Removing Virus

The virus did not survive a disk format. He was re-infected after the OS was re-installed

I am aware that the virus remained, my question was: What A/V program (if any), should he use? Or should he go out and purchase new hard drive?

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode or Safe mode with Command Prompt.
Run a full system scan and delete all the files detected.
Remove the lines that the worm added to the System.ini file.

For specific details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
How to disable or enable Windows Me System Restore
How to turn off or turn on Windows XP System Restore

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, reenable System Restore by following the instructions in the aforementioned documents.

If you did a format and a clean install the virus would be gone. Is this a OEM CD for XP not a copied CD? If it is not a real CD it could contain the virus or it could reload with new programs. It also could load from a flash drive, floppy or back up device.
Look at the post ten things to do to a PC before connecting it to the internet. It is here on TR.

The best practice to clean install Windows in existing Windows system is to delete all partitions in the HD, to turn the computer off for at least 30 seconds, and then to install Windows.

The idea behind this practice is that a few known virus remain in the RAM and would come back even if the HD was formatted and Windows got clean installed.
After Windows installation, make sure Firewall is enabled or installed and AV is installed before surfing web.

As far as AV program is concerned, I recommend you try Kaspersky or Virobot. They both have 30-day trial version available.

1. Kaspersky ? www.kaspersky.com
2. Virobot - http://tinyurl.com/p9zlq

Refer to http://tinyurl.com/es95s
I strongly recommend you use one of the listed in the above site. If your AV is not listed, it may not be as good as you think it is.

You don't need a new HDD but you do need a Wiping Utility to Wipe the HDD before you even consider reloading the system.

One of the many available Utilities that writes zero's to every sector of the HDD several times will destroy all traces of most Virus and shutting down and unplugging will remove any Memory Resident Virus so after you wipe the HDD and have powered down you should then be able to reload the OS and software without a problem. I always install the OS and then an AV program and update it before going onto anyplace on the net as it's way too dangerous not to do this.

From previous experience Boot & Nuke is an excellent wiping utility and is available here

http://dban.sourceforge.net/

Col

The other posts have good info, especially about the possibility that it remains in RAM a while, best to leve the machine off for a bit.

Also good is that you are reformatting and rebuilding, none of the worry about saving data, programs etc.

Here are two links:
From Symantec:
http://www.sarc.com/avcenter/venc/data/w32.hllp.sality.html

from Computer Associates:
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=52797

There are others (Google the virus name) but those should get you started.

I noted that AVG has a fix for this virus, but hadn't released it yet, according to the report I read.

However, it is a network aware virus, that could be the source of re-infection. You DID disconnect from the network and the internet before rebuilding didn't you???

If you can rebuild cleanly, then another network computer is the likely culprit, if not, there is another source for the virus to re-infect, eg a damaged copy of an install CD, a secondary hard drive.

After a clean rebuild, install an AV FIRST, then add programs one at a time, to try and find out if any particular one is causing it.

If all goes well, connect to the Network first (stay off the internet) and check again for infection.
Then connect to the internet, try again.

Each of these stages should help you pinpoint the source of infection.

A wild guess here: Another computer on the network is the source, if so, you have another job to do, on that one........ then every other machine connected.

Good Luck and please post back on results, we are always interested which, if any, of the tips we gave helped. I have a comprehensive list of online scanners (19 of them) if you want to try one, all free!! As I find more, I keep updating my list, no doubt there are more and more becoming available.

Personally, I have had good luck with AVG Free-edition for AV needs. One one occasion I did get infected and needed to manually remove the virus, but it was fairly simple. No AV product is foolproof. And personally I refuse to use any Symatec or Macafee home product. NOD32 is a very good AV solution to purchase, antivir, AVG, and Active Anti Virus Shield (AOL branded, but free from Kaperksy Labs)are all good choices. No matter what AV you use, someday, sometime, you will get infected. AV is 1/2 the solution, the other 1/2 is browsing and downloading habits.

did you remove any USB disks or USB keys before formatting & Installing?
Symantec has manual removal instructions at:
http://www.sarc.com/avcenter/venc/data/w32.hllp.sality.html.
according to the following forum for AVG, you did the best thing by formatting & re-installing, see discussion at:
http://forum.grisoft.cz/freeforum/read.php?4,74090,74478

this might help

link from Symantec.com stated how to remove this virus, hope this helps

http://www.symantec.com/security_response/writeup.jsp?docid=2006-011714-3948-99&tabid=1

Perhaps you should consider chaging to a more well known anti virus engine (that's just my opinion)

format the hard drive and install linux. :-)

sorry thats what i did when i had the exact similar problem. though I later found that my backup data which was written into the CD had acutally copied the virus too. but too late to switch back to windows, linux just gives peace of mind and not worry about security.

