me on 22/08 and 24/08 reached me several days later, I can't say exactly because I didn't check my mail for some days. So yes, I guess that your mailserver was affected too. Hope your problems are resolved now. And if your mailserver was affected, then I guess you didn't receive the last two emails that I sent you? Are you reciving PMs here at GD? You don't seem to be responding to those either.

Gaura,
When did you send the e-mails and possible PMs?

Well, who knows? Each time I run it it finds 'critical objects', whatever that may mean. I dont know if these are each time the same critical objects or new ones, so I cant tell if the critical objects of the previous scan had been removed or not?

Interesting was that when I ran ad-aware, the AV program Avast reported 6-7 trojans/viruses/worms, so ad-aware and avast do seem to coordinate things.

It seems ad-aware only works as a scanner not as a remover. When I click on ad-watch I get this message, with offers of software for sale:

I sent them on 18/08. When you didn't reply, I assumed that you hadn't got them and I resent them again on 22/08.

Hmm. That is really funny. My yahoo inbox says I received 2 mails from you on 21/08 and 2 on 17/08. The sent box says I sent you e-mails (replies) on 23/08, 22/08, 20/08 and 2 on 17/08. So I received and sent everything. Either yahoo didnt deliver the mails to you or something is wrong with your e-mail provider. I think the problem is on your side, because I had smooth communication with everyone else, both thru yahoo and hotmail. Did you also send PMs? Want me to send you the e-mails again?

Ok let's try that, please.

Most messages I sent you were about the trojan problem which is largely solved by now. I sent you a message to your spymac account about the sahasranama etc.

Earlier I had understood in this thread that trojans only infected program and system files but not pdf files (so that I could safely upload pdf or html files to my website), but just now I downloaded a pdf file from a site and I got this trojan warning from avast. How is that possible?

Judging by what's in the screenshot, it seems as if the DLL system file itself is infected, not the PDF. It becomes active when you try to launch Acrobat, hence the warning. Uninstall and reinstall Acrobat, should clean that up. Uninstall, reboot, reinstall -- as DLL files are sometimes stuck in the memory and won't get removed until they become deactive.

Indeed, at the moment I cannot open any pdf files anymore. So which programs have to be uninstalled of those mentioned on this Control Panel list?

Looks like Acrobat 7 is infected. Unstall both Acrobats (you don't need Acrobat 5 if you have Acrobat 7), reboot & reinstall Acrobat 7.

I think I uninstalled 5.0 once and then I wasnt able to create pdf files anymore. Shouldnt I just uninstall 7.0 and its upgrades?

It seems Advaita has Acrobat 5.0 Full and Acrobat Reader 7.0. He can't create PDFs with only the Reader. Anyhow - uninstall everything with Acrobat 7.x mentioned, then reinstall Acrobat 7.0.

Allright but what does that mean for me practically - no pdf file I create and upload to my site can cause the above damage to a person who downloads it?

I downloaded a bunch of them, and they weren't infected. Judging by that, your PDFs are clean.

But that is because they were all uploaded when my system was still clean. Since I am still finding Trojans during virus sweeps, the question is if it is safe (considering the events of today, with the dll contamination of a downloaded pdf file) to upload new or upgraded pdf files?

Well there's one way to find out isn't there. Upload one and send me the link, I'll see what happens.

Yeah sure but u previously said that if the file is contaminated I could spread the disease to my precious and sacred ftp space!

Oh, it won't jump from file to file there. I can assure you your hosting provider has seen to that.

OK try this.

(I noticed by the way that pdfs from my site are now opened online whereas previously one needed to download them to the HDD first before being able to read them. Is this in any way connected with my problem or just a change of policy of my provider?)

Not a problem opening that, no viruses. The change in the way they get downloaded is most likely a change in your browser settings.

free virus software
http://free.grisoft.com/freeweb.php/doc/2

free adware program

http://www.lavasoft.de/

git-R-done!

Well after my long trip to India I (my daughter actually) finally reinstalled windows XP, but during the installation-process we got the choice to either keep my files intact or not and we decided to keep them intact. Then we installed the firewall and F secure and while running F-secure manually on the harddisk we found 427 infections, be it in the sector which Avast! (the other viruskiller I had installed during the trojan crisis) had alotted as a quarantaine zone. All my programmes and applications were physically present on the harddisk, but were not working. Questions: 1. Should I have chosen for the other option of installation, not retaining all the files on my PC? 2. Since 427 infections have been found, be it in the quarantaine zone, is the reinstallation a failure? 3. Are the two issues related to each other? 4. Should the programmes be all erased from c:Downloads (where I first place them after downloading or opening them from CDs) and c:Program Files (where I later execute them) before installing them again?

1. Yes, assuming you have backups of everything you need.
2. No, since they are quarantined, but see (1).
3. Well, since you kept all your old files, any 'infections' would remain on your machine. Chances are your 'core' XP files are no longer infected, but some bad files are still on your machine.
4. If you can get the programs again, then you should delete them. Your old installed programs may not work since installing a program sometimes involves copying files to the Windows system that your new install got rid of. Best to reinstall.

