Infected with Virus. Any help appreciated.

star07 · 10-25-2009, 03:14 PM

Hi
My computer fell victim to the patching virus Virut all of a sudden today. :(

I was always careful with anything i download/sites i visit..had mcafee running..both virus scan and firewall and still got infected. I guess there is no such thing as a full protection

I read some posts regarding this virus on this thread and i have a few questions.

1
Is there a sure-fire way to get rid of this virus?

i saw an video on how to get rid of this Virut on youtube and am following the instructions as i write this post(using a different machine)

The video apparently that does not fix everyone's problems as the comments there show.

2
Im thinking of upgrading to windows 7 next week.(have ordered a new HDD as the current one i have on my laptop is kinda old and not spacious)

should i wait till i get the HDD and install everything fresh?

but if i were to do that...i need a lot of data from my current HDD...im a student and i have a lot of files that i really need...:(

what type of files can i transfer without running the risk of re-infecting my new machine?(im thinking writing those files to a dvd/cd and putting them in the new HDD/OS)

are pictures and text files ok?

but i would really like to get my machine working again because i have a couple of midterms coming up next week and i wont be able to get the os/hdd till the end of next week.

any help is much appreciated
thanks in advance!

star07 · 10-25-2009, 04:03 PM

Hi

I apologize for posting another post rather than editing the previous one. But i am not able to find the edit option anymore.

I ran into a problem when i restarted my machine which was infected with Virut virus. It loads but i only see a black screen. and the mouse cursor. no icons..no bars or menus...

when i click alt+ctrl+tab i get the menu but it only has the "change password/lock machine" option.

the same for the safe mode also. i see the "safe mode" tables on the four corners of the screen and the mouse pointer. and nothing else.

is there any way for me to save data/write it to a dvd or something ?

thank you

tetonbob · 10-25-2009, 05:12 PM

We do not try to clean Virut infected machines. It's just not in the best interest of you, the machine, or the rest of the internet.

Your system is infected with a polymorphic file infector called Virut. Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a format and clean install, or destructive recovery if you have an OEM recovery partition, is the best way to clean the infection and it is the best and safest way to return the machine to its normal working state.

Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (*.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too.

Recent variants also modify htm, html, asp and php files.

Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups. If that is not possible, then your data is lost.

See miekiemoes' blog for similar comments here:

http://miekiemoes.blogspot.com/2009/...-throwing.html

To help protect your computer in the future I recommend that you follow these steps and look into the following free programs:

Microsoft Windows Update - http://www.windowsupdate.com
Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
SpywareBlaster to help prevent spyware from installing in the first place.
- Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE.
Winpatrol

Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.

You can get a free copy of Winpatrol or use the Plus version for more features.

You can read Winpatrol's FAQ if you run into problems.
MVPS HOST FILE
The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
ANTIVIRUS SOFTWARE
It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

Do not install more than one AntiVirus program because they will conflict with each other.
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer
http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.

ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

tetonbob · 11-03-2009, 07:08 PM

Since this issue appears to be resolved, this topic will now be archived.

10-25-2009, 03:14 PM	#1 (permalink)
star07 Registered User Join Date: Oct 2009 Posts: 4 OS: vista 32 bit	Infected with Virus. Any help appreciated. Hi My computer fell victim to the patching virus Virut all of a sudden today. :( I was always careful with anything i download/sites i visit..had mcafee running..both virus scan and firewall and still got infected. I guess there is no such thing as a full protection I read some posts regarding this virus on this thread and i have a few questions. 1 Is there a sure-fire way to get rid of this virus? i saw an video on how to get rid of this Virut on youtube and am following the instructions as i write this post(using a different machine) The video apparently that does not fix everyone's problems as the comments there show. 2 Im thinking of upgrading to windows 7 next week.(have ordered a new HDD as the current one i have on my laptop is kinda old and not spacious) should i wait till i get the HDD and install everything fresh? but if i were to do that...i need a lot of data from my current HDD...im a student and i have a lot of files that i really need...:( what type of files can i transfer without running the risk of re-infecting my new machine?(im thinking writing those files to a dvd/cd and putting them in the new HDD/OS) are pictures and text files ok? but i would really like to get my machine working again because i have a couple of midterms coming up next week and i wont be able to get the os/hdd till the end of next week. any help is much appreciated thanks in advance! Last edited by star07; 10-25-2009 at 03:15 PM.

10-25-2009, 04:03 PM	#2 (permalink)
star07 Registered User Join Date: Oct 2009 Posts: 4 OS: vista 32 bit	Re: Infected with Virus. Any help appreciated. Hi I apologize for posting another post rather than editing the previous one. But i am not able to find the edit option anymore. I ran into a problem when i restarted my machine which was infected with Virut virus. It loads but i only see a black screen. and the mouse cursor. no icons..no bars or menus... when i click alt+ctrl+tab i get the menu but it only has the "change password/lock machine" option. the same for the safe mode also. i see the "safe mode" tables on the four corners of the screen and the mouse pointer. and nothing else. is there any way for me to save data/write it to a dvd or something ? thank you

10-25-2009, 05:12 PM	#3 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,775 OS: 2000 Pro; XP Pro; XP Home	Re: Infected with Virus. Any help appreciated. We do not try to clean Virut infected machines. It's just not in the best interest of you, the machine, or the rest of the internet. Your system is infected with a polymorphic file infector called Virut. Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a format and clean install, or destructive recovery if you have an OEM recovery partition, is the best way to clean the infection and it is the best and safest way to return the machine to its normal working state. Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable. Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too. Recent variants also modify htm, html, asp and php files. Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups. If that is not possible, then your data is lost. See miekiemoes' blog for similar comments here: http://miekiemoes.blogspot.com/2009/...-throwing.html To help protect your computer in the future I recommend that you follow these steps and look into the following free programs: Microsoft Windows Update* - http://www.windowsupdate.com Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. SpywareBlaster to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE. Winpatrol Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here. You can get a free copy of Winpatrol or use the Plus version for more features. You can read Winpatrol's FAQ if you run into problems. MVPS HOST FILE The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. ANTIVIRUS SOFTWARE It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out. Do not install more than one AntiVirus program because they will conflict with each other. Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT. ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry. NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster. In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles How did I get infected in the first place? PC Safety and Security--What Do I Need? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

11-03-2009, 07:08 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,775 OS: 2000 Pro; XP Pro; XP Home	Re: Infected with Virus. Any help appreciated. Since this issue appears to be resolved, this topic will now be archived. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009