Tech: Comp Virus Crush 'Em 2.0

Subject: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 02 Jun 07 - 12:18 PM

This virus has downloaded itself onto my computer. Can anyone help me get rid of it please.

Cheers    Carole

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 02 Jun 07 - 12:22 PM

Just found another....Puzl'em 1.0.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Mick Pearce (MCP)
Date: 02 Jun 07 - 01:52 PM

Carole

A quick look round suggests these things appear in a list of screen savers. They should be in the Add/Remove program list (in Control Panel), but reading suggests that you need to start your machine in Safe Mode to get the Remove to actually remove them.

Mick

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 02 Jun 07 - 03:39 PM

Cheers Mick. I've no idea how to start my machine in safe mode...can you help please?

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Mick Pearce (MCP)
Date: 02 Jun 07 - 04:19 PM

Carole

(I assume you're running Windows here!)

Restart your machine (or start it if it's already off). You'll probably get a screen showing a memory check and when that finishes press F8. You'll be presented with a list of options, one of which will say Safe Mode - select that (use up/down arrows to get to it).

Windows will start in Safe Mode - you'll see that written at each corner of your screen, and the display will be low-resolution (things will look big - don't worry about it).

Use Start/ Control Panel/ Add/Remove Programs and (if what I've read is correct) you should see those things listed in the program listing (if your machine is up, you can check this before you restart). Just select Remove for each of them.

Then Restart your machine normally and they should be gone.

Mick

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 02 Jun 07 - 04:27 PM

Thanks Mick - you're a star! I'll let you know how it goes

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: GUEST
Date: 02 Jun 07 - 11:04 PM

IF - you get up and running "on-line" again....run a check with McAfee, Symantec, AdWare, C(rap)Cleaner, Zone Alarm, and finally, Gibson (GRI)...and perhaps six more offerings the fellows of this thread advance.

Stay away from porn sites.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Stilly River Sage
Date: 03 Jun 07 - 12:13 AM

Some computers have a different F key to get into the safe mode. Watch closely as it starts up and you should see a message that tells you (very quickly!) which key to push.

Tell us please what kind of computer, make and model, and what is your operating system?

SRS

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 03 Jun 07 - 01:25 AM

In Windows XP, F8 should always work for booting to Windows Safe Mode. It's built into WinXP. (KB 315222)

Some OEM builders may add another key that can be used, and some BIOS setups may allow something different. In theory, an OEM could change the F8 to something else, but there'd be no good reason that I can think of for doing it. Earlier Windows versions are much more subject to variations, with Esc, F2, F6, and F8 (and probably others) having been used.

In WinXP, however, it is NOT GENERALLY TRUE that you'll see a startup or post screen that will tell you what key to use, since WinXP generally skips the POST screen and also mutes the Startup Beep Codes. You can generally choose (in BIOS Setup) to have this preliminary stuff shown, but the default WinXP boot settings often omit it.

Another "peculiarity" to watch out for, is that while some BIOS chips support a USB port, some - apparently quite a few - don't. If your BIOS doesn't support USB, a USB/wireless mouse may not work in Safe Mode. You may also be unable to access USB devices, like external hard drives in the basic Safe Mode(s).

There apparently are a very few BIOS chips that don't support a Serial port, and with these even the common "wired" mouse may not function in Safe mode, although I don't believe this is common.

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Crane Driver
Date: 03 Jun 07 - 11:31 AM

I'm having to post this for Carole - she got the machine to start in 'Safe Mode' - it gets to the 'log on' screen where you click on your user name, but whatever you click on, the computer re-boots and you just cycle back to the same point. Windows never actually opens, so you can't get to Control Panel. Even if you click on 'Turn off Computer' it just re-boots.

Any suggestions? Or do we just take it to the fixer man?

Andrew

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Geoff the Duck
Date: 03 Jun 07 - 11:51 AM

I expect a lot depends on whether you have backups of the computer which would let you wipe the problem and replace it with a recent copy of the system from before the virus got hold.
If you have backups, your strategy could then depend on whose backup software you are using.

If you don't have backups organised, you ought to do so as soon as you have solved this current problem.
I use and thoroughly recommend onc called Acronis True Image, which will make a "snapshot" copy of a whole partition at a specific point in time. When your system goes kaput, you can boot from a CD which allows you to restore the snapshot and it just overwrites the trashed partition with what was there at the time of the snapshot.
I think I saw it on one of this month's computer magazine cover disc giveaways, so a trip to a bigger newsagents might be worthwhile.

