Removal of Virtumonde.generic shut down the operating system!

Discussion in 'Malware Help (A Specialist Will Reply)' started by Beamer, Jun 9, 2008.

  1. Beamer

    Beamer Private E-2

    I am new today, so please forgive any mistakes! I have a school lab of 24 computers which run on Windows 2000 and 2 on Windows 98(which didn't have the problem). I ran the end of year scans I usually run, one of which is Spybot. Two things happened: I updated Spybot, was asked to restart the computers, 5 out of 6 won't start except with a blinking cursor in the upper right hand corner. After that, I did not install new updates on the rest, ran the Spybot Version 1.4 and it found the Virtumonde.generic problem. I "fixed the problem" through Spybot and when I started them the next day, 12 of 14 either had the blinking cursor or "a disk read error occurred, press ctrl-alt-del to restart"! I tried to reboot using the 2000 CD and the setup boot disk floppies to neither worked to restart the computers.

    What happened and what can I do to solve this horrendous problem???

    Thanks for your help!

    Rose
     
    Beamer, Jun 9, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Do you mean you updated the 1.4 program to 1.5.2 or do you mean you just updated 1.4 to use the current detections. Spybot does not normally ask for PC to be rebooted.

    Did you power down and then try starting? Have you tried to boot into safe boot mode? When you power down a PC and then restart do you see any text appear on the screen related to BIOS...etc. Do you ever see the Windows 2000 logo?

    Spybot does not really fix Virtumonde and in most cases does not even find the real problems related to it.

    But what had you done on these 14 PCs. Had you only run Spybot 1.4 and done nothing else? Did you run it on all of them before rebooting any single one? Why would you continue on after the problem you experience on the first 5 or 6? When was the last time before this that any of these PCs had been rebooted?

    Not sure what you mean here. If you ran the Windows 2000 CD didn't it boot up to ask you if you wanted to repair or install Windows? When you boot from the Windows 2000 CD that is what should happen.

    Virtumonde itself or the removal of Virtumonde is not known to cause problems like this. So you must have had other issues.

    At this point you are really in the wrong forum since we cannot help you if your PCs are not bootable. You will have to try using safe boot mode, or last know good ....etc to see what happens. Also you can try doing a Windows Repair using your CD on one PC to see what happesm.
     
    chaslang, Jun 10, 2008
    #2
  3. Beamer

    Beamer Private E-2

    Thanks chaslang for your reply and for your welcome. Sorry it took so long to reply, had trouble getting to this page today. I am trying to get a handle on doing this so bear with me! I'll answer your quotes in order...

    My lab has 24 computers in it and I just start in the first row and go one by one defragging, updating Windows, Ad-aware scan, etc. and Spybot was the last one I was going to each and updating. When it updated to 1.5.2 in the first row, I went back to them and several said "to finish updating, please restart your computer" which I did. They never came back except to a blinking cursor (upper left-hand corner) or "a disk read error has occurred". If you can picture, I am doing this one by one up and down each row. So by the time I realized what was happening, I didn't do anything with the update on the rest, I just went back to the 1.4 version, ran the Spybot scan, and the one thing it kept finding was the Virtumonde.generic virus. As I always do, I "fixed the problem" (that's what the option is called in Spybot) and they were fine when finished. I was at the end of the day so I shut them down and when I came in the next day, the same thing happened to them even though I had not updated the Spybot version. I have 3 that didn't "find any problems" and they still work so I have to think it had something to do with the Virtumonde.generic issue. I've gone back to all the computers that do no start up several times but nothing happens.

    Each of the computers I was working on with the end of the year scans were restarted every day and worked fine until the started updating and scanning with Spybot. I've used it each year and find it to be very good. As I said, I stopped any updating when I found they didn't reboot. I just ran the older version I had used at the end of last school year.

    When I used the Windows 2000 CD to reboot, it did ask to repair or install, I chose to repair and it went through many loading of processes, and then it asks if I have Windows 2000 Emergency Repair Disk, which I did, and used it when asked to do so. At the end of that process, the screen said "please press any key to boot from the CD" which I did and that's where the rebooting process ends. I also had previously made a set of "Windows 2000 Setup boot disks" on floppies, which I tried as well, and again, nothing past the Emergency Repair Disk sequence.

    I cannot get to safe mode, I start and push the F8 key and I have the choice of (F10=Setup) or (F12=Network Service Boot). I've used both, F10 to change so it read the A drive first rather than CD when trying the boot disks, but I've never been able to get to safe mode or any kind of MS-DOS prompt.

    Honestly, I used all of the computers everyday up until school ended and had no problems with any of them until all of this happened. I didn't really want to "reroll" every one of them again, but I'm not sure what other choice I have.

    I would appreciate any further thoughts you may have.....thanks again!

    Rose
     
    Beamer, Jun 10, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm not sure what to tell you. This is already outside the scope of malware. We have fixed thousands of Virtumonde type infections and it has not led to problems like this. I'm not sure exactly what it was that Spybot is removing to cause a problem like this but it sounds like it would have to be files required by the Windows OS to even get started. It really sounds more like a BIOS issue of not recognizing the hard disk. Are the hard disks being seen in the BIOS? Are they being configured properly? If you take the hard disk from one of these failed PCs and put it into a working PC as a slave drive, can you see the file system on this hard disk (the bad one)?

    Since you do not get any kind of indication that Windows 2000 is trying to load, it sounds like you have no OS on your hard disk anymore. It would be best to work this aspect of your problem in the Software Forum to see if you can get your PCs (one at a time) to be bootable.

    If you run Windows Repair from the Windows 2000 CD and tell it that you do not have any ERD's what happens?

    You may want to read the below and see if it of any help to you:

    http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/core/fnbb_str_hxob.mspx?mfr=true

    http://www.dewassoc.com/kbase/windows_2000/using_the_erd.htm
     
    chaslang, Jun 11, 2008
    #4
  5. Beamer

    Beamer Private E-2

    Thank you chaslang for all of your correspondence. I really appreciate your thoughts on all of this. I just know I need to get them up and running by the start of next school year! I guess my main concern is that I don't want the same thing to happen next year but I don't know what the cause was to avoid it! I'll look into your suggestions and will let you know what I find out.

    Thanks again............Rose
     
    Beamer, Jun 11, 2008
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Good luck Rose. It really sounds like it is not recoginizing the hard disk or it does not see a master boot record.
     
    chaslang, Jun 11, 2008
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds