Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus Killing My Hd Help ;(


  • Please log in to reply
10 replies to this topic

#1 nap101

nap101

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 28 February 2008 - 08:49 PM

hello all need some help i think this virus is destroying my hard drive im not sure if it was me or my sister that got this virus but it's not showing up on my nod32 or my super antispyware ok i was doing a usall scan on my pc nod32 did not show anything ran the super antispyware and at almost at the end of the the antispyware running a little box pops up on my system tray states
corrupt file
the file or directory c windows\system32\mib.bin is corrupt and unreadable please run chkdsk utility

so i went ahead and ran a chkdsk thinking it was normal maybe a bad sector that needs to be fixed WRONG the chkdsk started to delete files that looks important

under file verfication
deleting orpahn file record segment 3469


under verefiying index
deleting index entry acterror.htm in index $I30 of file 3462

this happen twice the second time my sister did not write down what was deleted i was not home at the moment so she just let the chkdsk run what she told me that it deleted two more similar files just that the numbers were diffrent.

i can not do a system restore and my fire wall is disabled seems like a nasty one i never had a virus with this strength
do so much damage im hoping i don't need to go buy a new hard drive im still paying for college bills.

i don't want my only computer destroyed please anyone help.

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,853 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:29 AM

Posted 29 February 2008 - 01:46 AM

Hello nap101 and welcome to BC :flowers:

Chkdsk did what it's supposed to.

deleting orphan file record segment 3469 <-- This is the equivalent of going through the file cabinet and noting a file folder with a partial label on it and no documents in the folder. It is an orphan record segment. I toss it out.

deleting index entry acterror.htm in index $I30 of file 3462 <-- This is the equivalent of going through an index and finding, let's say, an extra entry for gorillas listed with the zebras and zygotes. It is misfiled in the index. I eliminate the entry. Gorillas is properly located in the part with the geckos and the giraffes.

So, don't worry about what Chkdsk did.

the file or directory c windows\system32\mib.bin


Hmm. Did you copy the file path correctly?

What is your operating system: Windows XP, Vista etc.?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 nap101

nap101
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 29 February 2008 - 02:07 AM

i am using win xp home edition and thanks for warm welcome

Edited by nap101, 29 February 2008 - 02:07 AM.


#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,853 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:29 AM

Posted 29 February 2008 - 02:11 AM

Hello nap101,

Have you double-checked the file path for mib.bin? My research indicates that this file should have a different file path than the one you have posted here.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#5 nap101

nap101
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 29 February 2008 - 02:19 AM

yes that what had said when i ran super antispyware that when it said to run a chkdsk so i did and it started deleting the files during the scan

Edited by nap101, 29 February 2008 - 02:20 AM.


#6 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,853 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:29 AM

Posted 29 February 2008 - 02:21 AM

Can you post the SAS log please?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#7 nap101

nap101
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 29 February 2008 - 02:21 AM

ok i will do

#8 nap101

nap101
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 29 February 2008 - 02:32 AM

This is the one i did yesterday, if you would like me to run it again i will do.
and for some reason when i turn my pc on even before going to a website i get the same tracking cookies.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/28/2008 at 03:51 PM

Application Version : 3.9.1008

Core Rules Database Version : 3411
Trace Rules Database Version: 1403

Scan type : Complete Scan
Total Scan Time : 01:48:05

Memory items scanned : 346
Memory threats detected : 0
Registry items scanned : 5195
Registry threats detected : 0
File items scanned : 59147
File threats detected : 6

Adware.Tracking Cookie
C:\Documents and Settings\killer\Cookies\killer@ad.us-ec.adtechus[1].txt
C:\Documents and Settings\killer\Cookies\killer@doubleclick[1].txt
C:\Documents and Settings\killer\Cookies\killer@tacoda[2].txt
C:\Documents and Settings\killer\Cookies\killer@ar.atwola[1].txt
C:\Documents and Settings\killer\Cookies\killer@2o7[1].txt
C:\Documents and Settings\killer\Cookies\killer@atwola[2].txt

#9 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,853 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:29 AM

Posted 29 February 2008 - 12:18 PM

Hello nap101,

Cookies are txt files that do not actively do anything. Whenever you browse the web, you will get cookies unless you have set up your system to block them. I have my system ask me every time before setting a cookie, and I also have third party cookies blocked. To prevent the cookies in your log from reappearing, in IE Navigate to Internet Options --> Privacy. Click on the Advanced button and put a check by Override Automatic Cookie Handling. Then under Third Party Cookies, put a check by Block. Under First party cookies, you may choose to have it Prompt you (that's what I do) or accept. If you choose Prompt, when you navigate and the site wants to install a cookie, you may choose to block or allow it. (You will need to click on More Info. every time in order to see the details about the cookie so you can make an informed decision). This will put that site on a black or white list. You may put a check by "Always allow session cookies." (I personally don't do this). The latter will remove themselves once you close the browser.

In Firefox, navigate to Tools --> Privacy. Under Cookies, put a check by Accept Cookies from sites, then in the little window underneath, make sure it says "Ask me every time." When navigating you will get a window with similar options that you get in IE. In FF, once you choose More Info, the window will almost always pop-up that way after. You get three choices. Deny, Accept as Session, or Accept. You also get an additional option above those choices. If you put a check by "remember this decision" (or something like that) the cookie will be added to the black or white list. If you leave the box unchecked, you will receive the prompt again.

You can also install SpywareBlaster which adds many tracking cookies to the blocked zone so you don't get so many prompts. You should update it once a week and make sure that all protection is enabled.

[*]Spywareblaster - prevents spyware from being installed on your PC. - Tutorial: Using SpywareBlaster


Note, this quote is from a topic that is updated on a regular basis.
----------------
As for the mib.bin error, since running SAS produced the message in the first place, please run SAS again to see if the error appears again now that you have run Chkdsk. Let us know if it does or not.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#10 nap101

nap101
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:29 AM

Posted 29 February 2008 - 10:20 PM

hey thanks for the info i did the procedures you have stated to do on my ie and firefox, what aout the system restore not working? and my firewall not staying on everytime i restart windows firewall is off i have to manually turn it back on and there is times that it does not want to turn on i get a error "windows firewall setting cannot be displayed because the associated service is not running. do you want to start the windows firewall/internet connection sharing (ics) service?"

When i click yes, i get this messege:
"windows cannot start the firewall/internet connection sharing (ics) service."

#11 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,853 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:29 AM

Posted 01 March 2008 - 12:30 AM

Hello nap101,

Let's try this to see if this resolves some of these issues.

Click on Start --> Run. In the run box, type sfc /scannow Make sure there is a space between the c and the /. The computer will then check a number of system files and if any are missing or corrupt it will try to fix or replace them. If you do not have the i386 folder, the computer may ask you for your XP disk so be sure to have it at hand just in case. It will post any errors, corrections, or replacements in the System Events log.

Let us know how it turns out and if this resolved any of the problems you are having.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users