Is this possibly a virus doing this?

jimpeel · Jul 15, 2006

In my event viewer, I get these messages that my anti-virus program has started successfully and then a couple of minutes later that it has been stopped and three seconds later that it has been started again. This happens often. I know that there are viruses which attack the anti-virus programs to turn them off but I don't know which ones are noted for doing this.

I have run AntiVIR, http://housecall.trendmicro.com/ , AdAware, Pest Patrol, and Spybot but they come up clean.

Could it be a virus doing this and if so which virus could it be if known?

Event Type: Information
Event Source: H+BEDV AntiVir
Event Category: AntiVir
Event ID: 4096
Date: 7/14/2006
Time: 9:27:41 PM
User: NT AUTHORITY\SYSTEM
Computer: JIM_PEEL
Description:
The AntiVir service has been started successfully!

Event Type: Information
Event Source: H+BEDV AntiVir
Event Category: AntiVir
Event ID: 4097
Date: 7/14/2006
Time: 9:30:34 PM
User: NT AUTHORITY\SYSTEM
Computer: JIM_PEEL
Description:
The AntiVir service has been stopped!

Event Type: Information
Event Source: H+BEDV AntiVir
Event Category: AntiVir
Event ID: 4096
Date: 7/14/2006
Time: 9:30:37 PM
User: NT AUTHORITY\SYSTEM
Computer: JIM_PEEL
Description:
The AntiVir service has been started successfully!
Click to expand...

The other message I keep getting is that my drive has a bad block but this is the same message I got with my other drive. I have run chkdsk /f and chkdsk /r but they find nothing wrong with either drive. I have also tried the manufacturer's disk scanning program and it also gives a clean bill of health to both drives.

Event Type: Error
Event Source: Disk
Event Category: None
Event ID: 7
Date: 7/14/2006
Time: 6:59:29 PM
User: N/A
Computer: JIM_PEEL
Description:
The device, \Device\Harddisk0\D, has a bad block.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Click to expand...

Could this also be a characteristic of a virus?

I went to the malware removal page and did all of the steps last week and there was nothing there that was suspicious. I downloaded all of the programs, ran them, updated them, ran them again, went through the steps one by one to the end and saw nothing that would raise my hackles.

chaslang · Jul 16, 2006

The problem with Antivir being stopped could be due to malware. There are many such infections that do things like this. One is W32.Kelvir.BD. See:

http://www.sarc.com/avcenter/venc/data/w32.kelvir.bd.html

The bad block on your harddisk most likely has nothing to do with malware.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

.

jimpeel · Jul 17, 2006

Soooooo ... I get to the part in the step by step solution line 1) which states "... disable system restore and reboot!" and when I reboot I get this little gem.

SMART Failure predicted on hard disk 0: Maxtor 6Y120P0-(PM)

WARNING: Immediately back up your data and replace your hard disk drive. A failure may be imminent.

Press F2 to continue
Click to expand...

Any thoughts? Do any viruses mimic hard drive failures?

chaslang · Jul 17, 2006

jimpeel said:

Soooooo ... I get to the part in the step by step solution line 1) which states "... disable system restore and reboot!" and when I reboot I get this little gem.

Any thoughts? Do any viruses mimic hard drive failures?
Click to expand...

As I said in my previous message! Not malware! This is a physical hard disk problem as the message indicates.

Also you are not supposed to disable system restore until malware has been removed (if you have any). The READ ME says:

1: WARNING TAKE NO ACTION UNTIL YOU READ THIS WHOLE STEP.

Temporarily Disable System Restore only after all Malware has been Removed (this step only applies to WinXP & WinME)
Click to expand...

It goes on to say this two more times.

Log in or Sign up

Is this possibly a virus doing this?

jimpeel Sergeant

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jimpeel Sergeant

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Log in or Sign up

Is this possibly a virus doing this?

jimpeel Sergeant

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

jimpeel Sergeant

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches