Comments on: Win32 Virtob/Virut removal http://labs.phurix.net/posts/win32-virtob-virut-removal Research and development Thu, 05 Jan 2012 01:26:23 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Demonwolf http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-2#comment-209158 Demonwolf Wed, 02 Jun 2010 06:49:11 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-209158 Hey all. I am a network admin at two schools. Schools prove to be extremely difficult to handle because we all know what young students are like, they don't want to read a virus warning and go ahead anyway because they want the program they created at home to run and show their friends. Virtob/Virut have proven to be a formidable nightmare to deal with. Especially when coupled with a Mabezat infection that creates .exe duplicates of itself, even over networks. But I have found a solution. I use Hiren 10.4 and boot into the MiniXP. It boots pretty quickly and works like a charm. With the MiniXP, I run Dr. Web (Included on Hiren) and it clears out the majority of the infections. Then I enable the network shares with the useful network function on the desktop. Then I connect into the PC using the c$ network share (preferably from a notebook directly to the infected PC through LAN) and do a full scan with an up-to-date antivirus. I used BitDefender 2010. This finds a few more infections but clears 99% of them and asks what to do with the other 1% if there are any. Generally deleting them isn't an issue because of what I plan next. Once I have checked through everything, I do a Windows XP Repair to fix and/or replace damaged files. Thereafter, ensuring the BitDefender Client Security was updated to the newest version (Which includes a forced USB scan WMI script that is amazing) and that it has been set up correctly. Then it is just a case of repairing a few installations of applications (Nero, Pastel, Office) and all works wonderfully again. The catch comes in that you have to make 100% sure the computer is clean before reattaching it to a network. If any PC on the network has even one infection of either, you have to redo the entire network within 48 hours. If you work for schools, use school holidays to your advantage. 4-5 hours at each machine generally works beautifully. If you have multiple machines that are almost identical, Hiren does have cloning software. Recap: 1) Hiren 10.4 (One released each month so it might be on 10.6 now. Newer is generally better) 2) MiniXP 3) Dr. Web full scan 4) Enable Network in MiniXP 5) Scan remotely with updated decent antivirus (BitDefender, Kasperski. Norton is NOT decent) 6) Repair Windows 7) Check Antivirus and Firewall installed correctly and up to date 8) Repair any applications that won't work 9) Attach to clean network And it is that simple. I hope this alternative helps some people. It couples together many of the various other ideas on the website above and I have had a 90% success rate with most virus infections, not just Virtob/Virut or Mabezat. One last thing to watch out for, one of the telltale signs you have a serious problem is that when Login in, before you get to a desktop it logs you back out. This is a problem with the registry (HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\UserInit should read "C:\WINDOWS\system32\userinit.exe," without quotes) and/or the userinit.exe file in %systemroot%\System32. If someone manages to login but doesn't get icons and start bar, Explorer.exe and/or Explorer.scf are corrupt. You might also want to check the Shell entry under the same key of the registry above. It should read "Explorer.exe" without quotes. Hey all.

I am a network admin at two schools. Schools prove to be extremely difficult to handle because we all know what young students are like, they don’t want to read a virus warning and go ahead anyway because they want the program they created at home to run and show their friends. Virtob/Virut have proven to be a formidable nightmare to deal with. Especially when coupled with a Mabezat infection that creates .exe duplicates of itself, even over networks.

But I have found a solution. I use Hiren 10.4 and boot into the MiniXP. It boots pretty quickly and works like a charm. With the MiniXP, I run Dr. Web (Included on Hiren) and it clears out the majority of the infections. Then I enable the network shares with the useful network function on the desktop. Then I connect into the PC using the c$ network share (preferably from a notebook directly to the infected PC through LAN) and do a full scan with an up-to-date antivirus. I used BitDefender 2010. This finds a few more infections but clears 99% of them and asks what to do with the other 1% if there are any. Generally deleting them isn’t an issue because of what I plan next.

