Critical Virus

marleyboy

Although I have two versions of XP on my system, my main one has been corrupted by a virus. The Virus has somehow disabled my Sys restore, even in safe mode, I cannot go any further than the safe mode screen.

It allows me to boot up but after a few seconds, starts to hide my desktop icons eventually leading to the taskbar. With not enough time to run a virus scan or equivelent. Its more frustrating because a reboot confirms all my apps are still there, but something then proceeds to block them.

XP wont allow me to try to repair with a fix, as it asks me for the admin password, only it wont recognise my password, (assuming its the same password as the admin login).

I am currently running my XP (slave drive) version, but if I try to run my antivirus, it crashes at 2%. Is there anyway possible to scan my other version of XP from this one? Is there any software that can perform such a thorough scan and maybe save my original XP, or am I going to have to re-install XP as fresh?

Any help would be greatly appreciated.

imho

I cant help you but i am bumping up your thread so one of the clever guys might see it .

wakandem

If you have backed up all your docs from the original system then disconnect the slave drive & do a reinstall. When up and running with all updates and av prog then switch off connect the slave drive boot up on your new os and av scan the slave drive.
There probably are ways of sorting it out but it may be quicker to reinstall. At least you know it is clean..
You should be able to to scan the 1st os with the slave one, just locate the folder and scan it. You could try an online scan which would include the 1st os as long as the folders can be seen by the slave os, but still think a reinstall is better, just make sure you have the apps ready to install.

GreenNotM

Can you get to the virus'ed XP's command prompt from the boot menu > "Safe Mode with Command Prompt "

Browntoa

surely thaey are install into different partitions so working XP partition should be able to scan the other ??

fwor

Marleyboy - one other factor to bear in mind (as if you didn't already have enough problems...) is that a significant number of viruses will automatically scan for all readable volumes, and will attempt to infect any drives that it finds. So if you boot your "dirty" copy of XP while your "clean" copy is attached, it may not stay clean for long.

So once you've solved the initial problem it would be worth checking your other copy carefully - particularly for rootkits.

marleyboy

Thanks for all your help everyone, I cant get past the "safe mode" screen on the infected XP, I thought I had it clinched (I was close), using an online scan via my "so far - still healthy XP". It detected some. However If I use a static Virus scanner, it crashes during the attempt.

My original XP does boot up, and displays all my icons, but the virus seems to hide them, while XP seems to try to refresh the screen, breifly re-displaying my icons and task bar, however this doesnt give me enough time to run a vscan. It also doesnt get to run my virus scanner, as it seems to have disabled it, or crashed it. (apps do run if i click them quickly enough, and will remain open), but the desktop icons and taskbar will appear-dissappear alternately, up until they no longer appear, leaving just the Windows Task Manager to play with.

Confusing I know, it seems the virus blocks or hides my apps. If I knew what the virus was, I probably would be able to cure it (yeah right ).

It doesnt seem to have corrupted my files as yet, so im hoping it is cureable, however I am happy that I can at least access and back up any vital files\folders I may need, should the inevitable (re-install) be needed.

skiddy2k

Download and Restrictions Removal Tool. Run it, tick all the boxes which you can and click "remove" (on the bottom-left).

Seeing as you cannot run a antivirus, it seems as if a nasty on your computer has prevented antiviruses from running. Try to use an un-popular application to remove it... because its not as popular, the person creating the nasty may not have blocked it from running. Go onto this link: http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
Download and run the most recently created file (it should be the last one in the list).
Scan your computer using it and set the scan settings to Maximum Protection.
(Uncheck "parse e-mail format" and "scan password protected archives" in the scan settings if its enabled).

If the above does not work, download and run ComboFix and attach the log file it creates here.

GreenNotM

Has the virus disable "New Task (Run....)" on the file menu of task manager ?

You can use this to run the above - if not already - good luck !

marleyboy

Cheers skiddy2k I am currently running it on my uninfected XP, should I try and run it from the affected XP as well or instead of? Thanks in advance.

marleyboy

GreenNotM wrote: »

Has the virus disable "New Task (Run....)" on the file menu of task manager ?

You can use this to run the above - if not already - good luck !

I should be able to run it from the affected XP NEW TASK (run), but am unsure what to type in to run it