What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please help remove this virus

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm running AVG Free 8.5 and it recently detected a virus on my computer for which I moved all infected files to the Virus Vault. However my computer isn't working as normal anymore, it's very sluggish and whenever I go to start Windows I'm greeted with a Data Execution Prevention message saying:

To help protect your computer, Windows has closed this program.
Name: Userinit Logon Application
Publisher: Microsoft Corporation

I consider myself to be good with computers, but when it comes to viruses I'm a bit of a novice so any advise you can give me to help fix my computer will be greatly appreciated :)

If it helps these are the details from the Virus Vault:

Virus identified Worm/Generic_r.GO
C:\\WINDOWS\ld12.exe

Trojan horse Downloader.Generic8.BACN
C:\\WINDOWS\system32\grffr83hn.dll

Trojan horse Startpage.EJY
C:\\WINDOWS\Temp\ewcs73nf.exe

Virus found Win32/Virut
C:\\Program Files\Samsung PC Studio 3\util\SetReadD500.exe
C:\\WINDOWS\system32\SoftwareDistribution\dd9ab5193501484cf5e6884fa1d22f9e\netsetup.exe
C:\\WINDOWS\system32\SoftwareDistribution\dd9ab5193501484cf5e6884fa1d22f9e\notepad.exe
C:\\WINDOWS\system32\dllcache\sstext3d.scr
C:\\WINDOWS\system32\dllcache\tlntsess.exe

Thanks in advance, Dan
Post #2
Hi there,

Welcome to WTT.

Well it doesn't look promising, AVG has reported Virut, and that requires a reformat and reinstall to clean. But before we do that, lets make a couple of double checks.

I would like you to upload a file to be scanned
  • Please go to VirSCAN.org
  • Copy and paste the following file path into the "Suspicious files to scan"box on the top of the page:

    • C:\Windows\explorer.exe
  • Click on the Upload button
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Open Notepad and paste the contents into a new Notepad file using Ctrl and V at the same time.
  • Save the notepad file to your desktop as VirScan.txt and copy the contents into your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
  • Double-click on cureit.exe to start the program.
  • Click Start
  • Click OK to the RAM scan
  • When the RAM Scan has completed, choose the Complete scan
  • Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
  • Agree to any prompts to Move files
  • Click the Select all button at the bottom
  • Click the Cure button, and Delete incurable in the pop out menu
  • Allow it to cure or delete all files, then click on the File menu, then Save report list
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
Post #3
Hey thankyou for posting such a easy to follow guide in your response.

Here is the contents from my VirScan.txt file:

