Hey I need help! SERIOUS HELP! But apart from that i need help with my pc. It was running on ME (bleh) so last week i decided to upgrade to XP - i knew i had trojans on the system before but i thought I had managed to remove them with AVG. Sadly it appears they have returned but this time with some friends! The virus seems like a worm virus to me but when i tried worm blast it found nothing. Spybot S&D removed what it found but sadly theres still stuff there. Unfortunately now im at the point where it wont let me run any antivirus programs on it at all. It just fails to run them and if i try to ceonnect to teh internet it shuts me down(typical worm feature) I know one of the files was called teekids, i am pretty sure another has attached itself to svchost but if i try to remove any processes it shuts me down. I'm totally at wits end now.
Does anyone know what virus this might be so that i could possibly delete something in the setup or has anyone else experienced this and not had to format???
Please I'm desperate now and running out of time before i put my head thru the screen!

I take it you didn't do a fresh install of XP?

You need the right tool for the job...a Trojan Remover:

http://www.simplysup.com/tremover/download.html

You are new to XP so do this first. Diable your system restore by right clicking on my computer---->Properties--->System Restore tab-->Check the button to turn it off. Viruses use this to hide themselves in backup where they cant be removed. Then reboot into safe mode, loading only the nessasary components. Then run your antiviruses and spywares. Also, you could try this which will install to the control panel, it is called "startup" this will allow you to select what boots when the OS boots. Make sure that all scanners are up to date, as well as your XP operating system. Then go here and run the shields up test on all open ports. Green is good, red is bad.

hi kate,
you probably have the worm blaster and the associated welchia worm
try getting a copy of the worm blaster fix, and welchia worm fix from someone you know and run it.
hope this helps,
murve

Thanks for your responses guys. I already disabled system restore, which had no affect and i also ran Symantec Worm blaster that didnt work. But I shall definately have a try at some of your other suggestions. I wasnt sure that running the scanners in safe mode would still pick up the viruses or not or if they may just go to sleep. I think i shall run as many things as I can and then install a fresh version of XP. Again, thanks so much for your help! I'll let you know!

My reasoning for telling you to boot into safe mode is because when you boot in normal mode, the computer will load everything, including any malicous programs that you dont want to run. The program I mentioned to download, called startup will allow you to select the bootable programs. However, there are still others places that applications load from, another common place is your System Services. Where applications can boot before you log in to windows, allowing them to disable anti-virus, change there location, or even change files sizes. I think you get the point. When in safe mode, it won't load the extra services or the extra programs, it will only load the nessacary programs to boot. So, it may seem like a pointless step, but it may help correct your anti-virus not scanning or even help to locate the origin of the virus. If you discover what the program is that is doing this in any of the scanners, post the name. We will be able to help you better once we can identify which program is the source. (more specifically the virus name, and affected files)

It may not even be a virus at all. Have you identified one with your scanners? If not I am willingly to bet it is something else. Perhaps a bug. Since you didn't do a complete format of the drive before loading XP you have taken I believe, a FAT32 file structure (older, 98 style files) and put a NTFS file structure instead. Which means your PC will have to emulate ALOT to try and run all these older files. Why not burn your important data to a disk, then wipe the drive completly clean. Then when you get XP back online, install all of your security app's like firewall, antivirus, spyware blockers and scanners, etc... That way you have a clean start. I don't know a great deal about ME file architecture, but I do know that it is as buggy, if not worse than 98SE. Also, the FAT32 architecture that I mention is a poor design (an upgraded design from Win95 and DOS) It is VERY common in these old enviroments to recieve memory leaks, crashes, hangs, etc... So Windows revamped the poor design and created NTFS. Which is 10000% more efficent, little to no memory leaks, faster file access, better managment, etc... Well, the two designs can't work hand in hand, so Windows created an emulator. Which is a program that acts like FAT32 and trys to run it in the old FAT32 enviroment. Problem is, Microsoft is out for money, they rushed the emulator to quickly to sell the operating system. Thus, the emulator is junk, and is common to crash. The only reason I mention this is so you can see why taking your old files and putting them on a new computer may not be a great idea without a full format. Also, another belief of mine, is that when you defragment using the Windows XP utility, it fragments using the NTFS structure. If your files are all FAT32, this will actually make files slower and harder to access. And finally to sum up, it may be your winsock. I had ME for a few months to test, and I had my winsock crash probably 5 times. You can try to search microsoft for the patch to fix the winsock. (hopeless, I got something like 10,000 page results) or you can do as I have mentioned.

*************

Have you tried unplugging the power to your modem (if cable internet or DSL) Waiting 30 seconds, plug it back in. Then wait a few minutes untill you see the activity light on your modem. (not status light or the link state light, the Activity light) Then go to Start Button ---> Run ---> then enter Cmd --> click enter

Then type in this exactly without the quotes
"ipconfig /release"
then type this
"ipconfig /renew"

Agobot also will not let you run any anti virus progs and a few others even, run stinger in safe mode to identify what virus it is and run the fix for it, or run the avg dos version cause the agobot won't shut it down it only shuts down the win32 exe version. Run the avg.exe in safe mode ang it will identify it also. Note the win32 version is the avgcc32.exe and the dos version is the avg.exe, also while you are in safe mode run msconfig AND regedit to see what progs are loading in startup and do a search for them on the net, that might be helpful in trying to find out what virus it is so you can get it removed. After it is removed you will need to download and apply the dcom patch or it will just redownload itself to your pc when you get on the net.