Hope you get it sorted.
Quack!
Geoff.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 03 Jun 07 - 12:33 PM

There are only two causes that pop up in a quick search of the Microsoft Knowledge Base for continual reboots when attempting to enter Safe Mode . One or two specific kinds of Radeon Video cards are cited as possibly causing this, and a corruption in a UMAX driver when WinXP SP2 is first installed can do it. The second one probably can be ruled out if SP2 wasn't recently installed, although it would take some digging about in the machine to be sure.

In both cases, I would recommend skilled assistance. I don't believe that someone who needs hand-holding is likely to be able to navigate finding and correcting the cause. It's likely to involve multiple trial and error steps, where each successive step depends on the result of the previous one.

In WinXP Professonal, there is a thing called the "Recovery Console" that can be used in place of a simple safe boot. It's immensely powerful, but can totally mess you up if the installation is not done correctly, and turning it off is almost as complicated as starting it in the first place. I don't believe it's available in WinXP Home. I don't recommend attempting to use it in any event except by fairly knowledgeable and experienced users, and then only by those willing and able to read and follow exactly the detailed instructions.

I will note that I did not find a "virus" by the name given when I searched for it, although I only looked at the first 500 or so Google returns for my search. Does someone have a source that confirms that this is a virus and not just a deviant/obnoxious program?

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: bobad
Date: 03 Jun 07 - 12:41 PM

Some info on these here and here

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Mick Pearce (MCP)
Date: 03 Jun 07 - 04:08 PM

None of my original searches on them suggested that they were particularly malevolent, just wouldn't uninstall easily. Most said (as in bobad's 1st link above) that an ordinary uninstall just didn't remove the program. The one site I found had successfully removed them with an uninstall from Safe Mode as suggested above.

If you can't get to Safe Mode, there are other ways to remove files which are locked during system operation - HijackThis has an option to delete files on the next startup (before the system locks them). However HijackThis is a program you need to feel confident about to use (never use the Fix option unless you really know what you're doing - it highlights things that are potentially problems, but might be part of normal system operation - fixing them will probably stop your system!). However the delete files on reboot option (from the Misc Tools button) should be OK. If the programs install as screen savers (as one of the sites I looked at suggested) you should find them in the Windows/System32 directory, probably as .scr files. (However that's only surmise). Deleting these may leave rubbish in the Registy, but I suspect that most peoples registries have a lot of unneeded rubbish anyway! If you delete the files, you can have the entries removed from the Add/Remove program list by just trying to Remove them - it will tell you the files are no longer there and ask if you'd like to remove the entry from the list.

As I said, the sites I looked at didn't suggest they were dangerous.

Not having Safe Mode working is (probably!) a different problem, and not something I'd like to have not working on my machine. However as JiK suggests it may need expertise to sort that out.

Mick

(PS - I should have said to try the Remove anyway - they might have fixed the installers since the entries were posted on the sites I looked at).

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 03 Jun 07 - 11:48 PM

Any attempt to search for "Crush 'EM" in Google gets swamped with hits on a rap piece that's apparently be "covered" by 43% of all rap performers worldwide.

NONE of the links where "removal" is at issue seem to be able to provide any information about what these programs are, or where they might come from, although there are vague clues that might tie them to some drivers for an obsolete Packard-Bell scanner.

Some vague information seems to indicate that they're related to a "screen saver" function, that may have been "bundled" with a driver download.

Microsoft information suggests that the failure of Safe Mode startup might be related to scanner or video driver corruption, or use of an inappropriate driver for either. Installation of WinXP SP2 can corrupt either kind of driver, which will then cause the Safe Mode failure to boot. This corruption occurs only if the driver was incompatible prior to the SP2 installation. The procedure given is to boot normally, remove the driver, uninstall SP2, and then reinstall SP2. With the driver NOT PRESENT you'll get a valid installation of SP2. (You will also need many Megabytes of additional critical patches issued subsequent to SP2.) You can then, if necessary, install a compatible driver that you may be able to get from your video card maker.

As there is NO INDICATION that the files/programs in question are "viral," there is no compelling reason why they absolutely have to be removed, unless there is a specific performance problem that can be cited. Knowing what problem(s) the files are causing could be quite helpful in suggesting what needs to be done for removal.

The main reason why Windows Add/Remove Programs may not be able to remove a program is that a file that is open and running cannot be deleted.

The normal procedure for programs that start something during startup is to boot to Safe Mode, where the Startup folder contents aren't run. Add/Remove Programs usually can then do a complete removal.

