Can't run any programs unless I run as admin?

Started by Icey, Sun 31/07/2011 06:48:11

Previous topic - Next topic

Icey

I had recently got a virus on my laptop. I fought like hell to get it off as it wouldn't let me open malwear bytes. I tried to download AVG but it didn't even won't to open. I found out were the virus was and took it off. After thinking I was good I noticed that I couldn't open any programs because windows didn't know how to open them. I tried to run them as admin and it work so I wasn't gonna really bug about it unless it got out of hand. The problem now is that I can't debug any of my games. It gives me an error and tells me to close out of AGS.

Is there a way I could fix this  :'(

Icey

Never mind, It's working again somehow :/

monkey0506

If you did in fact have a virus, can I ask how you got rid of it?

Coz, seriously, viruses are hell to get rid of. You'll think they're gone. Then, one day, maybe days, maybe weeks or even months later, it suddenly comes back..with a vengeance.

I'd be very cautious about saying you got rid of a virus, because that's about the time it's gonna rear its ugly head again.

P.S. AVG causes memory leaks in my experience. :P

Icey

I feel like I got rid of the virus & at the same time I don't. I mean sure I can open all .exe files again but now that I think about it I did download a new .exe reg file. I thought reg files don't go in effect until you restart. I haven't restarted my laptop due to me being cautious about losing my Games to some virus that I think is gone. I was able to get malwear bytes back and I am doing a full scan. I currently have no problem so I think it's gone.

As for AVG it's stupid and I hate it. It gave me a list of the 3 problems then might have been my problem but 1 of those 3 was a Keygen for Photoshop cs4. It said it was a Trojan horse and ended up moving it to the vault. I restored it but I couldn't open it and it kept saying it was a virus. It wasn't a virus as I have had it for months now.

Well the big point now is it is up to malwear bytes. :-\

Eigen

The only way I run my Windows XP box is that my main account is a regular user account, not the admin one. If I want to install anything I either use "run as" on the .exe or log in as an admin. Having your main account as an administrative one is pretty much the worst thing one could do on Windows. I mean, it has all the permissions and even for stuff that goes on in the background. This advice was given to me by the network sysadmin in my university. I'm glad I took it because I haven't had any problems since. Obviously, if you go crazy and browse a dozen pr0n sites a day you're bound to run into trouble no matter what. So, drop the administrative account and start using a regular one (if you aren't already)

Icey

#5
So if I make another account will it take up space? I always thought that by making anew account that the HHD splits up space for that account or something like that. Also could I just guest?

Also could someone do me a favor and check my like page on FB: Studtio3 DLG

I noticed that ever since this happened I jumped from 19 likes all the way to 50. I am happy but I would like to know if this is true or not.

Anian

Quote from: Studio3 on Sun 31/07/2011 11:33:35
So if I make another account will it take up space? I always thought that by making anew account that the HHD splits up space for that account or something like that. Also could I just guest?
An account takes up some memory because there are settings and folders that have to be made.
I would not suggest to guest, just a regular account, without admin permissions, it'll be a pain to install something, but I guess it'll keep you a tad safer. I don't know if that will help if you already have a virus. Btw viruses have a tendency to have backup and if you delete like folder on you disk, there's a chance it will come again.
I don't want the world, I just want your half

Peder 🚀

Quote from: Eigen on Sun 31/07/2011 10:53:16
Obviously, if you go crazy and browse a dozen pr0n sites a day you're bound to run into trouble no matter what.

What ??? You are telling me to STOP watching pr0n? NEVER! :=

Icey, keygens could very well have viruses in them. Why keep it after you've used it? If you really need to keep it I'd advice you to put it on a CD. Then after that I advice you to be carefull what you download. One day you might get caught and that won't be fun ;).

Also when you have truble running things like malwarebytes, run in safe mode!

Phemar

Quote from: Studio3 on Sun 31/07/2011 11:33:35
Also could someone do me a favor and check my like page on FB: Studtio3 DLG

It shows only 2 likes when I view it.

monkey0506

The fact that you've had a file or program for months (or any duration of time) without symptoms is not an indicator that it's not infected. You need to be aware of that.

Viruses do not want to be gotten rid of. Quite a few of them are self-replicating. In fact, a lot of them combine the following two statements at the point of infection, something along the lines of this:

- You download an infected file, which slips in under the radar of any prevention software you may or may not be running.

- You're certain the program is safe because you didn't get any alerts from your antivirus, so you go ahead and open it.

- At this point, the virus is running in your system's memory. You are now infected.

- The virus doesn't want you to know you're infected yet though. The sooner you catch it, the easier it is to up-root it. So, it silently creates a few copies of itself and embeds itself into your System Restore points and the main Windows system directories, the registry, and so-forth. It does all of this in much the same way that a completely normal program would do, because it doesn't want to set off any alarms. Again, it doesn't want to be found out yet.

- The virus needs time to be able to work its magic without setting off any red-flags. It creates some silent scripts to be run when Windows is loaded, to replace core system files and core components of your antivirus program (before your AV is even running!). It wants to get its roots as deep as possible before it lets you know that it's there. So it sits and waits, silently biding its time. Again, this could last weeks or even months.

