[Closed] Win32Delf.uc virus and others

Catbyte I have done as requested a couple of times. No virus found. I repeated as after running the scans no output log was available to post. I presume this is because both scans reported that they did not find any viruses? Therefore there are no attachments with this post accept an error message that still appears and a report from Spydoctor programme that appeared after above action carried out. Many thanks.

OK,
Can you please run OTList it now then as requested. Thanks

• Download OTListIt2 to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Catbyte Ran the OTL programme. Only List.txt document produced (attached). No Extras.Txt file produced ??! I have also added error message as screen shot on boot up.

Hi theodoce123

First running two antivirus products can cause conflicts and instability in your system, this could be a cause of various errors.

I suggest you uninstall one of them.

If both products are still active - choose the one with the longest subscription remaining…If you are happy with neither, then uninstall both and I can recommend a free antivirus product for you.

McAfee recommends uninstalling their product through Add/Remove programs first then run the removal tool found
HERE

(remove everything related to McAfee and Network Associates in Add/Remove programs)

Similar uninstall for Norton - Norton Removal tool can be found HERE

The alerts you are receiving from Spyware Doctor - does it state which files are infected (difficult for me to read).

If so please copy and paste which files are being flagged as infected.

NEXT

(I know you have run this previously but delete your old copy - download a fresh copy - make sure you update it and allow a full scan - paste the log in your next reply)

Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


NEXT

Download the latest version of Trendmicro's Hijackthis to your desktop.

• Drag your old copy of HJT to the trash then
• Double click the freshly downloaded program to install it
• Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe

• Open HJT Scan and Save a Log File, it will open in Notepad
• Go to Format and make sure Wordwrap is Unchecked
• Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread

In your next response I need

• Antivirus situation - were you successful in removing one
• MBAM log
• Fresh HJT log

CatByte Having a few problems here. First I uninstalled McAfee as suggested and I am only running with Norton now. I tried running the Malwarebytes' Anti-Malware programme. I have never got this to the end yet. Either my computer freezes then shuts down, or I get a Microsoft error message which I have attached. Based on this, I have downloaded all the updates and installed. I have tried re-running Malwarebytes' Anti-Malware programme after fresh download but get same problem and microsoft error message. I will keep trying to run Malwarebytes' Anti-Malware and post if successful.

OK, Let me consult with the expert working with me on this before you do anything else……I will try and get back to you as soon as possible….

Hi,

thedoce123.

Is the BSOD only in relation to MBAM? or does it occur with other applications…

are you able to run OTListIt?

If you are - please post a new OTListIt log

• Download OTListIt2 to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

CatByte BSOD appears after bootup before I have opened any applications not in startup. Same error message each time. I could not download LTList2 from link!?? Message 404 Not Found. The resource requested could not be found on this server! Powered By LiteSpeed Web Server LiteSpeed Technologies is not responsible for administration and contents of this web site! I eventually found a download that worked from another post on WhattheTech. I will run this now and post. In case things shut down again, I thought I would also inform you that Norton has removed the following: W32.Virtu.CF detected by autoprotect (Norton) and removed 13/02/09 at 22:18. This is after your previous advice. Thanks again

CatByte No problem running OLTList2. Here is the log.. Scan complete with no action required. I only have a OLTLIstIt to post.

Norton has removed the following: W32.Virtu.CF

Bad news, I am afraid you have the Virut file infector.

Virut is a polymorphic file infector with some additional features. It spreads all around the drive and infects even files infected by another virus previously. The only symptoms are a strange HDD activity while infecting, and also unwanted TCP traffic. Virut tries to connect you into an IRC network under the user name "Virtu" and zombify you. Unfortunately, the cleaning of this virus is very difficult or almost impossible.

As you saw from the results of the Dr.Web program, Dr Web can cure some of the files but it cannot guarantee to have cured them all. As your entire operating system files may be infected and probably Dr Web is now infected.

I would at this stage recommend a full reformat and install. We have a tutorial here

Things to bear in mind if you go this route, only back up data files (word, excell etc.) DO NOT back up screensavers, program executables ( .Exe files) as they will be infected.

We have tried all the tools on your machine that are the best tools to clear this infection but still it remains and will likely continue to infect more and more files if you do not reformat.

Read more about the VIRUT FILE INFECTOR HERE


This is the safest recommendation from all the experts at this point.

I am very sorry we could not rid your system of this infection.

Hi thedoce123

Can you please advise that you have read the instructions above.

If you need assistance in reformatting your machine a tutorial can be found >>HERE<<

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log