memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

View previous topic View next topic Go down

memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/Flood.mirc, New IRC.

Post by raj4groups on 21st April 2009, 6:27 pm

Hi, i need a serious help in saving my laptop right now.
I am badly infected by above viruses. McAfee detects and delete some viruses but may be because of its infinite loop nature or something its keep on coming. I can't use internet anymore. It gets multiplied a lot, if I browse internet.

My laptop is at its worst, its very slow. I tried scanning via stinger but it doesn't work. I also tried [You must be registered and logged in to see this link.] but as soon as i try to execute the set up file, it says "r u sure you want to exit the set up?" and when i click NO, then it pops the same message again and again. Please help me remove the above viruses.

Thanks in advance and highly appreciating your time.

Thanks,
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 21st April 2009, 6:55 pm

Please download the current version of HijackThis from [You must be registered and logged in to see this link.]

  • Double click and run the installer.
  • It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  • After installing, you should get the user agreement, press accept and Hijack This will run.
  • Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 21st April 2009, 7:04 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:14 PM, on 4/21/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\reader_s.exe
C:\Documents and Settings\Raj M. Shah\reader_s.exe
C:\Documents and Settings\Raj M. Shah\Application Data\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O1 - Hosts: 212.48.121.88 banesto.es
O1 - Hosts: 212.48.121.88 [You must be registered and logged in to see this link.]
O1 - Hosts: 212.48.121.88 banesto.com
O1 - Hosts: 124.217.248.253 [You must be registered and logged in to see this link.]
O1 - Hosts: 124.217.248.253 [You must be registered and logged in to see this link.]
O1 - Hosts: 124.217.248.253 bancomer.com
O1 - Hosts: 124.217.248.253 bancomer.com.mx
O1 - Hosts: 124.217.248.253 [You must be registered and logged in to see this link.]
O1 - Hosts: 124.217.248.253 bbva.com.mx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [*ctfmon32] "C:\Documents and Settings\Raj M. Shah\Application Data\svchost.exe"
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\Raj M. Shah\reader_s.exe
O4 - HKUS\.DEFAULT\..\Run: [svc] c:\program Files\ThunMail\testabd.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [VRTD8] C:\WINDOWS\TEMP\VRTD8.exe (User 'Default user')
O8 - Extra context menu item: &Google Search - [You must be registered and logged in to see this link.] Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - [You must be registered and logged in to see this link.] Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - [You must be registered and logged in to see this link.] Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Similar Pages - [You must be registered and logged in to see this link.] Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - [You must be registered and logged in to see this link.] Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe

--
End of file - 6120 bytes

Thanks and please let me know the further steps.
Highly appreciating your time and efforts.

Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 21st April 2009, 7:25 pm

Got it !!... please take your time.
Thanks !


Last edited by raj4groups on 21st April 2009, 7:46 pm; edited 1 time in total (Reason for editing : realized my mistake)

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 21st April 2009, 9:23 pm

Bad news. Sad tearing

You are dealing with a polymorphic file infector known as Virut. It infects ALL exe/scr files on the machine. See here for details.
[You must be registered and logged in to see this link.]

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

  • Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  • Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  • Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  • From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS).

To help you understand more, please take some time to read the following articles:

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 21st April 2009, 11:27 pm

Hi,
Thanks, I appreciated your research.
But I have already formatted my laptop 2 times and even after that I am facing this problem.
do you recommend me to download rmvirut ? and try to clean virut from my laptop ?

or what would you recommend me to do ?

Thanks in advance.
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 23rd April 2009, 6:30 am

Belahzur, r u still resolving my problem ??
please update me !!
Thanks, highly appreciating your time and efforts.

Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 23rd April 2009, 8:38 am

Hello.
Missed your post, sorry about that.

Lets do a controlled format. Format it again, then download AVIRA from the source website, do not use any software from sites that are questionable.

Please install Avira antivirus otherwise you won't be protected.

1) [You must be registered and logged in to see this link.]
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 24th April 2009, 7:48 am

Thanks for the reply. Yes, I do have formatted more than 3 times now and I have also installed an AntiVir software. Right now everything is fine, but I still feel that there might be an elements of Virut left. I have not connected to the internet yet, do you recommend me to connect to internet and test ? or you want me to resend you log file from AntiVir and HijackThis ?

