nuqel.e

I tried your links for ComboFix...after running them (which seemed fine). An icon doesn't appear anywhere and I can't find where it saved on my computer -strange...I can't see where it is to open it (or double click???)

I disabled the McAfee but couldn't get Combo Fix going - ideas?

Thanks.

Delete the current version of ComboFix that you have and download this one:

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV. (Mcafee)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Hi there,

I tried this link and it said to go straight to 'Bleeping Computer' because this version could be infected with the virus 'Virut'?

I haven't done anything not sure how accurate this is - wanted to check with you.

Thanks

I'm afraid I have bad news.

Your system is infected with a polymorphic file infector called Virut. Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a format and clean install, or destructive recovery if you have an OEM recovery partition, is the best way to clean the infection and it is the best and safest way to return the machine to its normal working state.

Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (*.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too.

Recent variants also modify htm, html, asp and php files.

Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups.


For more information, please see Here

Instructions how to format and reinstall Windows can be found Here

That is bad news. The strange thing is I just had to reinstall my operating system (with Dells' help) because I had a issue with my operating system. The machine has basically nothing on it. I had my files copied by Best Buy onto an external HD. I have the HD now hooked up to my computer(haven't copied anything back) I wonder if the virus caused my problems before and now that it's hooked up it's causing them again?? The computer is running fine now, the only time I had a comment about the 'virut' was when I cliked on the "link 1" you had sent for Combo Fix. What problems would I be having if I have this Virut virus? I hate to go through the reinstall when I'm not having problems. Do you think it was just the Link 1 infected and not my computer?

Thanks,

Susan

Maybe, maybe not. Virut can easily get back in, because as I said, it infects exe type files, so if you backup any exe files, they you are backing up the infection. That's why when we recommend a format, we do it together with our users to make sure nothing slips under the radar and it's a controlled format if you know what I mean.