Once I have checked through everything, I do a Windows XP Repair to fix and/or replace damaged files. Thereafter, ensuring the BitDefender Client Security was updated to the newest version (Which includes a forced USB scan WMI script that is amazing) and that it has been set up correctly. Then it is just a case of repairing a few installations of applications (Nero, Pastel, Office) and all works wonderfully again.

The catch comes in that you have to make 100% sure the computer is clean before reattaching it to a network. If any PC on the network has even one infection of either, you have to redo the entire network within 48 hours. If you work for schools, use school holidays to your advantage. 4-5 hours at each machine generally works beautifully. If you have multiple machines that are almost identical, Hiren does have cloning software.

Recap:
1) Hiren 10.4 (One released each month so it might be on 10.6 now. Newer is generally better)
2) MiniXP
3) Dr. Web full scan
4) Enable Network in MiniXP
5) Scan remotely with updated decent antivirus (BitDefender, Kasperski. Norton is NOT decent)
6) Repair Windows
7) Check Antivirus and Firewall installed correctly and up to date
8) Repair any applications that won’t work
9) Attach to clean network

And it is that simple.

I hope this alternative helps some people. It couples together many of the various other ideas on the website above and I have had a 90% success rate with most virus infections, not just Virtob/Virut or Mabezat.

One last thing to watch out for, one of the telltale signs you have a serious problem is that when Login in, before you get to a desktop it logs you back out. This is a problem with the registry (HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\UserInit should read “C:\WINDOWS\system32\userinit.exe,” without quotes) and/or the userinit.exe file in %systemroot%\System32. If someone manages to login but doesn’t get icons and start bar, Explorer.exe and/or Explorer.scf are corrupt. You might also want to check the Shell entry under the same key of the registry above. It should read “Explorer.exe” without quotes.

]]> By: Blakey http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-204187 Blakey Sun, 18 Apr 2010 20:27:44 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-204187 BIG BRAINS WANTED: Please if you are a super smart geek please help me find a way to use windbg.exe (microsoft file via filestube) to reset the Kernel. Win32 VIRUT patches the Kernel, (IMO) and this makes it imposable to delete/fix. Help us use a Kernel Debugger and prevent this evil crap fuck of a patching virus from repatching our Kernel on every reboot. To find WinDbg.exe: Google " Filestube WinDbg_20v6.6.07.5.exe" - to download a legit copy of MicroSoft's WinDbg Kernel Debugger. Questions I have are: In WinDbg.exe, I will use command, ‘!chkimg -f nt’, without quotes, and need to know if "symbols are required for this action? Symbols are data sets for the debugger, and are like 650Mb. Are they needed for an !chkimg command? Is there a way to run WinDbg.exe in DOS before WinXP boots up? If so, How? You see, I know alot, but I'm also missing basic PC programming fundamentals. HELP US!!! I KNOW THIS WILL WORK, I JUST DON'T KNOW HOW TO IMPLEMENT THE PROCEDURES. REFORMATTING IS NOT AN OPTION, IT"S FAILURE! HELP US BRAINIACS!!!! Nerds Unite! Blakey BIG BRAINS WANTED:
Please if you are a super smart geek please help me find a way to use windbg.exe (microsoft file via filestube) to reset the Kernel.
Win32 VIRUT patches the Kernel, (IMO) and this makes it imposable to delete/fix. Help us use a Kernel Debugger and prevent this evil crap fuck of a patching virus from repatching our Kernel on every reboot.

To find WinDbg.exe: Google ” Filestube WinDbg_20v6.6.07.5.exe” – to download a legit copy of MicroSoft’s WinDbg Kernel Debugger.

Questions I have are:
In WinDbg.exe, I will use command, ‘!chkimg -f nt’, without quotes,
and need to know if “symbols are required for this action? Symbols are data sets for the debugger, and are like 650Mb.
Are they needed for an !chkimg command?

Is there a way to run WinDbg.exe in DOS before WinXP boots up? If so, How?

You see, I know alot, but I’m also missing basic PC programming fundamentals. HELP US!!!
I KNOW THIS WILL WORK, I JUST DON’T KNOW HOW TO IMPLEMENT THE PROCEDURES.

