Cannot remove W32.Serflog.A

I'm having trouble removing this virus. Is anybody familiar with it, or know how to remove it?

I found an old CD in a box of stuff and popped it into the drive to see what was on it, and my Norton's immediately started popping up messages that it had detected and removed a virus. It keeps cycling through the following 3 files over and over again:

C:\WINDOWS\msmbw.exe
C:\WINDOWS\system32\formatsys.exe
C:\WINDOWS\system32\serbw.exe

The virus detected is always "W32.Serflog.A", and under "action taken" it always says that the file was automatically deleted.

Symantec has removal instructions.. but unfortunately, because of the nature of the virus, it stops me from actually DOING any of those removal instructions. It stops me from going to any virus websites, it shuts down most programs I start up (virus scan, command prompt, registry, etc). It won''t let me download the removal tool. It has done something to my security settings so I can't disable system restore, etc.

I'm at a loss here. Normally I can remove a virus by myself, but this one is preventing me from accessing everything I need to remove it. Is it safe to boot up in safe mode, since Norton's says that it deleted the file(s)? Or would I be seriously screwing myself by doing that? (keeping in mind that I am not able to disable system restore).

Help!

Todd

 

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
  • runkeys.txt - the log from GetRunKey.bat
  • newfiles.txt - the log from ShowNew.bat[/B]
  • CounterSpy - ONLY IF you were not able to run Windows Defender
  • Bitdefender - from step 6
  • Panda Scan - from step 6
  • HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!


You have mentioned that you are having problems downloading.... If you have issues downloading the tools we need you to use can you try downloading them on a seperate computer and using a USB flash drive or cd to transfer them.

A lot of these steps need to be run from safe mode anyway.

 

Unfortunately, the virus prevented me from downloading any of the tools referenced in the tutorial. One of the many things the virus does is to immediately close most programs/windows (like command prompt, the run/save window when you download files, task manager, etc).

I managed to get around this by downloading the fix (from Symantec) on my laptop, burning it to a CD, and then running it from the CD on the infected computer.

Thanks for the help!

Todd

 

Are you saying you are having no more problems ?

I'd still suggest running some of the scans mentioned above. Where there is one virus there are often more.

 

Yes, it appears that I am having no more problems. And you are right, there are possibly more viruses lurking that I haven't found yet. I will run the rest of the scans when I return home and have access to the infected PC again (I am working on my laptop from a hotel room).

Thanks for the help!

Todd

 

OK

Just post scan logs when you return