Hi, I had to do a reinstall of XP Pro last week, and I have everything running, but I have a real virus problem.
I have a virus that is not allowing me to install antivirus software or if it does, it mucks it up. I use the AVG antivirus and when I manage to get it installed, the virus attacks the PC and puts it into a loop of restarts.
If I go to the pandasoft website and try to do an online scan, it crashes that, same if I try to do it in safe mode.
I can't install AVG in safe mode because it errors out.
The virus that is attacking is Virut.A.
Any ideas on how to kill this?
I was thinking of taking the hard drive to another computer that actively has antivirus software running, and trying to kill it with that, would that work?
Its driving me crazy because I really wish to have an antivirus software that is running, uncorrupted on my machine.
Thanks.
Here is my hijack this logfile
Logfile of HijackThis v1.99.1
Scan saved at 2:02:34 PM, on 9/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
STEP 1.
====== MWAV Scan
Please download MWAV to a convenient location. Disconnect from the Internet before running the scan.
This scan only produces a report, it doesn't clean your system. I will analyze the report and recommend a course of action depending on the results. This scan might take around 3+ hours to finish when set to scan everything.
Note: If you receive a pop-up saying you need to purchase, etc. etc.—just click the x in the upper right-hand corner and close it.
Double-click on mwav.exe.
Put a check next to the below items before scanning:
Memory
Startup Folders
Drive - All Local Drives
Folder - then click "browse" to change the directory to C: (default is C:\Windows)
Registry
System Folders
Services
Include Sub-Directory
Scan All Files
Please make sure ALL of these are checked, then press the Scan button. This typically will take hours to complete.
**NOTE*** Sometimes MWav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.
On the bottom portion of the window, you will see the lower panel where MWav is listing "infected items", please highlight everything in that lower panel and copy them by holding CTRL + C then paste it here. The whole log will be extremely BIG so there is no way to post the log. I just need the infected items list.
STEP 2.
======
Create a new folder on the desktop.
Copy the contents of this next code box to Notepad.
Name the file inspect.bat
Save as Type: All files
Save in that new folder on the desktop.
Double click on inspect.bat and let it run.
When finished it will open a file in Notepad.
That file will be named lsa.txt
Please post the contents of lsa.txt into your next reply here.
Extract it somewhere you will remember like the Desktop
Don’t do anything with it yet!
Reboot.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
Doubleclick WinPFind.exe
Click on Configure Scan Options.
Remove all the checkmarks under Folder Options on the left side by clicking the button Remove All, uncheck Run Addon's and click Apply.
Click Start Scan It will scan the entire System, so please be patient! This scan may take awhile
Once the Scan is Complete
Reboot your computer into normal mode.
Go to the WinPFind folder
Locate WinPFind.txt
Copy the results from the WinPFind.txt file and post the results in your next reply.
Please post (reply) with the results from MWAV, lsa.txt, results of WinPFind.
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.
If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows sometimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.
»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Logfile created on: 9/8/2006 5:52:29 PM
WinPFind v1.5.0 Folder = C:\WinPFind\WinPFind\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 6.0.2900.2180)
»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»
>>> Internet Explorer Bars, Toolbars and Extensions <<<
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
\{182EC0BE-5110-49C8-A062-BEB1D02A220B} - Adobe PDF = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
\{4D5C8C25-D075-11d0-B416-00C04FB90376} - &Tip of the Day = %SystemRoot%\System32\shdocvw.dll (Microsoft Corporation)
I am sorry that it took almost 9 hours for the MWAV scan to complete. But we obtained some vital information. I am trying to keep you off the Net while we clear some things up.
STEP 1.
====== Cleanmgr
To clean temporary files:
Go > start > run and type cleanmgr and click OK
Scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
Click OK to remove those files.
Click Yes to confirm deletion.
Step 2
=====
Using Windows Explorer, locate the following files/folders, and delete them: C:\814.exe<=file Exit Explorer.
Step 3
=====
You have some infected Windows system files. Let's try the following to replace them.
Go to start > Run > copy and paste in: sfc /scannow <=there is a space between the sfc and the /
Click 'OK'
You will need your XP/2000/ME disk. If you don't have it and instead only have a recovery CD, there is a work around. View the following link for a tutorial:
sfc - system file checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.
If you want to see what was replaced, right click My Computer > manage, expand event viewer > system.
I am very interested in what files were replaced. Were the following are replaced?
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
Please post (reply) and let me know what was replaced.
Did everything, however, the My Computer > manage, expand event viewer > system log could not be pulled.
I opened the log but as I scrolled down, it said it was corrupt and I couldn't see it anymore.
I don't know if the files were replaced or not. I do not want you connected to the Net very much. However, I hate for you to spend almost 9 hours to run MWAV again. So I want you to submit the files to Jotti and post (reply) with the results.
STEP 1.
======
Please show all files for your system. You will need to reverse this process when all steps are done.