If you are doing a fresh install, you really should start off by formatting the hard drive (getting rid of all old files)... otherwise you are just carrying all your old problems forward with you...

BTW, glad to hear you got back from India safe & sound...

Working on reinstalling XP and 26 applications since 2 a.m. (16 hours work) was totally in vain because the same 427 viruses that were found under the old XP are still there. Perhaps Windows Commander can still remove them? Of course they are quarantined, but am I really safer now against further infection with a new XP installed?

Advaitaji
When you reinstall XP, in the initial setup stages (the blue screen), there is an option to reformat your hard drive & install a fresh copy of XP. Its not the default option, but YOU need to do it. Get rid of everything and make it a fresh install.

EDIT: Follow these instructions from Microsoft on formatting the HD in the XP setup program

Format your HD in XP Setup

Two options were given to me at the beginning of the installation - one was to keep the files intact, which I did first, you said it was wrong, so I chose the other option tonight, took 70 minutes to install. There is simply no third option. If you remember the procedure by heart then please tell me what I should exactly chose at which stage.

I added a link to my post pointing to the instructions...

And yes, it totally sucks.. takes forever... I just did my laptop & I sympathize...

Someone told me its possible that even with a rerun of XP some hidden files (perhaps containing backdoors, worms trojans etc) may remain and it is better to just format the harddisk from the DOS point, and then install a clean XP. What about that?

Second option: I know the location of the viruses - what about going in there with Windows Commander and deleting them?

It sounds like you are trying hard to keep from losing your old files and documents in a complete reformat. That is why you should always have all your documents and pictures etc. backed up on a disc.
That way, when you need to reformat and reinstall your OS there is nothing to lose.
Myself, the grisoft program keeps me protected. Its like the best virus program around and it is free. It will find and delete all the viruses for you.

http://free.grisoft.com/freeweb.php/doc/2

If you keep having problems and need some help you can PM me and I will give you my son's email address. He owns a computer repair shop here in town and he does this kind of work professionaly. He can tell you exactly what you need to do.
His name is Nitai.

I believe if you follow the instructions I posted and DO NOT select the 'Quick Format' option, it takes longer but it is a full format of the HD.

Personally, I think this is your only option - if the infected files are on your machine, you are assuming your software caught all of the infections... best just to start from scratch.

First class tech support, available only at Madhai's.

With ' software' I hope you mean just XP, right? Not other programmes as well?

Ha.. poor Advaita...

No, I mean you are assuming your anti-virus/anti-spyware caught all the known infections... thats why I always advocate for a clean install.

That's hardly a consoling answer. There's no way to have safe sex is there?

I dont see this in the initial screen I get when I start up the XP CD. I see this, and it seems that only the first option can be chosen. Further down the process there is also no opportunity to reformat the harddrive.

I think you need to boot up with the XP Install CD in your CDROM drive and not try to run setup from an already running windows.

So:
1. Put XP Install CD in CDROM Drive.
2. Restart Computer.
3. It will either boot directly into XP Setup or give you a prompt 'Press any key to boot from CD...' (just press any key)
4. Install XP & pay attention to the link I posted earlier.
5. Good luck

That means I wont have to reset the BIOS to let the PC start with reading the CD rom drive first?

And what is this all about? (From the manual you gave a link to, about formatting the HD with the XP CD....)

I tried this on my computer but I couldn't find the ANY key. Can somebody tell me where that key is located on the keyboard?

Hmm... well, you might have to. Try it first without changing the bios - it might just work, and then if it doesn't, make the change in the BIOS. It always just does that on my machine, so I don't know what the BIOS is set to.


Sometimes there is exotic hardware that XP doesn't support out of the box. Some weird SCSI CDROM drive or some such. I'd put a 99% chance that your CDROM is supported by XP & you can just ignore that.

You might have explained b4 how to change the BIOS settings, but I cant find it just now. Can you remind me?

Then the next point:



Do I need to make any partitions? If not, how do I indicate that? With a single key strike? And then I can just proceed? Or do I really need to make partitions?

1. Try just booting with the XP cd in the drive. While booting, the screen should come up 'Press any key to boot from CD...' - you can just not hit any button and it should boot right into your normal XP. This confirms that you can boot from CD.

2. If you do not get the 'Press any key...' in (1), then you need to get into your BIOS (usually pressing F2 or Del key during the computer's startup screen). If you get to the XP startup screen, you didn't hit the right button, or didn't hit it fast enough - just restart & try again.

3. In your BIOS, look for an option called 'Boot Order' - its somewhere, but every BIOS is different. Don't be afraid, just look around. Usually on the right or the bottom of the screen there will be instructions for moving around the BIOS.

4. Find the Boot Order, and modify it (look at the instructions) & put the CDROM first.

5. Save & Restart & then you should get the 'Press any key...' option. If you are ready to install, just press a key to start the setup.

As for partitions, its a personal preference - I usually split my HD up into a C: & D: drive, but keeping it all on one partition is fine...