Comments on: XP blank desktop – explorer.exe not loading (virut)

By: nommo

nommo — Tue, 28 Apr 2009 20:09:49 +0000

Cheers for the tips… I had a couple of goes at scanning and fixing using the Dr.Web LiveCD, but the laptop kept going into hibernation and not coming out! Plus most of the files gave back a “write error” rather than “cured” for over 70% of the files it did process before hanging…

Towel thrown in Waiting for the owner to post her OEM XP disc so I can format and start again with a clean platter…

Peaces

By: nommo

nommo — Tue, 28 Apr 2009 20:06:37 +0000

I got the photos off onto a USB flash drive using Ubuntu disc… all clean. (scanned with Avast and Dr.Web CureIt – no results)…

It seemed to have mostly gone for .exe files. Hundreds of them…

By: nommo

nommo — Sun, 26 Apr 2009 12:51:41 +0000

Hi Kevin,

Thanks for dropping by and offering condolences

Yes – sadly it seems like some kind of universal law that you only think of backing up your data (especially photos) once it is seriously threatened. I learned this lesson once myself…

Hopefully I will be able to get a clean backup… I grabbed Dr Web last night after reading some learned people such as yourself rate it highly.

Now I need to get a blank & cheap Flash/HD to back the files up to…

By: JDProuty

JDProuty — Sun, 26 Apr 2009 04:25:03 +0000

Things had been going too well lately. Being between games, I was getting bored. So I downloaded the nastiest virus I could find, W32.Virut.CF. Fought this monster for two days. Threw everything I could find at it, Dr. Web, Malwarebytes, Ad-Aware, Symantec Endpoint Protection and Removal Tool, and AVG’s Remover. Also, keep an eye on your Hosts file and startup programs (msconfig). After all the collateral damage, Vista wouldn’t boot or repair from CD but a System Restore fixed that. Finally, you must repair all your .htm*, asp*, php, and pe files which have iframe lines added to them. I used UltraEdit’s “Replace In Files” command for this. I think I’ve finally got it licked but you never know… Best wishes!

By: Kevin

Kevin — Sun, 26 Apr 2009 00:30:41 +0000

Sorry to hear you were infected with this. The JunkPoly infections found by Avast are a sure sign that the infection is deeply rooted into the computer. JunkPoly is another name for Virut. Also your suspicions of it coming from P2P are most likely accurate. This new variation is spreading via illegal download sites.

Good luck with the photos. I would suggest using Dr Web CureIt to scan them. That is one of the more powerful tools when it comes to Virut. While I’m very bad about backups, I do try to put all of my pictures and important documents on a flash drive “just in case”. Reformatting is one thing but loosing family photos is a whole other heartache.