VirSCAN.org Scanned Report :
Scanned time : 2009/07/16 22:31:05 (BST)
Scanner results: 66% Scanner(25/38) found malware!
File Name : explorer.exe
File Size : 1053184 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : 41ace819e2bf91b06736daed914aef40
SHA1 : 2d86a838d46c5bf25b6bbfc820c2e6e8cf339436
Online report : http://virscan.org/report/e6853ff9b47e4cce…f2c77dc2ca.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090716213250 2009-07-16 0.40 Trojan.Win32.Patched!IK
AhnLab V3 2009.07.16.05 2009.07.16 2009-07-16 0.73 Win32/Virut.F
AntiVir 8.2.0.220 7.1.4.246 2009-07-16 0.41 W32/Virut.Gen
Antiy 2.0.18 20090716.2619098 2009-07-16 0.02 -
Arcavir 2009 200907161747 2009-07-16 0.05 -
Authentium 5.1.1 200907161850 2009-07-16 1.18 W32/Virut.AI!Generic (Heuristic)
AVAST! 4.7.4 090716-1 2009-07-16 0.05 Win32:Vitro
AVG 8.5.288 270.13.17/2242 2009-07-17 0.45 Win32/Virut
BitDefender 7.81008.3733604 7.26632 2009-07-17 3.28 Win32.Virtob.Gen.12
CA (VET) 9.0.0.143 31.6.6616 2009-07-15 7.05 Win32/Virut.17408 virus.
ClamAV 0.95.2 9574 2009-07-17 0.16 -
Comodo 3.10 1674 2009-07-16 0.99 -
CP Secure 1.1.0.715 2009.07.16 2009-07-16 11.14 -
Dr.Web 4.44.0.9170 2009.07.16 2009-07-16 4.88 Win32.Virut.56
F-Prot 4.4.4.56 20090715 2009-07-15 1.24 Possible W32/Virut.AI!Generic
F-Secure 5.51.6100 2009.07.16.12 2009-07-16 6.09 Virus.Win32.Virut.ce [AVP]
Fortinet 2.81-3.120 10.613 2009-07-16 0.25 -
GData 19.6500/19.399 20090716 2009-07-16 4.39 Virus.Win32.Virut.ce [Engine:A]
ViRobot 20090716 2009.07.16 2009-07-16 0.42 -
Ikarus T3.1.01.64 2009.07.16.73048 2009-07-16 3.25 Trojan.Win32.Patched
JiangMin 11.0.800 2009.07.16 2009-07-16 3.49 -
Kaspersky 5.5.10 2009.07.16 2009-07-16 0.05 Virus.Win32.Virut.ce
KingSoft 2009.2.5.15 2009.7.16.15 2009-07-16 0.51 Win32.Virut.ce.53248
McAfee 5.3.00 5678 2009-07-16 2.91 W32/Virut.n.gen
Microsoft 1.4803 2009.07.16 2009-07-16 5.16 Virus:Win32/Virut.BM
mks_vir 2.01 2009.07.15 2009-07-15 3.24 -
Norman 6.01.09 6.01.00 2009-07-09 4.01 -
Panda 9.05.01 2009.07.16 2009-07-16 2.86 Suspicious file
Trend Micro 8.700-1004 6.281.00 2009-07-16 0.04 PE_VIRUX.J
Quick Heal 10.00 2009.07.16 2009-07-16 1.30 W32.Virut.G
Rising 20.0 21.38.34.00 2009-07-16 1.07 Win32.Virut.bm
Sophos 2.88.0 4.43 2009-07-17 2.85 W32/Scribble-B
Sunbelt 5258 5258 2009-07-16 0.95 Virus.Win32.Virut.ce (v)
Symantec 1.3.0.24 20090715.016 2009-07-15 0.06 W32.Virut.CF
nProtect 20090716.01 4760023 2009-07-16 6.54 -
The Hacker 6.3.4.3 v00368 2009-07-15 0.69 -
VBA32 3.12.10.8 20090716.1142 2009-07-16 1.75 Virus.Win32.Virut.X6
VirusBuster 4.5.11.10 10.108.9/1837986 2009-07-16 2.84 -

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

And here is the results from my DrWeb.csv file:

