Help! Viruses and Reg problems I think. Logs attached.

gravytrader · Aug 23, 2012

Hey guys, its been 3 years but I'm back! I am coming all the way from Tanzania now trying to fix a computer for my NGO.

First off, I'm running XP on a Dell Insperon Mini that originally had Windows 7 Starter on it. It was given to me like this to fix and I have no idea where or when the problem originated. There apears to be a copy of the windows folder called windows1 that I'm not sure what it's for but I wouldn't mind deleting if I can if it's just for shady backup.

There are alot of virus looking processes running the cpu down. There are also errors continously popping up saying "There is no disk in the drive. Please insert a disk into drive \Device\Hardisk1\DR3" asking Cancel, Try Again, or Continue (see attached error.bmp in next post)

All scans ran fine with the exception of HitmanPro which kept getting stuck after the scan in various spots. I'm guessing because trouble connecting. Still got the log after the scan though, hope it helps. I got two logs from TDSSKiller. I'll post the smaller one that came after the comp restart in second post.

Thank for the help!

gravytrader · Aug 23, 2012

Extra attachments mentioned in first post. BMP size was reduced refer to first post for the text if you can't read it.

chaslang · Aug 24, 2012

I'm sorry to tell you this but this PC really should be flatten and reinstalled from scratch. DO not copy/backup anything off of this PC unless it is a plain old text file. You have a severe Virut infection. See the below standard notice we post for Virut and similar PE file infectors.

The virut infection is a polymorphic infection which infects .exe and and .scr (screensaver) files. It will quickly spead and replicating itself by infecting all .exe and .scr files on a PC. It can accept commands to download other malware on the compromised machine. It will even infect files infected by another virus. Typical symptoms are unusual harddisk activity while it is infecting the system. Also unwanted TCP traffic. Virut tries to connect you into an IRC network under the user name "Virtu" and zombify you. Unfortunately, the cleaning of this virus is very difficult or almost impossible.

Even if we attempt to remove it, and we have had some success in the past, it is really safer to just bite the bullet and do a clean reinstall.

The problem is that the damage caused by this infection really makes a PC unreliable/untrustworthy. PE file infectors like Virut, Ramnit,.... etc can infect all executable files (DLL, EXE, SCR....and many more and also HTML). These infections can open back doors that truly may compromise your computer and your security. These backdoors could allow a remote attacker to access and instruct the infected computer to download and execute more malicious files.

In many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus or by other scanning tools. Also when disinfection is attempted, the files often become corrupted and the system may become unstable or irrepairable. The longer these type of infections remain on a computer, the more files it may infect and/or corrupt so the degree of infection can vary.

Virut and Ramnit can commonly be spread via a flash drive (usb, pen, thumb, jump) infection where it copies the worm using a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are a major source of system infection.

So all the above being said, and please do take serious note of the warnings, do you really wish to attempt cleaning even though the stability and security of your be cannot be guaranteed? And also note that we could spend a lot of time trying to fix it and still fail due to the number of files that have been infected. And lastly, since so many system files are infected, if we attempt to start cleaning the infection, there is a very high probability that the PC would soon not even boot up. What would you like to do?
Click to expand...

gravytrader · Aug 27, 2012

Thanks chaslang!

I guess today the virus wins :major

chaslang · Aug 29, 2012

You're welcome.

gravytrader said: ↑

I guess today the virus wins :major
Click to expand...

Yes with PE file infections they typically do and this was a very severe case of infection.

Log in or Sign up

Help! Viruses and Reg problems I think. Logs attached.

gravytrader Private E-2

Attached Files:

MGlogs.zip

HitmanPro_20120823_1501.log

mbam-log-2012-08-23 (13-49-45).txt

RKreport[1].txt

TDSSKiller.2.8.7.0_23.08.2012_14.04.52_log.txt

gravytrader Private E-2

Attached Files:

TDSSKiller.2.8.7.0_23.08.2012_14.09.09_log.txt

Error.bmp

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

gravytrader Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member