Highly appreciating your help. Waiting for your reply.

-Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 24th April 2009, 8:12 am

I have one more question... wht do u mean by controlled formatting ?
I did formatting with TOSHIBA system recovery DVD's.

Please clear my doubt.
Thanks,
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 24th April 2009, 4:28 pm

By a controlled format, I mean that you do it again with me watching over, instead of you doing it yourself, then running something you think is real, which in truth isn't, that's why you got infected again and again.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 24th April 2009, 5:21 pm

Ok, I got it, please let me know the steps that I have to follow.

-Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 24th April 2009, 5:38 pm

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 24th April 2009, 6:01 pm

So, you want me to update my computer and install all the anti virus SW and Firewall mentioned.
Then do the Format.
And then again install all the above components and get back to you ?
Please confirm, so I can start the procedure ASAP.
Thanks,
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 24th April 2009, 6:25 pm

No, format it first, then install an AV, then come here and read my above prevention speech on how to stay away and stay clear of malware.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 24th April 2009, 6:59 pm

Got it, I will let you know once I am done.
Thanks,
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 30th April 2009, 5:56 pm

Hi,
I did exactly the way you have explained it to me.
But I still believe that AV can not scan 2 files, and that two files are giving me hard time. if you want I can send you log.
can we talk on phone or something.
I want result now, I am tired. I was planning to change my RAM, incase something works out ...

Please help me.
Thanks

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 30th April 2009, 6:17 pm

Did you choose not to format?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 30th April 2009, 6:23 pm

No I do have formatted my computer. I have followed all your steps.

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 30th April 2009, 6:31 pm

Ah. Then unless your infected again, what files can't be scanned?

I know some legit files are locked by Windows so they can't be altered in anyway.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 30th April 2009, 11:05 pm

I can not track the location but AVIRA AV says "2 Warnings" and in log file it says 2 files can not be scanned.

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 30th April 2009, 11:17 pm

Ah, I know about them.
One is pagefile.sys in the C:\ drive right?

Don't worry, it's not malware. Windows needs them two files, so it locks so they can't be touched/scanned/changed by anything. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 30th April 2009, 11:21 pm

should I send you log file from HijeckTHIS SW ??
now should I connect it to internet ?? is it safe now ?

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 30th April 2009, 11:28 pm

Yes, it's fine. Stop worrying. Open Grin

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 30th April 2009, 11:37 pm

Ok, Let me see how it goes. I will get back to you soon.

Thanks for your all help, Highly appreciated.

Have a Good one.

-Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 1st May 2009, 12:55 am

Hi,
I just scanned my laptop through Spybot S & D and found 94 problems.
major are with windows folder, I was wondering if I fix them or delete them, I might have to face start up problem. do you think so ?
majority are .dll file : type: file
I do have some other extension files :type: data
and some folders.

Please help.
thanks
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 1st May 2009, 2:30 pm

Maybe. I trust MBAM's judgement over Spybot to be truthful.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 1st May 2009, 6:14 pm

So now you want me to uninstall Sypbot and install MBAM ?
Right now laptop is working at its best, i dont see any problem, except when ever I connect external USB or ext HDD, I can not double click it to open. It says "Access Denied". But I can access it by right click and do whtever I want.

Thanks,
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 1st May 2009, 8:08 pm

Hello.
Plug in whatever USB/external hardrives you have.

Please download [You must be registered and logged in to see this link.] to your Desktop and run it by double clicking the program's icon.

