Question

Locked

removal of W32Virut.cf virus

By artzelda ·
this virus is driving me nuts. How can I remove it. I believe it also has infected my image files. running WIN XP Pro SP2

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

removal of W32Virut.cf virus

by Mehul Bhai In reply to removal of W32Virut.cf vi ...

Follow the procedure in the follwing URL. You have to even download a removal tool and run as instructed. Even update your antivirus to the latest virus definitions and install SP3 for more security. Your system is infected as you have not done both:
http://www.symantec.com/security_response/writeup.jsp?docid=2009-020411-2802-99&tabid=3

Collapse -

Back up and re-install OS

by 2BlueUK In reply to removal of W32Virut.cf vi ...

At first it may come across as a simple solution but on the long run it will save you more time and a **** of a lot of frustration.

Collapse -

How do you know you have it?

by ThumbsUp2 In reply to removal of W32Virut.cf vi ...

How do you know you even have that virus? What told you the name?

That particular virus goes by many different names, depending on what anti-virus software found it:

* W32.Virut.CF [Symantec]
* Virus.Win32.Virut.ce [Kaspersky Lab]
* W32/Virut.n [McAfee]
* PE_VIRUX.A [Trend Micro]
* W32/Scribble-A [Sophos]
* Virus:Win32/Virut.BM [Microsoft]
* Trojan.Win32.Patched [Ikarus]


Symantec removal instructions are listed here:

http://www.symantec.com/security_response/writeup.jsp?docid=2009-020411-2802-99&tabid=3

There is a REMOVAL TOOL offered which can remove the virus for you. Other anti-virus software vendors offer the same.

The virus appends malicious code to all executable files throughout your system.

Have you tried (1) turning off system restore and (2) runing full system scans using your anti-virus/anti-malware software while the computer is booted up in Safe Mode?

Have you searched your anti-virus software maker's web site for instructions on how to remove it?

Also, the program called Malwarebytes is pretty good at removing viruses, but you have to (1) rename the downloaded file just to get it installed and (2) after it is installed, rename MBAM.EXE to something like 2MBAM.EXE before you can execute a system scan and (3) do it in Safe Mode.

http://www.malwarebytes.org/

Collapse -

Removal tool

by GSG In reply to removal of W32Virut.cf vi ...

I downloaded the removal tool and it worked great at removing the virus. However, during the process, I had quite a few problems with files damaged beyond repair, plus my wireless was completely dropped and I couldn't rebuild it.

I ended up finishing the removal process, and then restored back to a day where I was fairly sure that I wasn't infected, which restored my wireless and repaired the files. Then I ran my Antivirus tool, which didn't catch anything. However, since it didn't catch the original virus, I installed Microsoft Security essentials and did a full scan, which took 3 hours. It caught several Trojans and a couple of keyloggers plus bunches of spyware that the other tools missed.

My last step was more time consuming. I only go to a limited number of sites from home, so I identified what directories the viruses were in, visited a couple of websites, then scanned those directories. I've identified 2 websites so far that have been causing my infections.

I'm happy to report that TechRepublic is NOT one of the offenders!

Collapse -

ProcessExplorer

by msnep In reply to removal of W32Virut.cf vi ...

Have you tried ProcessExplorer (MS / Sysinternals) to find virus-related processes and files?
Then get rid of the files and entries in the registry.

Back to Malware Forum
5 total posts (Page 1 of 1)  

Related Forums