XP Virus Need some help

D

drozenski

Limp Gawd
Joined
Mar 9, 2003
Messages
506
I have a client that droped off his laptop. I've been working at it for about a day now. He came in complaining about some virus and said he wanted it cleaned off. No reformat. He was very adamit about that.

So here is the situation.

I took the drive out and scanned it with mine. Removed a little over 200 Virus's about 7-10 diffrent ones. Also removed about 20 adware infections.

Still have infections on files that can not be removed.
e:\WINDOWS\system32\drivers\atapi.sys ( Backdoor.Tidserv!inf )
e:\WINDOWS\system32\dunulaju.dll ( Trojan.vundo )

I have the users password but not the admins password so i can not get into the recovery console

When i boot into UBCD it blue screens with the Stop: 0x0000007B error code

When i boot normal into windows or windows safe mode it lets me log in for a split second then logs me out.


Any one have any ideas?
 
Boot into Safe Mode with Command Line and run sfc /scannow with the XP disk in the drive.
I'm not sure if sfc is in Safe Mode or not. If it's not- you'll need to get the Administrator password (Call the guy or just use OPHCrack to discover it) and use Recovery Console or something...

sfc /scannow will scan all the Windows system files- and if they're corrupted (like your two examples) it'll replace them.


All that said- what tools did you use?
I'd run MalwareBytes and Avira, MSE, or NOD32 on that drive. Then use sfc /scannow to replace all the rest of the files.

If that works- you're in business.
 
The customer also needs to know that no anti-malware tool is 100%.

System really cannot be trusted after such an infection. I wouldn't put my data on it.
 
TechieSooner said:
Boot into Safe Mode with Command Line and run sfc /scannow with the XP disk in the drive.
I'm not sure if sfc is in Safe Mode or not. If it's not- you'll need to get the Administrator password (Call the guy or just use OPHCrack to discover it) and use Recovery Console or something...

sfc /scannow will scan all the Windows system files- and if they're corrupted (like your two examples) it'll replace them.


All that said- what tools did you use?
I'd run MalwareBytes and Avira, MSE, or NOD32 on that drive. Then use sfc /scannow to replace all the rest of the files.

If that works- you're in business.
Click to expand...

No go on safe mode with command promt. Regular safe mode works. Command prompt blue screens.

So far i have used. Symantec Endpoint, Nod32, Malware Bytes, SPS&D, and Prevx
 
drozenski said:
No go on safe mode with command promt. Regular safe mode works. Command prompt blue screens.

So far i have used. Symantec Endpoint, Nod32, Malware Bytes, SPS&D, and Prevx
Click to expand...

You've got the tools covered then :D

You can still run sfc within regular safemode. Go ahead and try it. It *should* fix your problem, depending on what malware is still lingering around.


And again- I'd tell the guy that you'd never personally trust it.
 
Whether the customer wants a reinstall or not should not be his choice - tell him if he wants it clean, it's a data backup and reinstall. The atapi.sys file, if removed w/ your tools, will cause the system not to boot.

That's my 2 cents. Sounds to me like the laptop OS is pretty infected and damaged. The amount of time you will spend recovering this system, plus it's performance will possibly be poor even after a full removal, does not make it worth the effort. It will save you so much time to do the data backup and reinstall.

If he refuses, charge him like $300 to do the removal :)
 
It's the customers machine- so yes, it's the customer's choice.

But as I said, you just have to give the customer his options... Removal might work, but nothing is 100% and I might spend more time removing than reinstalling Windows, and even at that: I'd never trust it again.

Regardless though- my suggestion should repair those files you're having problems with. I'd just NEVER put my data on a machine that's been that infested.
 
It's the customer's choice to not want a format, it's your choice if you want to work with your hands tied. If I scan a system that has that much shit on it I call the customer before I remove anything and tell him what I think is best. If I think it needs a format and fresh install I tell them, if they jump up and down and say no I say "take your system back as is and bring it to somebody else". I don't care, when I know that cleaning it is not going to remove 100% of the malware and the system can't be trusted i'm not wasting my time or their money to prove my point.

I've said it a million times in posts around here, if you clean a system and give it back when you're not sure or have a bad feeling about it then expect a phone call and a whining person on the other end. Also be prepared to lose more money fixing it a second time on the arm because malware is still lingering or the OS is corrupted from the first time.
 
From normal mode run Combofix it will fix that atapi.sys file for ya. Fixed a machine 2 weeks ago with CF, Malwarebytes found some stuff but couldn't fix that one file and wouldn't find it either.
 
You must log in or register to reply here.
Back
Top