viruses

[spaminator]

sometime ago i had an internet connection/computer restart virus. (the computer would restart after a few minutes of being connected to the internet.) i tried formating the hard disk and reinstalling windows. the same thing kept happening. the only thing that fixed it was installing all of the microsoft updates. my question is, how can a virus or viruses be still on a computer after formating the hard disk and reinstalling windows? :confused:

[networkguy]

Well if you don't have a firewall its possible that you got infected right after your install was complete. Or its possible you never got rid of the virus in the first place, did you do an FDISK or just a format?

NG

[spaminator]

Well if you don't have a firewall its possible that you got infected right after your install was complete. Or its possible you never got rid of the virus in the first place, did you do an FDISK or just a format?

NGi did a format and a reinstall using recovery/restore cds.

[networkguy]

Ok, but a format and an fdisk are not the same thing. A virus can live in the boot sector of a hard drive and a format will not get rid of it. If you do this command:

fdisk /mbr

It might, but I am not necessarily suggesting you do this.

What antivirus software are you running, has it identified the virus by name?

NG

[spaminator]

Ok, but a format and an fdisk are not the same thing. A virus can live in the boot sector of a hard drive and a format will not get rid of it. If you do this command:

fdisk /mbr

It might, but I am not necessarily suggesting you do this.

What antivirus software are you running, has it identified the virus by name?

NGi am running sympatico anti virus. it didn't identify the virus. microsoft, emachines, and sympatico told me, based on what i told them about the computer restarting after a few minutes after an internet connection, that it was a virus. they all told me that the only way to fix the problem would be to install all of the microsoft updates. after i did that, it appeared to fix the problem.

[networkguy]

Strange, doesn't sound to me like it was a virus then.

NG

[spaminator]

Strange, doesn't sound to me like it was a virus then.

NGyou might be right. i pray to god it never happens again. i wasn't able to install the updates using microsoft update because the computer kept restarting during the installation which kept destroying the files on the computer. i had to wait several months for the microsoft security updates cd to come in the mail because they were out of stock. :(

[frostyone]

Actually it does sound like a virus.

Viruses don't always live on your computer.

Windows ( and Internet Explorer) have many security holes.
There's a class of viruses that love to exploit these holes.

They live in that grey area called the Internet.
They are just there.

A famous example is the msblast family of worms.
"A worm is a type of computer virus that generally spreads without user action and that distributes complete copies (possibly modified) of itself across networks (such as the Internet)."

Keywords are " without user action" . You don't have to do anything at all.
Just connect to the net.

Symptoms (among others ) are
The computer may shut down, or may restart repeatedly, at random intervals.

Now if you have a patched. updated system you are alright.
If it's not updated , you can experience the effects of this worm and it's cousins.

The mere fact that it is out there , means you can experience system instability on an unpatched system. Even if you have an updated anti-virus.
It's the patches that are a necessary step.

What is required is a firewall.
Unfortunately in service pack 1 the windows firewall is not on by default.
As a result of these types of worms, in service pack 2 the firewall is on by default.

http://support.microsoft.com/default.aspx?scid=kb;en-us;826955

Edit to add:
To prevent this you need a firewall.
Then get the patches.
Then an anti-virus.
Even with an updated anti-virus you can get that rebooting.

f-secure:
"this might happen on Windows XP and 2003 even if you've applied the right patches. However, the machine won't get infected in these cases - just rebooted."
", it would probably be a good idea to install a firewall "

Trendmicro:
"The importance of applying these patches cannot be overstated "
"cleaning the system without prior installation may result to immediate reinfection or system instability."

The anti-virus , by itself, is not enough to prevent the system instability.
There are reports that even Microssoft's patches are not always effective.
( see f-secure)
Or Steve Gibson:
"We have received numerous confirmed reports of systems which were patched but reportedly remained vulnerable to remote DCOM exploitation. It appears that, for some reason, Microsoft's DCOM patch is not always effective."
http://grc.com/dcom/

You need a firewall.