A virus killed my computer. I could use some help!

Might as well tell the story from the beginning.

A couple days ago I was visting a webcomic site. I have a few favourites and I tend to check them daily. Teatimer from Spybot S&D piped up with a warning. It had something to do with "flash32" and the registry. I didn't know what it was so I hit "denied" . Today the problems started. I noticed that the computer was getting a bit unstable, games would behave strangely. My music player would sometimes hiss and pop for no reason I could find.

And then firefox crashed on me. This wass the first crash I ever had from firefox since my last install of windows. I pulled up Spybot S&D, updated and did a full scan. It picked up 2 entriedsoth Virtumonde.sci However it did not pick them up properly. Instead there was an error message beside each, something about a list and it being truncated or a similar problem. My first act was to search on the web to learn what this was. Firefox then started to repeatedly crash. MY next act was to plug in a USB stick and backup the saves of a game I was playing recently.

Before I could even remove the USB stick my computer crashed. BSOD, PFN List Corrupt. When the computer booted up it loaded windows, but now my keyboard and mouse are no longer recognized. They do not even recieve power from the computer. I then tried to load up safe mode. The first attempt seemed to stall and then the computer reset. The second attempt suceeded in getting into safe mode. THe mouse and keyboard worked perfectly in safe mode.

The first thing I did was plug in the USB stick to see if the saves were intact, they seemed to be fine. I immediatly yanked out the USB drive. Windows then popped up with a message that a file write operation to Drive :F had failed. This made my blood run cold, this drive has all my backups on it and something on the computer was trying to write to it! Maybe it already had, I have no way of knowing. I loaded up system restore and restored the computer to a save point I had made several days ago. The system restored without incident, but when I loaded up windows my keyboard and mouse still do not function.

---

I can't even begin to express how stressed out I am over this problem. I have no idea where to even begin fixing it, or if it is possible at all. If anyone can help me answer these questions your aid would be very appreciated:

- How can I recover keyboard and mouse support outside of safe mode?

- How do I get rid of Virtumonde.sci?

- Is there any possible hope of bringing my computer back to a working state?

- Would it be safe to recover files such as music and other savegames from the hard drives. Or should they be considered wholly tainted and deleted as a whole?

- Is my backup USB stick now unsafe to use?

- What can I do to make my computer as bulletproof as possibly so this doesn't happen again?

72,021 views 21 replies
Reply #1 Top

There's a good malware removal tool that beats Spybots S&D in many cases.  The website is Malwarebytes

Download the free version and run mbam-setup.  Do a quick scan first and repair what it finds.  Then do a full scan.

Once done, scan again with Spybots S&D since it seems to be able to detect the problem.  Also scan with your anti-virus program.

Scan your flash drive after you've cleaned your computer.

Best of luck.

Reply #2 Top

yes do what he says

also just to be sure do a file name (Virtumonde.sci) search in your directories and other stuff just to be sure, I have found things that way the malware removal progran could not find  and deleted it manualy

Reply #3 Top

THe problem I have to begin with is that to install and or update anything I have to be able to log into windows. But if I do a normal startup instead of a safe mode startup I have no mouse and keyboard control at all. What could have caused this problem? If it was the virus then it must have damaged or destroyed something.

Reply #4 Top

Yeah, it seems pretty trashed. To be safe I would forget about your saved files and wipe them out. Re-format your usb drive in safe mode to be sure the virus is gone if there even is one. It might not be on there, but better safe than sorry. Run scans from different virus and spyware programs to see if they can take care of the problem, also see is there are any removal tools that were made specifficaly for this problem. If none of that works, move on to a more painful Option-B. If doing a system restore to a previous point would not repair your keyboard and mouse situation, I would just go ahead and do a destructive restore to be safe, there may still be traces of this thing left.  I hope you have a recovery partition? If not, format the c drive and reinstall windows, without a recovery partition this is the absolute safest course of action. I had to do the latter to a friend of mine's computer not too long ago because a whole bunch of viruses completely butchered her system. Since the computer was outdated and did not come with a partitioned hd, and also since she did not know how to make a partition since she is illiterate, I had to format the drive and reinstall windows and all the drivers from scratch. Yes, this is a royal pain in the a** and is very time consuming, but if nothing else, it is a guaranteed fix. Hopefully it won't come to that though, good luck.

Reply #5 Top

I have all the disks and such I need to perform a nuke and pave on this hard driv. The drive is 250 gbs and windows is intalled on a 60gb partition. THe rest is unused.

Thing is, I have a second hard drive in the computer. Its also 250 and contains almost 60gbs of games. Is there any danger of this hard drive being infected as well? I would really like to avoid downloading over 60 games all over again through Impulse and Steam.