Submit File to Jotti
Please click on Jotti
Use the "Browse" button and locate the following file on your computer: C:\WINDOWS\system32\spoolsv.exe
Click the "Submit" button.
Please copy and post (reply) with the results
If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html
Please also check the properties of those files (right-click and select properties from the popupmenu). Look if you can find some company information, etc.
Please repeat the above step with the following files. C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
Please reply with all the results. We need to get your Windows files fixed and then work on the others.
Here are the 4 files.
I have been on the net a bit this morning, but no new downloads or installations.
File: spoolsv.exe
Status:
INFECTED/MALWARE
MD5 6eb8aadb8a316f1825cddf7eaba8eb13
Packers detected:
-
Scanner results
AntiVir
Found W32/Virut.A
ArcaVir
Found W32.Virtob.C
Avast
Found Win32:Virut-B
AVG Antivirus
Found Win32/Virut.A
BitDefender
Found Win32.Virtob.C
ClamAV
Found W32.Virut.A
Dr.Web
Found Win32.Virut
F-Prot Antivirus
Found W32/Splendor.4960
Fortinet
Found W32/Virut.A
Kaspersky Anti-Virus
Found Virus.Win32.Virut.a
NOD32
Found Win32/Virut.5127
Norman Virus Control
Found W32/Virut.A
UNA
Found nothing
VirusBuster
Found Win32.Virut.A
VBA32
Found Virus.Win32.Virut.A
File: MsPMSPSv.exe
Status:
INFECTED/MALWARE
MD5 8c6c6fb1e4a9031d60f923da9064ce70
Packers detected:
-
Scanner results
AntiVir
Found W32/Virut.A
ArcaVir
Found W32.Virtob.C
Avast
Found Win32:Virut-B
AVG Antivirus
Found Win32/Virut.A
BitDefender
Found Win32.Virtob.C
ClamAV
Found W32.Virut.A
Dr.Web
Found Win32.Virut
F-Prot Antivirus
Found W32/Splendor.4960
Fortinet
Found W32/Virut.A
Kaspersky Anti-Virus
Found Virus.Win32.Virut.a
NOD32
Found Win32/Virut.5127
Norman Virus Control
Found W32/Virut.A
UNA
Found nothing
VirusBuster
Found Win32.Virut.A
VBA32
Found Virus.Win32.Virut.A
File: wscntfy.exe
Status:
INFECTED/MALWARE
MD5 7ab3a53e49be1e2138bd2bba69b8c0db
Packers detected:
-
Scanner results
AntiVir
Found W32/Virut.A
ArcaVir
Found W32.Virtob.C
Avast
Found Win32:Virut-B
AVG Antivirus
Found Win32/Virut.A
BitDefender
Found Win32.Virtob.C
ClamAV
Found W32.Virut.A
Dr.Web
Found Win32.Virut
F-Prot Antivirus
Found W32/Splendor.4960
Fortinet
Found W32/Virut.A
Kaspersky Anti-Virus
Found Virus.Win32.Virut.a
NOD32
Found Win32/Virut.5127
Norman Virus Control
Found W32/Virut.A
UNA
Found nothing
VirusBuster
Found Win32.Virut.A
VBA32
Found Virus.Win32.Virut.A
iexplore.exe
Status:
INFECTED/MALWARE
MD5 235efdcfb663d03c33665355e47dc411
Packers detected:
-
Scanner results
AntiVir
Found W32/Virut.A
ArcaVir
Found W32.Virtob.C
Avast
Found Win32:Virut-B
AVG Antivirus
Found Win32/Virut.A
BitDefender
Found Win32.Virtob.C
ClamAV
Found W32.Virut.A
Dr.Web
Found Win32.Virut
F-Prot Antivirus
Found W32/Splendor.4960
Fortinet
Found W32/Virut.A
Kaspersky Anti-Virus
Found Virus.Win32.Virut.a
NOD32
Found Win32/Virut.5127
Norman Virus Control
Found W32/Virut.A
UNA
Found nothing
VirusBuster
Found Win32.Virut.A
VBA32
Found Virus.Win32.Virut.A
Sadly, no, this whole thing started when I had to re-install XP.
If I were to get another HD, and install XP on it and antivirus software and make my existing C drive a slave, could I clean it out then and replace the C drive back? And, repeat again with the D drive?
Do you have a C:\Windows\ServicePackFiles\i386 folder? Back-up files would be contained there. If you have the folder then try to rename the files below (system32 folder and Internet Explorer folder) like spoolsv.exe => oldspoolsv.exe.
When you reboot, the files should be replaced from those in the i386 folder. Now if the i396 files are not infected, you may now have clean files. If they are replaced, then submit the files to Jotti like you did previously and let me know the results.
I have the folder, I went and renamed the four files, rebooted, and it did not replace into the Win32 and program files/internet explorer the new files.
Before I did this, I went to the i386 folder and found the files, but not the MsPMSPSv.exe file.
Should I manually move the files over from the I386 folder and submit them?
Thanks