REFORMATTING IS NOT AN OPTION, IT”S FAILURE!
HELP US BRAINIACS!!!!
Nerds Unite!

Blakey

]]> By: P*ssed off Teenager http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-203246 P*ssed off Teenager Wed, 07 Apr 2010 09:09:32 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-203246 GUYSS hello. Basically, i have the same problem with my brothers computer - i tried to download a PC game from an internet site. [yesterday.] Once the file had finished downloading, the computer immediately detected it, and shut off, with a warning screen. Turning the computer back on, I realised something was wrong when three links to porno sites had shown up on the computer. i deleted them, and the file that i originally downloaded, emptied the recycle bin, and hoped it ended at that. However, this morning, my brother told me the links had returned to his desktop. I ran a system scan, and yes, the computer detected several different viruses, but said i had to PAY TO ACTIVATE THE SCANNER. SO I COULD NOT REMOVE THE VIRUS. or malware, whatever the heck they are. now, for some reason, i cannot open internet explorer on the computer anymore, so either its been moved, removed, or infected. The virus had five parts to it, but i could delete the first four, but left me with one which i could not access, because 'the file was in use'. Someone mentioned that there are multiple instances - they are correct. They were named VT_1, VT_2 ... Im actually really annoyed, i cannot get rid of this virus and i cannot download any virus scanner because the internet explorer is gone. HELP. GUYSS hello.
Basically, i have the same problem with my brothers computer – i tried to download a PC game from an internet site. [yesterday.]
Once the file had finished downloading, the computer immediately detected it, and shut off, with a warning screen. Turning the computer back on, I realised something was wrong when three links to porno sites had shown up on the computer. i deleted them, and the file that i originally downloaded, emptied the recycle bin, and hoped it ended at that.
However, this morning, my brother told me the links had returned to his desktop. I ran a system scan, and yes, the computer detected several different viruses, but said i had to PAY TO ACTIVATE THE SCANNER. SO I COULD NOT REMOVE THE VIRUS. or malware, whatever the heck they are. now, for some reason, i cannot open internet explorer on the computer anymore, so either its been moved, removed, or infected.
The virus had five parts to it, but i could delete the first four, but left me with one which i could not access, because ‘the file was in use’. Someone mentioned that there are multiple instances – they are correct. They were named VT_1, VT_2 …
Im actually really annoyed, i cannot get rid of this virus and i cannot download any virus scanner because the internet explorer is gone.
HELP.

]]> By: Win32 Virtob/Virut removal « Klikdids' Blog http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-202983 Win32 Virtob/Virut removal « Klikdids' Blog Sat, 03 Apr 2010 03:31:18 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-202983 [...] http://www.hm2k.com [...] [...] http://www.hm2k.com [...]

]]> By: jim http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-183608 jim Sat, 24 Oct 2009 01:52:02 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-183608 I found TRUE information here: http://www.jeann2.com/blog/index.php?post_id=154 The article does not advertise any AV, i believe this guy is fighting against it. One good point i did not find in any other site: he proved the virus self installed in the master boot record. I found TRUE information here: http://www.jeann2.com/blog/index.php?post_id=154
The article does not advertise any AV, i believe this guy is fighting against it.
One good point i did not find in any other site: he proved the virus self installed in the master boot record.

]]> By: simon http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-182706 simon Sat, 17 Oct 2009 22:40:01 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-182706 Hi all For the last week i have been dealing with this Virut and what a nightmare it has been. Previously decided to follow a sequence of anti virus programs...1. Malwarebytes, 2. Superantispware,3. Combo fix, 4. Root repeal, 5. Mgtools. All free downloads. 1 and 2 went ok but when i got to installing 3 it informed me the virut had infected set up file. So here i am about to try the advise on this page. Normally I would just format and carry on but it is not my computer and there is alot of personal programs and data. Fingers crossed, will let you know of progress. Learning alot!!!!!! PS. This was virus was originally downloaded as a Heur virus i beleive. Hi all

For the last week i have been dealing with this Virut and what a nightmare it has been. Previously decided to follow a sequence of anti virus programs…1. Malwarebytes, 2. Superantispware,3. Combo fix, 4. Root repeal, 5. Mgtools. All free downloads. 1 and 2 went ok but when i got to installing 3 it informed me the virut had infected set up file. So here i am about to try the advise on this page. Normally I would just format and carry on but it is not my computer and there is alot of personal programs and data. Fingers crossed, will let you know of progress. Learning alot!!!!!!