YOUR PROBLEM BRINGS TO MEMORY A PARTICULARLY NASTY VIRUS ABOUT 10 YEARS AGO. IT WAS THE "STONED EMPIRE MONKEY" VIRUS,WRITTEN TO COMMAND, AND WOULD POSE AS A NORMAL START-UP FILE. SOMETIMES THE ONLY WAY TO FIND IT, WAS TO EXAMINE CHANGES IN COMMAND. BOY, I WENT THRU ALOT OF SWEAT WITH THAT GUY. IT WAS "STEALTH, POLYMORPHIC" AND EVER CHANGING. A LOW LEVEL UTILITY WAS THE BEST WAY TO GET RID OF IT. SOMETIMES IT WOULD "CRAWL" UP INTO THE MEMORY, AND HIDE, AND WAIT FOR YOU TO TURN THE MACHINE ON AGAIN, THERE WERE SOMETIMES WE HAD TO THROW THE MEMORY AWAY. FIND THE MANUFACTURER L.L. SOFTWARE, OR USE A KILLDISK UTILITY TO STSRT OVER AGAIN. THEN LOAD UP WITH S.B.A.B.R, AND AVG PRO. GOOD LUCK! OLDHIPPIE

Did you FDISK and FDISK /mbr before you reinstalled the OS???

I too received notification from Grisoft Free A/V that my PC had been infected. i was offered the opportunity to upgrade to the 'paid' version to enable a more effective way to remove this virus. Instead of upgrading I went to the McAfee and Symantec web sites and used thier free online scanner to check my hard drive, and surprise surprise, neither program found the the virus. I then tried other A/V programs and they also failed to turn up this virus! My conclusion was that Grisoft had provided a false-positive, either accidentally or deliberately, I do not know which. In conclusion, if an A/V program finds an infection and it cannot remove the infection then use another A/V program to double check the first, particularly if the A/V program you are using is a freeware version.

Run FDISK utility and then format again.
This will remove all virus

You have a boot sector virus. They survive a format and even a repartition because these processes do not touch the boot sector.

The most effective way that I have found to remove these is to use a Sector Editor program. There are numerous ones out there.

I then take the program and go to the Boot Sector and then just hold down the 0 key and rewrite the entire Boot Sector with 0's then I can repartition and format the drive knowing the virus is now gone.

I used to work at a school and the computer lab would constantly get infected and we would need to do this process once or twice a year.

1. There is no need to buy a new hard drive. Viruses are generally dependant on the operating system to be 'active', so the fact that the virus 'remained' is a mystery (I'm also not familiar with that particular virus you mentioned). It might be a 'memory resident' virus, in which case you'd have to shutdown the system completely (not justa 'reboot') from Windows then do your installation. Might also be that the system is being hit by a worm as soon as it's live on the net.
2. For an antivirus program, I've liked the PC-cillin/Trend-Micro products in recent years. I've never been a big fan of McAfee, and the Symantec offerings, while good, use too much of your system resources and seem to install too deeply into the registry for easy removal.
The free ones are okay, but I've found that virus removal with the free AVG isn't always simple; it just tells you that you have a virus and wants you to take care of it (no real 'removal' engine).
I've also heard good things about the Zone Alarm, CA, and Panda security suites.

As far as what I'd do to 'remedy' the situation (if you'd like to hear my opinion), I'd power down the system, remove power, and clear the CMOS (just to rule caching and any other settings out as a problem), REMOVE THE PC FROM THE INTERNET (in case it's caused by a Windows exploit that is opening a door for this and other viruses), boot the system with a Windows 98 boot floppy, FDISK and FDISK /MBR, and format from the floppy.
Next, format the drive with the Windows XP CD as NTFS and continue on with the Windows installation (I'd highly doubt that anything could survive two formattings under different file structures).
After Windows is done with the installation, install an anti-virus/security suite and run a scan.
For the record, I also like Hal's suggestion of a disk-wiping utility. There are many bootable .isos available that will do the trick.

