A31480 Virus

emills83 · Jan 19, 2009

I work for an oil company and have a pretty good knowledge of computers. One of our employees has somehow infected all 16 of our laptops with a nasty virus that seems to spread to everything including external harddrives and jump drives and reformatting does not get rid of it. So it is spreading like wild fire! It executes a file named A31480.exe which proceeds to installing several other vundo viruses. I can remove the viruses using the steps listed in these forums; however, it does not completely get rid of the virus. After several reformats of harddrives, the virus returns almost immediately. The only way I have found to completely get rid of the virus is to use Dariks Boot and Nuke program. Is this virus infecting the boot sectors of the drives or what? Also, is there an easier way to repair this issue other than using Dariks Boot and Nuke? I have tried everything...Getting desperate and tired of this viscious cycle of cleaning and reinfecting. All the computers use Windows XP Professional w/ SP3. It has also infected my personal laptop which I am running Windows Vista Ultimate 64-Bit.

TimW · Jan 20, 2009

Welcome to Major Geeks!

I suggest that you download the scans to one computer and burn to disc. Then physically disconnect each computer from the network ( plug the cable ).

Next, copy the downloads to each of the computers and run them as instructed, with the other infected media plugged in ( jump and external drives - > include them in the scan runs). You should then have a series of logs for us to check. With 16 puters, you need to start a new thread for each and make sure you inform us of which is which.

Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.

TDSSserv Non-Plug & Play Driver Disable

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

[*]Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

To avoid addtional delay in getting a response, it is strongly advise that after completing the READ & RUN ME you also read this sticky Don't Bump! It Only Hurts You!!!. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

Log in or Sign up

A31480 Virus

emills83 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member