PS. This was virus was originally downloaded as a Heur virus i beleive.

]]> By: Steven http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-178156 Steven Mon, 14 Sep 2009 16:08:10 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-178156 This will fix the virut virus and you will need to install a 2nd windows on a seperate partition if you dont already have it (dw if you dont want it afterwards just remove it) 1. go to a proxy site then from there go to the avg site to download their virut remover put this in your c drive 2. Run msconfig 3. Change Boot tab to safe boot & alternate shell (doesn't load explorer and leaves it free to repair) 4. Reboot 5. When dos box type "cd c:\" 6. Type "rmvirut (all your drive letters ie: C:\ D:\ etc)" 7. Let it run through. 8. Scan any folder it finds the virut again 9. Then Scan all your windows folders (depends on how many multiboots you have and its pays to have at least 2 with this virus) 10. Lastly Scan C:\windows\explorer.exe (the evil heart of the virus) 11. Then type msconfig 12. Change Boot tab to remove safe boot 13. Reboot 14. Then boot into another boot of windows and open cmd.exe scan everything again paying particular attention to folders with the virus in it All done, can now go to antivirus & mircrosoft websites PS I dont deserve credit for this my mate found/tweaked this fix in the 1st place and I just tweaked it a bit further to help out the noobs This will fix the virut virus and you will need to install a 2nd windows on a seperate partition if you dont already have it (dw if you dont want it afterwards just remove it)

1. go to a proxy site then from there go to the avg site to download their
virut remover put this in your c drive
2. Run msconfig
3. Change Boot tab to safe boot & alternate shell (doesn’t load explorer and
leaves it free to repair)
4. Reboot
5. When dos box type “cd c:\”
6. Type “rmvirut (all your drive letters ie: C:\ D:\ etc)”
7. Let it run through.
8. Scan any folder it finds the virut again
9. Then Scan all your windows folders (depends on how many multiboots you have
and its pays to have at least 2 with this virus)
10. Lastly Scan C:\windows\explorer.exe (the evil heart of the virus)
11. Then type msconfig
12. Change Boot tab to remove safe boot
13. Reboot
14. Then boot into another boot of windows and open cmd.exe scan everything
again paying particular attention to folders with the virus in it

All done, can now go to antivirus & mircrosoft websites

PS I dont deserve credit for this my mate found/tweaked this fix in the 1st place and I just tweaked it a bit further to help out the noobs

]]> By: JsBc http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-177126 JsBc Fri, 04 Sep 2009 04:50:26 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-177126 I really need some quick help here please. I've got this awful virus. Does this work if I have Vista installed on the infected pc? I don't know if bart's pe will work, if not is there something for Vista?. Thanks I really need some quick help here please. I’ve got this awful virus. Does this work if I have Vista installed on the infected pc? I don’t know if bart’s pe will work, if not is there something for Vista?. Thanks

]]> By: Jin kazuma http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-173165 Jin kazuma Wed, 05 Aug 2009 10:01:44 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-173165 I did exactly as you said now my computer wont log on when i log on it syas its missing windows components and just restarts I did exactly as you said now my computer wont log on when i log on it syas its missing windows components and just restarts

]]> By: Gary Osterholt http://labs.phurix.net/posts/win32-virtob-virut-removal/comment-page-1#comment-172801 Gary Osterholt Sat, 01 Aug 2009 05:30:23 +0000 http://www.hm2k.com/posts/win32-virtobvirut-removal#comment-172801 What's the best way to get the virus off an external hard drive with the Virus on it? Thanks Gary What’s the best way to get the virus off an external hard drive with the Virus on it?

Thanks
Gary

]]>