[IngeniousHax]

my g/f's friend downloaded something, and she seems to have caught a mutating virus... I mean this thing is replicating faster than the black plague...

So far, all I know is the symptoms consist of this:
Computer is stuck in Admin mode probably for accessing otherwise unacessable files...
Explorer.exe is no longer working or mssing. Say's the application not found.
All system files seem to be infected
no default programs are working
if something is loaded, it is immediately infected and rendered useless
when CMD is started, it's started in Admin mode, not current user.

Computer does have McAfee however, it quarantines something, but the something is attached to a system file and therefore renders it useless...

Anyone have any ideas before I back up needed files and redo the entire system?

This post has been edited by IngeniousHax: 23 October 2009 - 11:27 AM

[RudiVisser]

McAfee is never anything but useless.

I'd suggest first running the best anti-virus (@KYA (hello!) this is not my personal opinion, it's based on several comparitives), which is G-Data TotalCare 2010. I've linked directly to the trial.. Providing you can install that, see if it runs and finds anything (It's my understanding that it runs in Safe Mode, so you could additionally try that if it fails).

Other than that, a full reformat would be the best way to go... You never know what else is infected even if you do get rid of the "main" virus.

[IngeniousHax]

Alright thanks for the link. I tried to install Hijack This to find the infected files and it instantly rendered it useless... So hopefully I can get this to load, and scan, and hopefully get rid of the files... IDK though, seems pretty nasty.

[RudiVisser]

Yeah it doesn't sound like a nice virus

Is safe mode actually.. safe? I mean working without being affected by the virus?? You could always try running "sfc /scannow" from CMD in Safe Mode to restore system files, also bring up msconfig and disable pretty much EVERYTHING that isn't *required* for normal operation of your system.

[IngeniousHax]

Alright, ill try that aswell, as of now,im not sure fi safe mode would be "safe". I mean I can't even use I.E. on the computer, im using my g/fs computer to troubleshoot this right now... I guess it blocked WClean, which wasn't even loaded on the computer from being started at startup, which leads me to believe that among the virus is other programs tied in with the virus to keep many things from running using precompiled software.

[no2pencil]

IngeniousHax, on 23 Oct, 2009 - 12:22 PM, said:

[b]Explorer.exe is no longer working or mssing. Say's the application not found.

At this point, I would stop everything.

Boot off the Windows cd, select repair, & either from the repair console sfc /scannow

or Boot off the Windows cd, select to install, press F8, & then select repair, & repair the OS. Doing this you will need your registration key. So if it isn't on the side of the computer, you will need to find a way to jot that down before hand.

When explorer.exe is missing, corrupt, or infected, I usually call it a done deal & just install over it. The above will not affect any saved files, such as music, movies, or whatever else you...er, her friend has downloaded.

Best of luck

[IngeniousHax]

Yeah, ill try it, IDK, it sucks, she needed AutoCAD for her architecture school, but didn'thave the 5000+ dollars to get it, so bootlegged it, and got wrecked by a virii genius.

[no2pencil]

Just another example of how free software comes with it's own price.

[IngeniousHax]

yeah, good point. really goes to show things are not free, and everything comes with a price.

[KYA]

RudiVisser, on 23 Oct, 2009 - 11:27 AM, said:

I'd suggest first running the best anti-virus (@KYA (hello!) this is not my personal opinion, it's based on several comparitives)

In the interest of not derailing this thread I won't say what is actually on my mind; however, what the hell is your deal guy? Get a grip.

[IngeniousHax]

LoL. Yeah, so yesterday, I was attempting to run through files and catch the infected files to see if there was a way to salvage what ever was still working and keep it from being ruined all together and doing a complete system makeover. But, as soon as I got into CMD prompt for the second time, it said the file was missing and was no longer available.

So in the end, the virus won and I had to do a system makeover.

[RudiVisser]

IngeniousHax, on 24 Oct, 2009 - 09:57 AM, said:

So in the end, the virus won and I had to do a system makeover.

To be fair, it's probably for the best

At least you know all traces of it are removed now don't you

[IngeniousHax]

Yeah, i'm real glad I could recover her computer. She was very irate with the situation, but I have to hand it to the Virus coder, who ever made it made a damn good virus. Quickly mutating and self replicating. It was madness out of control.

[Dark_Necros]

oops. i didnt read the entire thing XD sorry. good job at killing the virus.

This post has been edited by Dark_Necros: 29 October 2009 - 08:14 AM