In any event, I wish you good luck. :)

Symantec reports they have a solution so you would need to purchase their product. They have some excellent info at the follwing link:
http://www.sarc.com/avcenter/venc/data/w32.hllp.sality.html

Another solution may be one from CA who have some free web tools. I have never used their tools so don't know how effective they are. Here is a link to their site.
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=52797

Some of the anti-virus software does not remove virus, they only tell you the name and the type of virus infected the system. To get rid of this problem, try to locate the virus and its sub files such as win32/sality(.exe, .dll, and .ini)and delete them manually thru safe mode. In order to do this, login as administrator in safe mode. if you dont delete all this file expectially, the .ini file will recreate the virus everytime the system reboot. try this. Good luck

If this is XP, you don't need fdisk
This virus is not memory resident. I agree with previous posters that you are somehow reinfecting yourself.
Wipe your drive with dban, then reinstall
http://sourceforge.net/project/showfiles.php?group_id=61951&package_id=58479&release_id=439240

try fdsik. not sure if you have tried that. don't think anything will survive that

At home, I use Avast AntiVirus. You can download a free home edition at avast.com. It has a real nice boot time clean. It works real good to remove viruses from the boot area and is as easy to use as any of the programs you have to buy subscriptions to.

In the case of boot sector virus, I write zeros to the drive with Gdisk. This is after deleting any partitions and fdisking the mbr. The Gdisk operatio n will write to every sector of the frive, this includes the boot sector. If anything survives this operation then it damn well deserves to.

The advice given is all good, especially isolating your PC from the possibility of the virus hiding in : networked machines, CD's, DVD's, RAM, logical drives, secondary drives, also remove all media from any floppy, flash card, USB, CD / DVD drives etc.
As you are already in reformat / reinstall OS mode I suggest you remove your hard drive(s) ( or your PC ) and take it to a reliable IT friend or computer shop to get them scanned to ensure they're clean b4 / after OS reinstallation. Especially if your CMOS needs to be reflashed to clean a virus out of it. All should be OK if your reformatting was thorough.

The first programs to reinstall after the OS must be a reliable AV with most up to date signature available then a Firewall that monitors outgoing communications as well as incoming. Go back online to update your firewall, your AV and your OS in that order! Download and install spyware protection ( I can reccomend combination of AdAware SE personal and Spybot S&D ), from their websites not a shareware site! Turn off the autorun feature on your CD / DVD drive and SCAN ALL existing media with your updated AV and AdAware before reintroducing their contents or reinstalling anything they contain onto your PC. Scan your PC after introducing any programme not installed from manfacturer's media, eg., a downloaded programme, a magazine CD etc. This is tedious stuff indeed, but necessary to reassure yourself that the virus is not present on your drive in any form or hiding inside of or fetched by some malware program when its given the chance to subvert your browser or email progam. Some malware use their own smtp server to fetch viruses etc. ( Some malware bots deliberately download a virus & corrupt your PC if you stop their illicit activity ). Practise caution with all sites. McAfee have a free site advisor you install into Internet Explorer's toolbar.

i had a similar problem. I booted into DOS and did an FDISK/MBR & that fixed it up, didn't hurt drive or any programs on drive

The only thing I would like to add is that after creating a boot floppy from an uninfected system, make sure to make the floppy read only by moving the slider on the floppy so nothing can write to it or it will infect the floppy. The virus may be looking for fdisk to be run and will then infect the floppy if it is not made read only then you have to start over again.

I agree, virus was probably reinstalled after format, unless the format came from a restore partition and the boot record was infected.

Due a FDisk then flormat it in reg dos then reload the os and do a ntfs flormat. And buy Grisoft Anti-Virus 7.1 i have a two year free updates 38.00

All of the above posts are correct. I just want to add a few of my own.

Doing a cold boot will ensure you that no virus is present in the memory. When booting and installing a new OS, I greatly suggest that you do a cold boot, and use the cd as the first boot device, hence, use a bootable cd rom. Then format and install the OS. Just make sure that the installer are legit, or else, you become infected again. Install the os, or better yet, if the pc comes with a restore cd, use it. Before installing any programs, and, and before connecting to the internet, have a very good antivirus and firewall installed. This way, all programs that will be installed will be scanned by the antivirus program.

Have a happy and successfull installation.

Was an Outlook .pst file transferred from the old OS setup, and re-imported into the new OS? If so the virus may reside within that file or archive.

I guess you have reformated your friends computer using windows XP CD. To remove these kind of virus, you need to make the HDD raw, and then re-build the file tables.

You need to first , use a windows 98/dos bootable floppy, use FDISK utility and delete all the partitions, or you can also use Disk Manager to delete all the existing partitions, and then reboot the PC and make a new C-Drive partition, and format that with NTFS if you have disk manager or reformat using a Windows XP CD. This should resolve your friend's computer problem.

Regards,
DON

If you have a western digital hard drive you can download from their site, a program that checks and writes zeros to hard drive. Another free program to wip the hard drive is
Kill Disk. After using either of these programs you must use WinXP CD to partition and format the drive. Be sure to turn off all power to computer for 30 seconds
before starting anything

presently my system av has quarantined and clean it. but has not been able to remove it.