Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Abuse!


  • This topic is locked This topic is locked
5 replies to this topic

#1 Guest_VirusesAteMyMom_*

Guest_VirusesAteMyMom_*

  • Guests
  • OFFLINE
  •  

Posted 01 November 2004 - 11:45 AM

Hey whats up

Im a college student with decent computer skills and a knack for taking on problems which end up to be harder then expected

I help out other people around campus with their virus problems for free... the big problem is i hit one i cant kill and since its not my computer its not like its readily accessable to get 2nd opinions (i need to build a like 1.5 ghz loaner system for ppl to use while i fix their pc)

anyway **since i talk alot at this time it may be helpful to just go down and look at my questions and decide if u want to reread**

This girl had like virus times 8 billion on her pc.. so i was like... ok get what you need off of it and burn it to cd etc etc etc... so i was all ready to kill this hard drive and go clean slate... she didnt have her disk for xp home so i was forced to use my own copy of xp pro... (ok ive done it now, microsoft will be knockin on my door)... i figure the girl already bought it she doesnt know the diff between pro and home - its legal, right? yeah yeah yeah

so i format the hard drive... it was an hp 2.4ghz with 40gb hd .they had originally partioned it to have D: for windows and C: for BS... but i decided id just do away with the partion, cuz who partions drives nowadays...

I boot it up for the first time after having Xp installed and it asks me if i want to run xp home or pro.. and im like... uhh.. wtf... how do u know anything about home...

so after all that good stuff i was like ok its gonna work! minor setback.. yay! happy happy joyjoy whats that popup... AAGHHH

Currently her pc is acting like its getting the defibulator every 3 seconds... her cpu is jumping from like 4% used -->90% used, dropping, and then repeating...

it has the a virus that hijacks IE and sends you to like 2 porno sites somethin like perkynipz.com and absolutely free something blah blah blah u get it....

Mistakes i made while formatting:
1) I didnt unplug the network cable... a major DOH! on that one
2) I didnt reboot and test everything before taking her picture files and word files n replacing them into my documents, but i DID install mcaffee and spybot S&D

Questions:
How did the virus come back.. did it write itself into the cd with 'my documents' stuff that she had? why is it recognizing that 2 versions of XP are available when one should be formatted?

If i take her pc and post hijack this logs will some1 help me

I think id feel bad about deleting her hard drive 'for free' and not cleaning the virus


If u read all of that, you must actually care... yay.. lol

Please help,
VirusesAteMyMom

BC AdBot (Login to Remove)

 


#2 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US

Posted 01 November 2004 - 12:50 PM

Sounds like a re-re-install is in order. I will assume she has a valid COA for Windows XP home. In that case, locate any valid Window XP Home installation disk (she will not be able to active the XP Pro - it will be dead in 30 days) and do a CLEAN install of XP using that disk. You can change the COA number to her valid number (hopefully that number is shown somewhere on the machine) using the procedure here. A followup activation will most likely be required.

As for the reinfection. MTTI (mean time to infection) using an unpatcher copy if Windows with no firewall is 20 minutes. I've seen system infected from the net in less than 30 seconds. You MUST be sure a firewall is active before getting anywhere near the net after a clean install of Windows. Then head directly to the Windows Update site and install All critical updates.
Derfram
~~~~~~

#3 Guest_VirusesAteMyMom_*

Guest_VirusesAteMyMom_*

  • Guests
  • OFFLINE
  •  

Posted 02 November 2004 - 03:50 PM

ive reformatted using xp pro because at this point there is no hope of finding her home cd... I have the computer right now after trusting her with my custom built pc...eeek... lol i have it running xp pro with sp2 and i have mcaffee goin n catchin viruses... only problem is i was forced to delete "windnsd.exe" in the system32 folder as it was claimed by viruses that i couldnt clean even in safe mode... how do i get another copy of this file to slap in there? i cant seem to find it to download it and i didnt see it on the xp cd.

other then that the only thing i have left to fix is like... an audio driver... so im in the clear as long as i can replace that file....

thanks

#4 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:12:16 PM

Posted 02 November 2004 - 04:12 PM

I don't think you want to reinstall a copy of Windnsd.exe. See WORM_WOOTBOT.AS

Doesn't really matter though, as that installation of WindowsXP Pro will ask to be activated in 30 days. And since it is installed and activated on a different machine, you will not be able to do so. It will cease to function.

As I said previously, it IS possible to use a different copy of WindowsXP home, and then change the COA number - and do it legally. Otherwise purchasing a new copy of Windows will be necessary.
Derfram
~~~~~~

#5 Guest_VirusesAteMyMom_*

Guest_VirusesAteMyMom_*

  • Guests
  • OFFLINE
  •  

Posted 02 November 2004 - 05:43 PM

alrighty then.. i do have the cdkey as it was pasted on the side of the computer... But i guess i gotta find some1 with an xp home cd... anyways, after all of that, hp pavilion is worthless.. They do NOT provide drivers for the HP pavilion a200n... where am i supposed to find drivers to reinstall audio & video drivers???

#6 Guest_VirusesAteMyMom_*

Guest_VirusesAteMyMom_*

  • Guests
  • OFFLINE
  •  

Posted 03 November 2004 - 12:47 PM

nevermind, im awesome :thumbsup: lol trial and error and a bit of luck and i found out that the a200n and prolly other hp pavilion pcs use RealTek AC'97 Audio drivers... (im hoping some1 will be like searching for the stupid drivers and come up with this forum post and be like sweeeeet)

anyway all is well and good once i find a cd for windows home...

thanks 4 da help




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users