- Finally, once the virus has embedded itself into your system deep enough, it determines that it's time has come, and it's ready for you to find out just how deeply nested inside your computer it is. Things suddenly stop working, breaking, files go missing. You try to do a System Restore, but the virus has already beaten you to the punch. If System Restore is even functional at this point, you're just restoring it to an already infected state.

This is how viruses work. You can sit there and say, "that's crazy" or call me a liar or what have you, but I'm speaking from first-hand experience in having dealt with recovering systems from viruses.

Regarding the idea of creating a non-administrator user, that is a preventative step, and it won't help once you're already infected (except perhaps against the introduction of new viruses that the primary one doesn't just invite in itself). The basic principle is that if you're on a non-administrator account on Windows NT (or a derivative thereof, such as XP), then you do not have the permissions to "install" programs. The security policies for non-administrators actually make it significantly harder for the virus to silently replace core system files if you in fact try to run an infected file. These policies won't mean much once the files have already been overwritten.

Oh, and Peder, "Safe Mode" is a very common hijack point once you've been infected. What I'm getting at here is that from the time you become infected until the time you manage to actually rip the thing out, kicking and screaming, it's running any time your computer is.

Tabata

Quote from: Phemar+ on Sun 31/07/2011 14:06:19
Quote from: Studio3 on Sun 31/07/2011 11:33:35
Also could someone do me a favor and check my like page on FB: Studtio3 DLG

It shows only 2 likes when I view it.

same here  ???

Peder 🚀

It shows 2 likes when I am not logged in but 19 when I am..

LimpingFish

Of course, depending on the "virus", anybody who downloaded and ran any of Icey's games could now be infected.

I'd watch out for that. ¬¬
Steam: LimpingFish
PSN: LFishRoller
XB: TheActualLimpingFish
Spotify: LimpingFish

Kweepa

And anyone who downloaded and ran a game made by someone who downloaded and ran one of Icey's games.

The AGS community is like a free love commune. Icey had to spoil it for everyone.
Still waiting for Purity of the Surf II

Icey

@monkey: I never knew that stuff. I thought the keygen was safe cause malwear bytes said it was ok. But AVG said it was harmful. I can get a free copy of Photoshop portable from my job. Also my laptop doesn't have a disk slot & Photoshop kept acting stupid because every time I turn off then back on my laptop it said the code was invalid.

@everyone: Thanks for checking. It's odd that it says 2 when not logged on. and 19 when you are. It says 50 for me still :/

@LimpingFish, Kweepa: Nah the games are safe. I have a special anti virus for my games. It's called OSD [optimal Shock Drop]

Icey

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Studio3\AppData\Local\gyn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Studio3\AppData\Local\gyn.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Studio3\AppData\Local\gyn.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\uwkd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

WHAM

Since I've worked in computer maintenance for years, I would recommend a fresh reinstallation of windows as follows:

1. Backup everything you absolutely need onto an external hard drive
2. Reinstall windows, install antivirus software, update it. After fully updating the windows and the antivirus software, disconnect from internet
3. Plug in external hard drive, run a full scan of it now, preferrably with windows in safe mode, repeat a few times with reboots in between
4. Reinstall windows one more time, remember to install antivirus software and update everything
5. Restore backed up files from external hard drive, continue use

I can warmly recommend F-secure Easy Clean (http://www.f-secure.com/en_EMEA-Labs/security-threats/tools/easy-clean/). You can download it now, and as per instructions that come with it, run it a couple of times before doing the above steps to minimize any viruses you might get in your back ups.

Also, if you have a history of getting viruses and trojans on your computer, I would recommend ditching free antivirus software altogether, and going for commercial ones. I have most experience with F-secure (so I'm biased) but for me it has been loyal and effective, and it has improved and gotten lighter every year. Whatever you do, do not get McAfee or Norman, those I have learned to detest over the years. Norton is a fair compromise too, but F-secure is better (I'm still biased, though).

All this takes roughly a day to do, but it's pretty foolproof and on the upside, reinstalling windows always gets rid of lots of unwanted and forgotten crap too, so it's good for your computer. It may seem a bit like overkill, wiht two fresh reinstallations, but heck, you can never be too safe with this stuff, especially if you're distributing software (such as AGS games) to other people regularly.

Hope somebody finds this useful.  :)
Wrongthinker and anticitizen one. Utterly untrustworthy. Pending removal to memory hole.

Icey

I find that very helpful, however I need to go through a lot just to reinstall windows. I guess I am better off (A)making a another account or (B) Updating windows to ultimate.

Bulbapuck

Quote from: Studio3 on Sun 31/07/2011 21:47:26
I find that very helpful, however I need to go through a lot just to reinstall windows.
Do it anyway.

I felt the same way when I had troubles with viruses. And one day I couldn´t start up my computer, even in safe mode! So I ended up having to reinstall windows anyway, but I lost some stuff that meant a lot to me.

Icey

I guess I just gotta do it then. it can't be that hard.

SMF spam blocked by CleanTalk