Reply #6 Top

Try to run this special free kasperski antivirus. http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/ it's a special version that's designed to work once and show the power of kaspperski's(best) antivirus engine. this version comes updated and uninstalls itself once finished. please give it a try (try to run it (full scan ofcourse) in safe mode if u have any problems. if you need more help, don't give up..  the way to keep it clean is to have a security suite like norton internet security (amazing efficiancy and super light on cpu and ram(version 2009) or kasperski's full suite. let's see if kasperski can kill them all ... another way to be safe is to use a good backup program (acronis true image is the best and able to boot even without windows (through linux kernell that it can create)and to restore the comp to earlier stage. if you use it, set up a secure zone and do a full backup inside it and you're very safe to be able to restore (at least the next time) hope it helps.

Reply #7 Top

Sorry to hear about your problem, Tamren. 

Here are the links to a couple of free proggies that may take care of it. 

www.atrbune.org/ccount/click.php?id=4

secured2k.home.comcast.net/2...undoBeGone.exe

Run Spybot again to see what it comes up with. There may be a registry entry that hasn't been cleared up. Intall and run Ccleaner to be rid of it.

Sorry I can't provide direct links. I use Firefox, which Stardock doesn't support.

 

 

Reply #8 Top

- How can I recover keyboard and mouse support outside of safe mode?

No way to tell unless we know the exact conditions causing the actual flaw.

- How do I get rid of Virtumonde.sci?

Most anti-virus scans should detect and safely remove it -- unless the tricky stuff goes in by some RootKit tactics; in which case, there are other solutions.

- Is there any possible hope of bringing my computer back to a working state?

Always, if one uses the proper tools and can have access to proper instructions on how to proceed.

- Would it be safe to recover files such as music and other savegames from the hard drives. Or should they be considered wholly tainted and deleted as a whole?

Unless proven otherwise, there's a good chance all of these files are still stable (FAT records and boot sectors and VERY tough to "destroy" by any virus as long as some heuristic system is in place on a machine that also benefits from regular cleansing methods for malwares)... unless, of course, files were re-saved or newly written since the problem(s) started to happen.

- Is my backup USB stick now unsafe to use?

Easily determined, scan the stick itself for odd stuff on it. And, try confirming the OS drivers are still working as expected for the whole USB infra-structure.

- What can I do to make my computer as bulletproof as possibly so this doesn't happen again?

Good, solid recurrent analysis of a system for malware is always a minimal habit to take... AVG_IS does the job for me, other people opinions may differ for the best software out there on www & found by Googgle searches.

 

I'd also recommend a thorough "Hi-Jack-This" scan (nothing else can pinpoint more accurately at registry hacks than IT!) and a followup processing of whatever they'd suggest to do from their web site forums... this tiny program saved many people "lives" with multiple kind of problems; http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Reply #9 Top

Great advice about the Hijackthis. Sorry about your troubles.

Reply #10 Top

Everyone that replied has given you excellent suggestion and recommendation.  You need to take whatever actions are appropriate for your situation.

Once you have everything back to a safe and clean condition free of any virus and malware you then need to look at how you update and add information to you computer.  Unfortunately all the things you can and should do will never eliminate completely the possibility or chance of this ever happening again.

Sad state of affairs for sure.  I'm sure you now have a new appreciation as to the things that can and will happen.  It does and will happen to everyone at some time.  The best you can do is make sure the percentages of it happening to you again are minimal.

Good luck and getting everything back to the way it shuld be.

Reply #11 Top

Malwarebytes saved my ass not long ago - so it is a good recommendation. 

Norton Internet Security 2009 also helped.

Even with that I still decided to reformat and start again with my Windows partition.

I allowed myself to keep my other partitions and drives tho' - after carefully scanning them with every scanner I could find (be careful of the fakes tho' - reputable suppliers only).  However, my other partitions were all "data" partitions that were not used to store programs (and games count as programs).

One other piece of advice that hasn't been given (unless I missed it) is that if you may need to take further steps not directly realted to the machine itself.  The safest thing is to assume the worst and that your account details and passwords are all compromised. That means logging  into every service you use and changing the passwords - from a safe PC.  If you used the machine for financial transactions then you will also need to inform the banks / credit card suppliers etc. that your machine has been infected - they will almost certainly just cancel the cards and issue new ones.  You could take a note of every infection found on the machine and verify that they are the type of infection which tries to steal personal information - but it may be simpler/safer just to assume the worst.

As to staying safe in future:

- a physical firewall built into a router (preferred but a good software firewall if not)

- a software firewall which blocks unauthorised outgoing programs accessing the net

- a good virus checker

- a good malware/spyware blocker

- keep Windows fully up to date

- keep your browser fully up to date

- don't trust any site to install anything on your machine

- regular backups to get you up and running again quicker next time (as someone else said - there is no absolute protection).