  1. Wait a couple of seconds for initial scan to finish.
  2. Connect all of your USB storage devices to the PC, one at a time, and keep each one connected at least for 10 seconds.
  3. If there are more USB storage devices to scan, please take a note about the order in which these were connected.
  4. After all the devices are scanned, right click in the Monitor tab, and choose "Save log". That will open the log in Notepad. Please copy and paste the log into this thread.
Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC, e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras, memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 1st May 2009, 9:07 pm

USBNoRisk 2.1 by bobby

Started at 5/1/2009 2:01:38 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {145ac1d6-3539-11de-881b-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 145ac1d6-3539-11de-881b-806d6172696f
----------------------------------------

========================================
Initial scan finished!
========================================


New device connected at 5/1/2009 2:02:49 PM

Scanning for connected USB mass storage...
----------------------------------------
E: {2b8e1908-35c9-11de-8820-00038a000015}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
autorun.inf found on E:
----------------------------------------
File E:\autorun.inf renamed successfully

Content of E:\autorun.inf.blocked
----------------------------------------
[autorun]
OPeN=rEcYClEr\sEtUp32.exe
IcON=%wIndIr%\sYstEm32\ShElL32.DlL,7
ACtION=Open USB
sHeLl\OpEN=oPEn
sHeLl\OpEN\cOMMaND=ReCyClER\sEtUp.exe
sHeLl\OpEN\deFaULt=1
----------------------------------------

No mountpoint found for E:
Sanitized mountpoint for 2b8e1908-35c9-11de-8820-00038a000015
----------------------------------------

desktop.ini found on E:
----------------------------------------

Content of E:\$RECYCLE.BIN\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
----------------------------------------


Content of E:\Recycled\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------


Content of E:\My Works\MyWorks\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Future Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\Romantic (Slow)\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=F3F7761A-3502-4863-A90E-DCBCA1865A0C&a_id=R%20%20%20220642&album=Bollywood%20Flashback&artistID=35F1A890-95E9-4D2E-8306-F688DBC4D2CD&p_id=P%20%20%20165442&artist=Bally%20Sagoo&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\ENGS\01 7 ENRIQUE\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=321C65CD-AFD3-4B80-AA50-30CDA4C626D1&a_id=R%20%20%20559247&album=Escape&artistID=AA3A7798-6F6B-4322-A50F-F03424B4862D&p_id=P%20%20%20169286&artist=Enrique%20Iglesias&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\02_Mix Hindi Songs\Mix\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=9663A712-6851-40D3-8985-A66465C02942&a_id=R%20%20%20764854&album=The%20Movement&artistID=9E9EA56C-C0F4-4764-AA92-0764053E21A7&p_id=P%20%20%20713823&artist=Karmacy&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------

----------------------------------------

No mimics found on drive E:
========================================



New device connected at 5/1/2009 2:03:24 PM

Scanning for connected USB mass storage...
----------------------------------------
F: {4705b9d6-353b-11de-881e-00038a000015}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on F:
----------------------------------------
autorun.inf found on F:
----------------------------------------
File F:\autorun.inf renamed successfully

Content of F:\autorun.inf.blocked
----------------------------------------
[autorun]
OPeN=rEcYClEr\sEtUp32.exe
IcON=%wIndIr%\sYstEm32\ShElL32.DlL,7
ACtION=Open USB
sHeLl\OpEN=oPEn
sHeLl\OpEN\cOMMaND=ReCyClER\sEtUp.exe
sHeLl\OpEN\deFaULt=1
----------------------------------------

Files referenced from F:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

Sanitized mountpoint for 4705b9d6-353b-11de-881e-00038a000015
----------------------------------------

No Desktop.ini files found on F:
----------------------------------------

No mimics found on drive F:
========================================

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 1st May 2009, 9:21 pm

Please open USBNoRisk again, we need to use a custom script to delete the malicious autorun.inf files.

  1. When USBNoRisk opens, go into the Script tab, copy and paste the bolded script in the quote box below.

    {2b8e1908-35c9-11de-8820-00038a000015}
    delete: E:\autorun.inf.blocked
    delete: E:\recycler\setup32.exe
    {4705b9d6-353b-11de-881e-00038a000015}
    delete: F:\autorun.inf.blocked
    delete: F:\recycler\setup32.exe
    protect:

  2. Then press the Run Script button.
  3. Copy and paste the report back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 1st May 2009, 10:03 pm

USBNoRisk 2.1 by bobby

Started at 5/1/2009 3:00:38 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {145ac1d6-3539-11de-881b-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 145ac1d6-3539-11de-881b-806d6172696f
----------------------------------------

