Virus

Hey guys...I need some help here plz...two days ago I tried to update mi windows and after downloaded and installed the update the files , I rebooted my Pc as it said and my windows never started it just kept rebooting and rebooting so I just could use my windows on safe mode otherwise I just got the reboot issue...so I reinstalled windows ... not formatting... so now my pc is 'back to normal' except for two virus! my antivirus detects them but can't desinfect or erase it... I even ran my antivirus in a safe windows mode but the same happens... so I wonder if any of you could help me plz!!

the paths of the virus are:

C:WINDOWSsystem32.exe

[the antivirus says this is a backdoor named Backdoor.Win32.IRCBout.uv]

C:WINDOWSsystem32configsystemprofileConfiguración localArchivos temporales de InternetContent.IE5K1Q3IR6Lx[1].exe

[the name of the virus is Net-Worm.Win32.Padobot.m]

what can I do? I can't seem to find those files!!

help plz!!

thanks in advance

#412328

hmm I'd recommend a format. (and backup the data you want to keep of course)

I partition my Hard Drive in such a way that it is divided into two- a 'system disk' which contains 'Windows', 'Documents and Settings' as well as 'Program Files' and then 'My Documents' which contains all the stuff I want to keep.

Then, whenever A virus comes along, I format my system disk and leave 'My Documents' disk which contains all my files intact...

Formatting is the best way! it ensures a fresh copy of windows, and your system will be squeeky clean and run a lot faster...

NOW onto removing the virus in an alternate way- theres a program called 'HiJack This', which allows you to prevent virus' programs loading a startup. Use it to find the virus, and disable it, and then try manually deleting the files in system 32.

You said you got this virus after using Windows update?... is the virus called "Windows Genuine Advantage"? by chance?... is so you downloaded it from Microsoft, and it will continue to hound you to buy the software until you remove it; heres a link if this is the case;

http://en.wikipedia.org/wiki/Windows_Genuine_Advantage

Also, I recommend you use AVG Free anti-virus software; its free, the updates system is good, it uses low system resources and it has ALWAYS worked in removing viruses that other pay programs (Norton, McAfee, etc) couldnt.

If you have further troubles, let me know, your post could be more specific with reguard to what anti-virus you are using, your Windows version and how your system is set up hardware wise (how many hard drives etc)....

#412335

Get nod32. I've had great experience with this anti-virus. Ive been browsing websites and nod32 will immediatly pick something up and instantly terminate it before it does anything.

(thanks to alianyn for recommending it......)

#412339

a friend told me I should partition my hard drive.... but he also told me that in order to do so I needed to backup al my data and then formatting and after that partition my drive ... now I'm thinking seriously about formatting ...but i just did it a month a go!

the virus, is not the one you told me ...my anti-virus say theres to infected files and one is Backdoor.Win32.IRCBout.uv and the other one is Net-Worm.Win32.Padobot.m.

'bout my antivirus I've been using Kaspersky Anti-Virus Personal by two years or even more I think , and it's been amazing all this time... in fact my PC haven't been infected in that time.. but now this happens... I'l check up on that AVG Free anti-virus software you told me

#412340

there's annother issue... I've just got annother virus alert located on C:WINDOWShelpinternat.exe infected with Trojan-Dropper.Win32.VBfr and as the other two it can't be desinfected!!! I think I should reboot my HD!

#412341

a friend told me I should partition my hard drive.... but he also told me that in order to do so I needed to backup al my data and then formatting and after that partition my drive ... now I'm thinking seriously about formatting ...but i just did it a month a go!

...

Bite the bullet, and it will be worth it! What makes it worth it is partitioning your HD into two- it really is the way to go.

you will have to backup your data you wish to keep. I suggest you get your friend to help you if you're not sure how to do it... (just warning u so u dont f*ck up and loose ur data)

I dont know about the other anti-virus programs mentioned, but I do know that AVG works wonders on my cruddy old windows box (I write this from my Macbook )

Partitioning your hard drive into two is good for three main reasons;

1 * You can wipe the system disk during emergency situations without loosing your important data.

2 * It makes your computer easier to sort.

3 * Your system will stay faster. The fastest part of a Hard Disk is its center, the longer a HD runs, the more the data becomes fragmented on the outer edges of the disk, thus making it slow to access. By partitioning it puts boundaries on where data can be stored, stopping system data from spreading out and keeping it central. Thus you should make your first partition a system partition of about 15GB to store your system files in order to have it in the center (double check how much you will need to store program files, documents and settings and Windows)

#412362

luccatonic,

when you restart your PC in Safe-Mode do not forget to disable windows' system restore functions. Also you need to login as an adminstrator.

The fastest way is to reformat your harddrive - if you can't do that. I suggest you do this:

* get ESCAN. Escan is free, but it doesn't delete the virus itself. It just creates a logfile. You can delete the files yourself. http://www.mwti.net/products/mwav/mwav.asp

* Because you cannot delete some files while the system is running you will probably need KillBox (http://www.majorgeeks.com/Pocket_KillBox_d4709.html)

* After you deleted the files. I suggest you deploy those tools: Spybot (spybot.info), AntiVir(free-av), a firewall and you might need to get FireFox or Opera - if you are still using IE, or Thunderbird - if you are still using Outlook

#412377

er yeah i agree with Astyanax on the nod32 thing. however i also have a bit of a virus problem. how do i deal with this situation without a reformat of xp?

http://img246.imageshack.us/img246/8979/untitledww3.png

#414108

Slewed:

1. Don't use InternetExplorer

2. Get a FireWall

3. Run Virusscan again, after:

* you made a backup

* switched system restore off

* booted in safe-mode

4. Run SpyBot-SearchAndDestroy

5. Delete the following keys in your registry, and the exact keys only:

* regedit

* delete the following subkeys:

** SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{1C044AAD-7955-4cbd-8175-501A165C4E5D}

** SOFTWAREMicrosoftWindowsCurrentVersionControl PanelSettingsTime

* Check for those subkeys in all major key-branches (starting with HKEY_)

#414115

did all of the above except step 5 already. I know it probably is spyware since im getting a winfixer style popup in explorer (not ie) occasionally

i'm not so sure i'd wanna mess with the registry though, what do those two specific keys do?

#414152

don't surf porn sites

#414164

Dude, just go to one of those Spyware Forum and post a log of your HijackThis! I'm pretty sure those spyware experts can help you get rid of that virus.

#414168

can't i just go to dllfiles.com and download a replacement dll, then copy it over in safe mode or something?

#414292