I am not going to bother getting into the "which security package is best" argument - its not worth it - check out the review sites, download demos of two or three of the top five and see which you prefer.  I personally picked NIS2009 and, so far, am very happy with it.

Good luck.

 

 

Reply #12 Top

It looks like I am going to have to wipe and start over. But since it runs in safe mode I am hoping to clean it up to the point where I can salvage and store data on my games drive, then reinstall the OS. But if this is really bad and there is a rootkit or something still hiding somewhere would this be a safe idea?

So far I have chosen:

  • AVG free
  • Malwarebytes
  • Spybot S&D
  • Avast

I have a router as a hardware firewall. But one thing I am missing is a software firewall, bar the default windows one which is of course crap. A friend recommended Zonealarm, anyone have any experience with it? My computer is primarily used for games so ease of use would be a big plus.

Reply #13 Top

- don't trust any site to install anything on your machine

I'd stress even further to this excellent advice while adding a slight precision; switch the anything above with the term **something**.

As to trusting any www sites -- with the number of Mirrors out there one is never too careful either, heck even Googgle sets priorities listing of results to 'paid privileges' and normally enforces all my searches into paging through PAGES of junk before i can finally get to the real site sought after.

Impulse is most probably a safe bet, though! :ninja:

 

Reply #14 Top

default windows one which is of course crap

I'll probably get plastered for saying this, but -- it really ISN'T.

Short of having nothing free at all and without extensive options and total control of all firewall'ing features, MS needed to protect their own OS by designing security 'stuff' beyond common knowledge.

The arsenal against 'Malwares' can never be free enough for all connected users of the web if we are to get rid of online criminality.

Besides, i also believe that each and all of our ISP should be held accountable for anything crawling to the pipelines... cuz, we PAY (at 480$/year for a steady continual Bell billings, i'd say!) to be connected on THEIR vulnerable servers.

Reply #15 Top

Impulse is most probably a safe bet, though!

Not necessarily. What a lot of people forget is that you are only ever one click away from disaster:

You browse a forum on here, someone posts a message alonger the lines "Hey, have a look at this site ...." - you click on it - hey, it's Impulse Forums, everyone on there is a good guy.  Bang.  You've installed a "Browser Helper Object" that starts downloading crap to your machine.  The message poster may not even know they are doing it - it could be a hillarious joke page they came across.

I have had some recent bad experiences with ZoneAlarm where is was hogging my machine but these things are often just bad luck - some sofware just doesn't like some machines.  It is easy enough to use and I did use it happily for years before that.

 

Reply #16 Top

Since your a FF user, I'd also reccomend the NoScript addon.  It's rather annoying at first, until you built it's white list.

Even if your AV program has auto-updates, try to force it to check for updates after you start up your computer.  It'll save you heartache when it decides to do it mid-game and it'll also help make sure you are up to date before getting your fingers out in that dirty www.

Oh yeah, and as for pop-ups or ANY suspicious window not even triggered by clicking on a web page, Alt-F4 (close current window) is you're friend.  That way you don't click on it to close the window, yet activate it.

Reply #17 Top

First I must say, if your windows doesn't boot, look for bootable cd from known antivirus programs like Kaspersky, norton etc. Theyre able to boot before windows and perform a cleanup, also check my post above, the free kasperski tool can run in safe mode and has extreemly high success rates

Also see if the Windows restore center has a backup point that was created when all was good.

To avoid the next time go for Acronis true image home (best backup program i know) and remember to set up a "secure zone" after installing it. It can boot before windows via a Linux mini-OS and perform a perfect restore of your backups!

Saved me so many times, 15 minute and all is back as it was!

 

 

Reply #18 Top

Quoting Tamren, reply 12
It looks like I am going to have to wipe and start over. But since it runs in safe mode I am hoping to clean it up to the point where I can salvage and store data on my games drive, then reinstall the OS. But if this is really bad and there is a rootkit or something still hiding somewhere would this be a safe idea?

So far I have chosen:


AVG free
Malwarebytes
Spybot S&D
Avast
I have a router as a hardware firewall. But one thing I am missing is a software firewall, bar the default windows one which is of course crap. A friend recommended Zonealarm, anyone have any experience with it? My computer is primarily used for games so ease of use would be a big plus.

HiJackThis.

Do what the site says to do. Follow instructions fully. Total wipe only if you can't restore files.

Reply #20 Top

Necrothread... ;p

Reply #21 Top

Some 'necrothread' revivals are quite pointless.

It's a pretty fair bet the OP has either solved the issue or has sunk permanently into a swamp somewhere.....after a year...;)