autorun.inf;e:;Probably Win32.HLLW.Autoruner.corrupted;Moved.;
reader_s.exe;c:\documents and settings\administrator;Trojan.DownLoad.29459;Deleted.;
bbc iplayer desktop.exe;c:\program files\bbc iplayer desktop;Win32.Virut.56;Cured.;
versioncuecs3tray.exe;c:\program files\common files\adobe\adobe version cue cs3\server\bin;Win32.Virut.56;Cured.;
adobe gamma loader.exe;c:\program files\common files\adobe\calibration;Win32.Virut.56;Cured.;
fnplicensingservice.exe;c:\program files\common files\macrovision shared\flexnet publisher;Win32.Virut.56;Cured.;
msmsgs.exe;c:\program files\messenger;Win32.Virut.56;Cured.;
orbitdm.exe;c:\program files\orbit downloader;Win32.Virut.56;Cured.;
setup50.exe;c:\program files\outlook express;Win32.Virut.56;Cured.;
qttask.exe;c:\program files\quicktime;Win32.Virut.56;Cured.;
wlsetupsvc.exe;c:\program files\windows live\installer;Win32.Virut.56;Cured.;
wmpnetwk.exe;c:\program files\windows media player;Win32.Virut.56;Cured.;
alcmtr.exe;c:\windows;Win32.Virut.56;Cured.;
explorer.exe;c:\windows;Win32.Virut.56;Cured.;
unregmp2.exe;c:\windows\inf;Win32.Virut.56;Cured.;
rthdcpl.exe;c:\windows;Win32.Virut.56;Cured.;
skytel.exe;c:\windows;Win32.Virut.56;Cured.;
alg.exe;c:\windows\system32;Win32.Virut.56;Cured.;
cisvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
clipsrv.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ctfmon.exe;c:\windows\system32;Win32.Virut.56;Cured.;
dllhost.exe;c:\windows\system32;Win32.Virut.56;Cured.;
dmadmin.exe;c:\windows\system32;Win32.Virut.56;Cured.;
dumprep.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ie4uinit.exe;c:\windows\system32;Win32.Virut.56;Cured.;
imapi.exe;c:\windows\system32;Win32.Virut.56;Cured.;
locator.exe;c:\windows\system32;Win32.Virut.56;Cured.;
logon.scr;c:\windows\system32;Win32.Virut.56;Cured.;
logonui.exe;c:\windows\system32;Win32.Virut.56;Cured.;
mnmsrvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
msdtc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
msiexec.exe;c:\windows\system32;Win32.Virut.56;Cured.;
netdde.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ntsd.exe;c:\windows\system32;Win32.Virut.56;Cured.;
nvsvc32.exe;c:\windows\system32;Win32.Virut.56;Cured.;
reader_s.exe;c:\windows\system32;Win32.Virut.56;Cured.;
reader_s.exe;c:\windows\system32;Trojan.DownLoad.29459;Deleted.;
regsvr32.exe;c:\windows\system32;Win32.Virut.56;Cured.;
rsvp.exe;c:\windows\system32;Win32.Virut.56;Cured.;
rundll32.exe;c:\windows\system32;Win32.Virut.56;Cured.;
scardsvr.exe;c:\windows\system32;Win32.Virut.56;Cured.;
sessmgr.exe;c:\windows\system32;Win32.Virut.56;Cured.;
shmgrate.exe;c:\windows\system32;Win32.Virut.56;Cured.;
smlogsvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
spoolsv.exe;c:\windows\system32;Win32.Virut.56;Cured.;
tlntsvr.exe;c:\windows\system32;Win32.Virut.56;Cured.;
ups.exe;c:\windows\system32;Win32.Virut.56;Cured.;
userinit.exe;c:\windows\system32;Win32.Virut.56;Cured.;
vssvc.exe;c:\windows\system32;Win32.Virut.56;Cured.;
winmgmt.exe;c:\windows\system32\wbem;Win32.Virut.56;Cured.;
wmiapsrv.exe;c:\windows\system32\wbem;Win32.Virut.56;Cured.;
wmiprvse.exe;c:\windows\system32\wbem;Win32.Virut.56;Cured.;
Post #4
Well, I'm afraid I have bad news for you.

You have been infected with a polymorphic file infector named Virut. This infection will spread to every executable file in your computer, and unfortunately the only cure for it is to Reformat and Reinstall.

Right now, the best thing you can do is to backup, preferably to CD, all your important data, documents, pictures, movies, and songs.

DO NOT backup any applications or installers and DO NOT backup any files with the following extensions:
  • .exe
  • .scr
  • .htm
  • .html
  • .xml
  • .zip
  • .rar
For more information on Virut, and why you need to reformat, have a read of miekiemoes blog here.

To find out how to carry out an XP Reformat and Reinstall, please see this page. If you are using Vista, then check this page instead.

Once you have reformatted and reinstalled Windows, have a look at this page for some useful tips on staying clean, along with links to some freeware to help.

To find out more information about how you may have got infected in the first place, you can read this article.

I am sorry I cannot give any better news.

Regards,
RatHat
Post #5
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI