w32.stration removal problem

New member, first post… I have a PC that's been acting crazy for the last few days. The HD would just keep reading/writing constantly, and wouldn't let me do anything (even ctrl+alt+del to get to task manager). I finally used my brain and started the machine in safe mode. I run AVG and Win Defender, which both came up with nothing. I then ran Symantec's online scanner and it found w32.stration.D@mm. After searching Google for a while, I found your site (thank the heavens) and found a thread about removing it using HJT and Avenger. Here's where my problem begins. When I boot the PC in safe mode and try to run the fix, nothing comes up. I assume safe mode is simply preventing the virus from even starting, so none of the items listed in the thread for HJT even show up. Also, the files listed to remove using Avenger also don't exist, even when I show all hidden and system files. So, I try to start the PC in regular mode, and when I try to open or run ANYTHING, my desktop/taskbar/etc. all disappear, only showing my wallpaper. The hard drive is still steadily reading/writing whatever it's thinking about all this time, but I can't do anything. And, as I said above, ctrl+alt+del won't even bring up task manager. So, any suggestions? I'm at my wits' end here.

Hello CajunGuy,

Welcome to the Tom Coyote Forums

Very first thing. Leave Avenger alone! Delete it for now……it's very powerful, and a last resort tool only.

The tool I'd like to run can only be run in normal mode, so we'll have to clean as much as we can and see if we can accomplish a normal mode restart.

* Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found: [external image: Posted Image]
• If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  [external image: Posted Image]
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously, along with a new HijackThis log in your next reply.

Thanks,
tea

Thanks for the reply, teacup. Unfortunately (well, maybe not for me) I actually fixed it! After much brain bashing, I decided to start it again in Safe Mode, disabled system restore, and try using Panda's online scanner, since AVG and even Norton's scanners didn't want to work. It found the virus and more or less wiped MOST of it off. This allowed me to reboot in normal mode without it tying up the system. I was then able to run AVG (after updating it) and it found what was left of the virus. After wiping it out, I then went searching for all the files the other post I read said might be left behind. None were found. So, long story short, I ran every scanner I could get my hands on, including spyware scanners, and came up clean. The system seems to be running, well, better than it was even before the virus. I'm sorry for taking up your time. I figured after the post got to the 5th page it probably wouldn't get answered. Next time I'll know to post if I fix it on my own. Thanks a ton anyway!

Hello, No need to be sorry! I thank you very much for letting me know anyway. If anything comes up in the future, you should know that most of us look for the ones who have been waiting the longest first. There is just such a massive amount of this garbage that there aren't enough of us to get to them all right away. <_< Thanks again, and take care! Tea