One of the sites I found cited an error message stating that the "log-file could not be read by Add/Remove Programs." A couple of posts indicated the presence of "unwise.exe" files. This filename has been commonly used by an install/remove file sytem that's fairly common in junkware, and occasionally crops up in legitimate programs. Sometimes double-clicking the "unwise.exe" file in the folder for a junk program will remove the program, since (maybe) it can read its own install log. This file can also have the same problem with "running files" that Add/Remove Programs runs into.

IF THE COMPUTER CAN BE REBOOTED NORMALLY, you can look for what turns on the program during reboot. If you change things so that the program no longer starts during bootup, you can reboot normally, and Add/Remove Programs, or the associated "unwise.exe," may be able to remove the program.

The most common method of starting something during boot is to place a shortcut to the executable for the program in the Startup folder. If you delete the shortcut, rename it in a way that prevents it from running, or move it out of the Startup folder, the program should not run after your next reboot, and you can attempt to remove the program while running in normal Windows mode.

It probably is safe for you to look in the Startup folder, and see if you can identify something that might be starting the programs in question. You will need to turn on "View Hidden and System Folders" in Windows Explorer, and may need to look under multiple user names:

C:\Documents and Settings\<username>\Start Menu\Programs\Startup

Something of this kind is most likely to be under the "All Users" username, but may be in more than one place.

Processes can also be started during boot by an entry in the Registry, so it may be necessary to find the Registry entry that's causing the program to start, and edit or remove the Key. The next reboot would then not start the program, and removal of the program may be possible in normal Windows mode.

Since you do not know what Registry entry may require change, or where it is, "merely competent" help is not necessarily sufficient. You need CAPABLE assistance from someone who knows how to work safely within the Registry, if you need to proceed to this point.

The inability to boot in Safe Mode indicates a fundamental problem that needs to be corrected, and if you can't get a normal boot to Windows you'll have to fix it first. You probably would benefit from letting your local support genius make the attempts to fix this.

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 04 Jun 07 - 05:28 AM

Thanks for all your help....I'm taking my machine into the local computer shop today - this all seems way beyond my capabilities.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 04 Jun 07 - 07:00 AM

Please do let us know how it all comes out.

And once you're healthy once again, come back and have more fun with us.

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: GUEST,SussxCarole
Date: 04 Jun 07 - 02:50 PM

Box now in capable (& probably expensive) hands of expert. Diagnosis imminent.......

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Jeri
Date: 04 Jun 07 - 05:17 PM

As far as I could tell, 'Crush 'Em 2.0' was something associated with a malware thingie called 'Hijack This' or something similar. I don't know whether it downloaded the other program, just infected it, or what. A techie is probably the best idea.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Mick Pearce (MCP)
Date: 04 Jun 07 - 06:02 PM

Unlikely to be HijackThis, Jeri. That's a well-respected anti-malware program (I've used it several times to clear up other people's machines). The only problem with it is that it requires the user to be very knowledgeable about what it shows you. It points out things that may be symptomatic of virus or malware operation. Unfortunately the same behaviour may be there for quite legitimate reasons and the user has to be able to distinguish which is which before getting HijackThis to fix things. There are several forums where volunteers will look at HijackThis log files that users post there and will tell them what to do (eg TomCoyote, CasteCops).

Mick

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Jeri
Date: 04 Jun 07 - 07:21 PM

Thanks, Mick. There wasn't much of an explanation in what I read, and I made the wrong association. The Google search I did was for (quotation marks included, "crush em 2.0".

The first hit is this thread.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 04 Jun 07 - 10:07 PM

A Google search for "Crush 'Em" (with the quotes) plus ".exe" (without the quotes) will find some information on a potential malware called "screensaver.exe."

Of 19 variants of the "screensaver" found in circulation by spywaredata, only one is classed as other than "?Safe"

One of the variants found (a ?Safe one) loads:

[%PROGRAM_FILES%]\bearpaw 4800ta pro\crush em\bin\
[%PROGRAM_FILES%]\scanexpress a3 usb\crush em\bin\
[%program_files%]\mvvr-100\crush em\bin\
[%PROGRAM_FILES%]\packard bell diamond 2400\crush em\bin\
[%PROGRAM_FILES%]\diamond 1200plus\crush em\bin\

There is no known source for this "program," however the packard bell diamond 2400 and diamond 1200plus are obsolete Packard Bell scanners. So far as I can determine, Packard Bell no longer manufactures or sells any scanner in their line of trash¹ and offers NO SUPPORT for ones it's dropped, so anyone who has one of these scanners would have to resort to "random web sources" for a driver for it. This package could have come as part of a "bundle" when a driver was downloaded(?). There is no indication that this "screensaver" has any known viral or other malware content.