========================================
Initial scan finished!
========================================

Processing script
----------------------------------------
No script to process for C:\
----------------------------------------



New device connected at 5/1/2009 3:01:38 PM

Scanning for connected USB mass storage...
----------------------------------------
F: {4705b9d6-353b-11de-881e-00038a000015}
Added F:
========================================

Scanning USB mass storage for files...
----------------------------------------
Blocked file found: F:\autorun.inf.blocked
----------------------------------------
Content of F:\autorun.inf.blocked
----------------------------------------
[autorun]
OPeN=rEcYClEr\sEtUp32.exe
IcON=%wIndIr%\sYstEm32\ShElL32.DlL,7
ACtION=Open USB
sHeLl\OpEN=oPEn
sHeLl\OpEN\cOMMaND=ReCyClER\sEtUp.exe
sHeLl\OpEN\deFaULt=1
----------------------------------------

Files referenced from F:\autorun.inf.blocked
----------------------------------------
None
----------------------------------------

----------------------------------------
No Autorun.inf files found on F:
Sanitized mountpoint for 4705b9d6-353b-11de-881e-00038a000015
----------------------------------------

No Desktop.ini files found on F:
----------------------------------------

No mimics found on drive F:
========================================

Processing script
----------------------------------------
4705b9d6-353b-11de-881e-00038a000015
Drive letter for GUID: F:
SectionStart = 3
SectionEnd = 6
Delete: F:\autorun.inf.blocked > Done!
Delete: F:\recycler\setup32.exe > File does not exist!
----------------------------------------
Protect F:
----------------------------------------
----------------------------------------

========================================
Scan finished!
========================================

-----------------------------
I will resend you log for other USB. Is this USB fine ?
Thanks for your help.
-Raj
------------------------------

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 1st May 2009, 10:07 pm

Whatever is plugged into F:\ is fine, now plug whatever was in E:\ before back in and re-run it using the script I supplied.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 2nd May 2009, 1:18 am

USBNoRisk 2.1 by bobby

Started at 5/1/2009 6:08:59 PM

Scanning for connected USB Mass storage...
----------------------------------------
========================================

Scanning for other storage...
----------------------------------------
C: {145ac1d6-3539-11de-881b-806d6172696f}
========================================


Scanning fixed storage for autorun.inf files...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for 145ac1d6-3539-11de-881b-806d6172696f
----------------------------------------

========================================
Initial scan finished!
========================================

Processing script
----------------------------------------
No script to process for C:\
----------------------------------------



New device connected at 5/1/2009 6:09:42 PM

Scanning for connected USB mass storage...
----------------------------------------
E: {2b8e1908-35c9-11de-8820-00038a000015}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
Sanitized mountpoint for 2b8e1908-35c9-11de-8820-00038a000015
----------------------------------------

desktop.ini found on E:
----------------------------------------

Content of E:\$RECYCLE.BIN\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
----------------------------------------


Content of E:\Recycled\desktop.ini
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------


Content of E:\My Works\MyWorks\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\My Works\MyWorks\Future Concepts\desktop.ini
----------------------------------------
[ExtShellFolderViews]
Default={5984FFE0-28D4-11CF-AE66-08002B2E1262}
{5984FFE0-28D4-11CF-AE66-08002B2E1262}={5984FFE0-28D4-11CF-AE66-08002B2E1262}

[{5984FFE0-28D4-11CF-AE66-08002B2E1262}]
PersistMoniker=file://Folder.htt

[.ShellClassInfo]
ConfirmFileOp=0
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\Romantic (Slow)\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=F3F7761A-3502-4863-A90E-DCBCA1865A0C&a_id=R%20%20%20220642&album=Bollywood%20Flashback&artistID=35F1A890-95E9-4D2E-8306-F688DBC4D2CD&p_id=P%20%20%20165442&artist=Bally%20Sagoo&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\ENGS\01 7 ENRIQUE\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=321C65CD-AFD3-4B80-AA50-30CDA4C626D1&a_id=R%20%20%20559247&album=Escape&artistID=AA3A7798-6F6B-4322-A50F-F03424B4862D&p_id=P%20%20%20169286&artist=Enrique%20Iglesias&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------


