Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

infected with w.exe (and more)


  • Please log in to reply
5 replies to this topic

#1 SamArmstrong

SamArmstrong

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 12 April 2010 - 06:00 AM

I have a virus and i am going round in circles trying to remove it. I have malwarebytes running active on my system. It detects the virus, says it needs to reboot after scans, then the virus pops up again.

It appears that the virus is able to infect malwarebytes, as malware bytes says my system is clean now, but if i uninstall and reinstall malwarebytes then malwarebytes again finds the problems.

Also, i cannot access any microsoft sites.

i have attached dds.scr logs. I am (sometimes) able to run GMER (normally just reboots when i try), but my system will not let me save the logs (it freezes).

please please, i need some help with this one.

*UPDATE* GMER LOG NOW ATTACHED

Attached Files


Edited by SamArmstrong, 12 April 2010 - 07:25 AM.


BC AdBot (Login to Remove)

 


#2 SamArmstrong

SamArmstrong
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 14 April 2010 - 04:27 AM

OK, I appear to have removed the virus.

Apparently it was the Virut virus, Trojan Remover sucessfully identified it and "rmvirut" by grisoft sudessfully removed it. Malwarebytes was uninstalled and reinstalled and removed the remaining items.



#3 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:12:35 AM

Posted 16 April 2010 - 10:32 AM

Hello SamArmstrong,



Sorry about the delay.sad.gif

If you truly have Virut, then you could not have removed it.

Virut is a file infecting virus which is able to modify itself each and every time it runs. In addition, when it infects, sometimes it will destroy the file it tries to latch onto.
For these reasons, you really can't truly fix Virut. You will need to format/reinstall the operating system on this machine.

More information:
http://free.avg.com/66558
QUOTE(AVG Technologies)
There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus.


http://home.mcafee.com/VirusInfo/VirusProf...aspx?key=143034
QUOTE(Network Associates)
W32/Virut.h is a polymorphic, entry point obscuring (EPO) file infector with IRC bot functionality. It can accept commands to download other malware on the compromised machine.
It appends to the end of the last section of executable (PE) files an encrypted copy of its code. The decryptor is polymorphic and can be located either:
Immediately before the encrypted code at the end of the last section
At the end of the code section of the infected host in 'slack-space' (assuming there is any)
At the original entry point of the host (overwriting the original host code)


Miekiemoes, one of our team members here and an MS-MVP, additionally has a blog post about Virut.

If you would like for me to look to be sure, then please let me know. smile.gif

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#4 SamArmstrong

SamArmstrong
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:35 AM

Posted 16 April 2010 - 11:56 AM

Hi tea, thankyou for your help.

I have 3 pc's that have gone down, although seeming with different virus's. Is it worth me posting new logs for this pc?

regards Sam

(arrgghhh, you closed my other thread which if for a different virus on my partners pc)

Edited by SamArmstrong, 16 April 2010 - 11:59 AM.


#5 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:12:35 AM

Posted 16 April 2010 - 12:01 PM

Hi there,

Well, I would really like to be sure before we just write this one off to Virut. I'd like to see a couple of things and check them out, please. I'd like to see a report from MBAM, and if something else was reporting the Virut I'd like to see a report from it too. smile.gif How is it running? Are you having problems with any files or programs?

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#6 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:12:35 AM

Posted 16 April 2010 - 12:03 PM

Yes I did close it. WAY too confusing for us Helpers, and it can get confusing if you have 2 different Helpers and you're following 2 sets of instructions for them.
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users