The single "screensaver.exe" that shows as a threat is listed as produced and distributed by a company called "MacSourcery." The download is called simply "[%PROGRAM_FILES%]\downloads\" and should be caught by any current AV/Antimalware protections either at download or at first attempt to open any files in the folder. The source also perhaps implies a "Mac Only" malware. No "crush 'em" files are indicated, but they could possibly be contained in the folder shown, since no detailed file list is given.

Note that one of the other ?Safe "screensaver" sources is Macromedia, which is generally considered a safe, if buggy, producer.

¹ I'm aware that Packard Bell is a fairly popular maker in the UK, and perhaps elsewhere; but they were literally run out of the US several years ago for producing random/undocumented hardware changes, using used parts and selling them as new, and for nonexistent support. Hopefully, for those who may have patronized them, they're better now.

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: GUEST,Gene
Date: 04 Jun 07 - 11:23 PM

It has been mentioned several times in different posts but I think
most users tend to disregard the advice...BACK IT UP!!!!!

BACK UP UR ENTIRE HD OPERATIONAL CONTENTS OF YOUR SYSTEM!

Hard Drives are VERY CHEAP today compared with earlier years...

at least in the SW part of the U.S. -- COMP USA, BEST BUY,
CirCUS CITY [and I mean exactly that, the video game and tv noise is
horrendus] and Office D-POT...offer 80G/120G/160G HDs on an almost weekly basis for under $100 or $75 and sometimes even less....
on Holiday sales...

I GHOST the HD of every machine I buy before i even hook to the
internet...

This past weekend I bought a MY BOOK 500 GIG EXT HD for $129.00 + the govenors fee....

and I keep only COPIES on the PUTER..I put an average of 10+ LPS/
CAS on the puter each week...and burn to CD...

Each new puter comes with RESTORE CDS...but the GHOST HD route
is the best PROTECTIVE METHOD I know of...

GG

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: My guru always said
Date: 05 Jun 07 - 08:32 AM

Good advice Gene, backups are essential!

Have tried Ghost myself but it's not happy with some of my drivers, not sure why - pity. Getting used to reformatting and spending hours updating and reloading.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 05 Jun 07 - 01:59 PM

Backups are essential, but are only one part of the deal.

What happens when you backup a drive that already contains malware, or that contains a defective program or other component that you just hadn't discovered when the backup was made?

In the present case, we don't know why it was decided that the two "problem files" needed to be removed, but it's quite likely that they have been present for some time and would also be contained in any backup likely to have been made.

We also have learned that the computer in question can't be booted to Safe Mode. Since the user has never tried to boot to Safe Mode we don't know when that failure occured; but the condition quite probably has been present long enough^** to have been backed up by anyone who kept their backups current.

In this case, restoring from a perfect backup would solve absolutely no existing problem. The computer quite probably still would not boot to Safe Mode, and the unwanted files would still be present after restoring from any backup likely to have been made.

^** The causes for inability to boot WinXP to Safe Mode that are described by Microsoft's Knowledge Base all relate to incompatible drivers at the time of installation of SP2. SP2 was released approximately two years ago, so it's quite likely that this computer has not been able to boot to Safe Mode since then. Any backup within the past two years would contain the error, and any backup more than two years old would be obsolete, since it wouldn't "be SP2" which is required for support of the system.

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Geoff the Duck
Date: 05 Jun 07 - 02:39 PM

Microsoft don't exactly make it easy for us, though! Do they?
Strange that everything is always "somebody else's fault" including the fact that the operating system is a botch job to start with and needs gigabytes of updates and patches just to paper over the cracks.

Carole and Andy. I echo Gene. Good Backups are essential, but as John says, a backup of an existing problem or infection will just restore the problem.
Mgas - I have been using Acronis True Image for a couple of years now and I haven't found Ny problems running it. It can be installed on the PC or run directly from a CD without Windows even booting up. The installled setup allows you to "explore" a disc image as if it was a real "read only" drive. Useful if you wantes to copy individual files from the backup.
I believe the latest version of the programme has a lot more whistles and bells compared with the version I have been using, but I don't "need" more than the basic backup ability.
As mentioned earlier, I thik it is on a UK computer magazine "freebie" disc this weeek but can't recall which one.