Content of E:\Raj_C Drive\RAJ\DARSHAN PATEL\Songs\02_Mix Hindi Songs\Mix\desktop.ini
----------------------------------------
[.ShellClassInfo]
FolderType=MusicAlbum
MusicBuyUrl=http://redir.metaservices.microsoft.com/redir/buynow/?providerName=AMG&albumID=9663A712-6851-40D3-8985-A66465C02942&a_id=R%20%20%20764854&album=The%20Movement&artistID=9E9EA56C-C0F4-4764-AA92-0764053E21A7&p_id=P%20%20%20713823&artist=Karmacy&locale=409&geoid=f4&version=11.0.5358.4827&userlocale=409
----------------------------------------

----------------------------------------

No mimics found on drive E:
========================================

Processing script
----------------------------------------
========================================
Scan finished!
========================================

I hope this USB is fine. Please let me know.

Now I have one more issue, I was backing up my data, I rescanned that HDD with Avira AV, It was all clear. So when I was copying a bunch of movies from that HDD, CRE (Cyclic Redundancy Error) occurred and it stopped copying for the rest. I thought its ok, it happens some times, but the strange thing is after that I tried to play some media files, my voice is stuttering and I noticed that in background my memory is too busy, this was not the case yesterday when I installed all AV's and all Sypware's. I used quite a while and then I decided to back up my data.
Now something happened after that file transfer and that is eating my memory.

Stuttering happened with me while back when I removed my HDD from Laptop, I was recommended to format my laptop because it was interface issue. But I haven't touched my HDD this time.

Can you please recommend me something.

Thanks,
Raj

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Belahzur on 2nd May 2009, 1:27 am

Hello.
Have asked Doctor_Inferno to drop by here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 2nd May 2009, 1:30 am

Thanks a million, I really appreciate that.
But USB is fine right ?

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 2nd May 2009, 1:35 am

Ok Thank You!


Last edited by raj4groups on 2nd May 2009, 1:47 am; edited 1 time in total (Reason for editing : -)

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Doctor Inferno on 2nd May 2009, 3:47 am

Hello,

Is your HDD's file system FAT, FAT32 or NTFS? Check under - right click the drive >> Properties.

CRC or CRE is bit of mathematics used to ensure that your data is OK when being transferred. It's a checking procedure that quickly identifies when data has been damaged. If you get this message, it means that the file being read by your PC or software is corrupted. However, it does not mean all the data is lost forever.

When data is transferred, it is usually in small blocks and each block is given a CRC value. If something goes wrong with the data between the time it leaves the source and arrives at its destination, the CRC sent at the source will no longer match the one that is calculated when the data arrives - this is when the cyclic redundancy check error will appear.
The most common time you will see the cyclic redundancy check error message is when trying to read data from a damaged CD or DVD.

Just before it appears, your drive will probably grind and whirl away - your PC may also become a little sluggish.

Less frequent causes are the result of system crashes, and buggy software.

You can read more here:
[You must be registered and logged in to see this link.]


I would strongly suggest backing up anything that is important to you. Do not Attempt to fix or repair the drive till you do so.

Any type of relocation of the data to good sectors can cause issues if it does not work/pass/move the data etc. It can cause loss of data or irreversible damage.

Start >> run >> cmd >>type in CHKDSK [drive letter] /r


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104620
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 2nd May 2009, 4:24 am

it is NTFS. Result is:
C:\Documents and Settings\Raj M. Shah>CHKDSK c:/r
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by raj4groups on 2nd May 2009, 4:24 am

wht you want me to do ?

raj4groups
Novice
Novice

Posts Posts : 25
Joined Joined : 2009-04-21
OS OS : XP
Points Points : 27909
# Likes # Likes : 0

View user profile

Back to top Go down

Re: memory virus: new poly win 32, new win 32, IRC/Flood.c, IRC/

Post by Doctor Inferno on 2nd May 2009, 4:28 am

Select Y.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104620
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum