New Malware/Virus taking out Windows XP?

C

CiscoInside

Gawd
Joined
Mar 26, 2010
Messages
546
We have seen in the past two weeks, on three separate occasions with three different clients, familiar symptoms taking out the PC. Basically, the computer will load to the XP Splash screen, and sit there, will not go any further. Two occasions we cannot even get into safe mode, on the third I was able to get into safe mode but could not get into safe mode with networking.

Is anyone else seeing this popping up? Or ran into this before?
 
Question- are all the pc's identical as far as hardware/software ?
It sounds more to me like a possible software/driver update that the system doesn't like.
 
Have you tried slaving the hard drives to a different computer and running a scan that way?

When was the last time the temp files were cleared out?
When was the last time the swap file was cleared out?
When was the last time the hard drive had chkdsk /f run on it?
When was the last time the drive was defragmented?

Also, I have seen Windows indexing cause strange issues like this. Changed the drive to not use indexing and it fixes weird drive slow/can't boot/lockup errors. It seems like the index file gets corrupted and Windows has a spaz attack when it does.
 
I've been seeing the same thing come up on a few PCs at work. (All different customers.) Replacing all the system32 files from a good known source and doing a repair install has gotten the computer booting for me. From then on it's a regular virus/malware removal. I have seen issues with the event.dll file being infected on a few machines as well... another technician and I have been getting shitstormed the past 2 weeks with nasty nasty infected machines that are difficult, if not almost impossible to clean. (They are business machines and it really is easier to disinfect them than it is to reload everything. You just have to be good at virus removals.) I currently have one on my bench where any software, be it HitmanPro, SUPERAntispyware, Malwarebytes, etc will start to scan and then close 2 seconds later. I've ran antirootkits, externally scanned the drive, Hijackthis, Combofix... can't figure out the problem. Also, once the application crashes, it messes up the .exe of the program and you have to reinstall it. This one is driving me nuts.
 
K guys I am heading to work, I am taking the latest machine I just pulled out of an environment and benching it. Usually we will take the drive out, hook it up via usb to another machine and scan it which is the first thing I will do. I don't want to do a full wipe yet (even though its not a big deal, they have roaming) but I want to find out what this thing is that is doing it.

I will keep you guys updated later when I have it on the bench, @/usr/home interesting that you are running into the same thing.

Lets compare notes later so we can see, @evilsofa I will look at that a little later today at work and see if we can name this damn thing.

Would make A LOT of sense if it was a worm.. @user3657 I am going to try and pull the eventlog to see if it may be related to that.

Thanks guys.
 
Try replacing "userinit.exe" with a good one from a healthy machine of the same service pack level.

Nothing new, some of the malware out there modifies this file and you get the symptoms you have, or....you get to log in...and the very second you log in and the desktop starts to appear...it quickly logs you out again.
 
Sounds good CiscoInside.

If I can't get it it today, I may just reload the client PC :(.
 
We took the HD out and started running a malwarebytes scan. This machine is pretty clean, but the AVG that is on the system that is running the scan is going nuts with these trojans:

VB.AILV - which keeps dumping more trojans. We are going to scan the other machines that are showing the same system, but this does not look good.
 
CiscoInside said:
We took the HD out and started running a malwarebytes scan. This machine is pretty clean, but the AVG that is on the system that is running the scan is going nuts with these trojans:

VB.AILV - which keeps dumping more trojans. We are going to scan the other machines that are showing the same system, but this does not look good.
Click to expand...

I've seen a couple lately with the same issue... I ended up just wiping it, the infection kept coming back.

edit: i didn't see any weird splash screen or anything though, but fake MSE alerts and tons and tons of trojans that wouldn't go away.
 
AVG seems to be finding it? Really?? I'd never guess that AVG would find it over others... lol. I'll try the AVG boot cd here.
 
Okay guys this seems to be worse then I thought. We are now seeing some stuff pointing towards this being a root kit destroying the MBR.

Another machine just popped up with a shit load of MBR errors.
 
user3657 said:
nope, never seen it. We have about 1000 pcs on our network. You sure something wasnt updated, software, anything that is on all 3?
Click to expand...

Same here, 90% of our hundreds of comps still use XP, and I haven't seen anything like that.

It really does sound like a faulty update.
 
Red Falcon said:
Same here, 90% of our hundreds of comps still use XP, and I haven't seen anything like that.

It really does sound like a faulty update.
Click to expand...

Its not an update. Sounds like one, yea, especially due to Microsoft's record of updates breaking machines, but unfortunately its not.
 
CiscoInside said:
Okay guys this seems to be worse then I thought. We are now seeing some stuff pointing towards this being a root kit destroying the MBR.

Another machine just popped up with a shit load of MBR errors.
Click to expand...

Try using Trojan Remover. http://www.simplysup.com/

It can remove and fix stuff that none of the other scanners can.

It is also a pretty quick scanner and is also very verbose about what it finds and asks you about any change it want to make. It tells you exactly what it found, where it found it, what kind of thing it is, etc.

If it is really bad, you may have to run it in safe mode.

As for it messing up the MBR... just boot from an XP install CD, go to the repair console and use FIXMBR.
 
cyclone3d said:
Try using Trojan Remover. http://www.simplysup.com/

It can remove and fix stuff that none of the other scanners can.

It is also a pretty quick scanner and is also very verbose about what it finds and asks you about any change it want to make. It tells you exactly what it found, where it found it, what kind of thing it is, etc.

If it is really bad, you may have to run it in safe mode.

As for it messing up the MBR... just boot from an XP install CD, go to the repair console and use FIXMBR.
Click to expand...

Thanks for the tip on that tool. We did do the fixmbr, but we are trying to find out what virus it is and how it is infecting machines before we fix the next PC, we need to know if this is a worm, etc.
 
You must log in or register to reply here.
Back
Top