Quack!
GtD.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 07 Jun 07 - 03:38 PM

Yipee...all sorted!   Windows was completely corrupt & viruses (no idea what)found in my data!   Clever guy at computer shop has cleaned & saved all my data and put my machine back to factory settings with my restore disc! It's wizzing along now! All for £60 - lots of dosh - but a bargain! Thank you to everyone for your help

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 07 Jun 07 - 05:13 PM

Good news!

Now, for future fun and pleasurable things to do, you need to:

1. get a good Antivirus program installed and updated, and set up for regular updates and scans.

2. hook up and get caught up with all the Security patches that have been issued since your recovery disk was made.

3. figure out what kinds of antispyware tools you want to set up and use.

It'll be lots of fun!!! .......(?)

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: SussexCarole
Date: 07 Jun 07 - 05:24 PM

Thanks John. My worry is that I have always run Norton & used 3 different spyware programmes. I've got Norton re-installed & updated again as well as another Virus programme AVG & just need to add back on some spyware programmes.

All available updates are uploaded....so all I can do now is cross my fingers.

First viruses I've gone down with in all my computer days - the medicine wasn't too expensive so here's to the future years!

Cheers   Carole

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Geoff the Duck
Date: 07 Jun 07 - 06:30 PM

Carole - I stuck my head in at local W.H.Smiths this afternoon and the computer magazine is PC Answers, July 2007 Issue (UK magazine). It has Acronis True Image 8.0 on its cover disc. It also has a partitioning tool and a couple of other useful programmes.
I would strongly recommend getting True Image (definitely worth the £5 or so for the mag) and take a mirror image of the system drive before you start making big changes or reinstalling software.
If you have such a backup safely stored it doesn't take long to restore your setup if you ever get a virus problem. It just overwrites the crud with a working copy of the system.
Quack!
Geoff.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Geoff the Duck
Date: 07 Jun 07 - 06:35 PM

Oh by the way, A few weeks back I was asking for suggestions for programmes which help keep the nasties at bay. Various catters suggested different things which help to protect your computer from unwanted programmes, spies and viruses. You may find it worth a look. Here is the BLICKY.

Quack!
Geoff.

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: JohnInKansas
Date: 07 Jun 07 - 06:51 PM

WinXP has a built in backup system that will let you mirror your system for recovery.

Any hard drive that you purchase new to have a place to backup your hard drive will come with a CD with diagnostics and backup software, that will allow you to mirror the existing hard drive.

You can go to any hard drive maker's website (there are only a couple) and download an up to date setup program¹ that well let you mirror your old hard drive onto a new clean one.

¹ At Seagate, the backup program is a free trial copy that expires in 14 days, but you can download a fresh trial copy as many times as you want, or you can register the copy for a nominal fee if you expect to use it regularly (which isn't really likely).

A backup isn't significantly less likely to get corrupted or infected unless it's on a drive that is not connected to your system when you're not actually making or restoring a backup.

John

Subject: RE: Tech: Comp Virus Crush 'Em 2.0
From: Geoff the Duck
Date: 08 Jun 07 - 07:32 AM

The problem of running something under Windows XP is that you have to have XP actually booted up and working. Most serious problems either trash the operating system or make it something you don't want to run as it allowas a virus to spread even further. The Acronis programme works on the computer before an operating system can boot up. In a sense it becomes the operating system whilst it is running. Because it is an operating system with very limited objectives - copying a partition and saving it as a file or reading a file and writing the information as a new partition, either on a blank sector of your hard drive, or overwriting a corrupt partition - it can be run from a bootable CD.
I haven't used any "Mirror" backup programmes other than the Acronis one. I tried it because I got a trial copy on a computer magazine cover disc. The thing I like is that the rescue can be run from a bootable CD. You need Windows to run the initial setup and burning of the recovery CD, but once you have that it can be run without an operationg system on your computer. Burn a backup onto a CD or DVD and you can even remove your hard drive and replace with a blank one and Acronis will restore the original content onto the new drive.
Of course a DVD or CD can get trashed, or potentially degenerate over time, but it can't get infected with a virus at some later date as it is on a fixed medium.
Another plus point is that it copied tan image of the drive, so it doesn't matter what the drive actually contains. It could be data (all your photos/sound files) or a partition containing an operating system. It will back up a partition which has a version of Linux on it just as happily as one with Windows XP/ME/98 or whatever.
I like it because it is easy to use and very effective.
Quack!
Geoff.