HM2K

— Just for info for other people finding this —

Dr Web CureIT worked for me whereas the AVG removal tool did not.

Also instead of using BartPE an alternative way to do this is to take out the hard drive from the infected machine and connect it to another computer. From there you can scan it with your own AV software knowing that none of the potentially infected files are in use and therefore unfixable.

To the website creator:
Great site and many thanks. How the feck do you get the time to fix stuff AND do this?
Paul
Alpha PC

I also got infected by doing a “dumb” thing … executing some weird file coming
from a weird source on my home system.
AVG , Avira and other scanners found some of the virtob/Virut variants but only were
doing their “rename/move” or “quarantining” things.
Dr. Web’s “CureIT” did a great job instead , also for my system. Most of the files
(except those with newest variants) reappear clean after a full volume scan.
Insofar the virtob/virut infection is easy to identify since the virus attaches itself
into empty spaces at the end of the executables (in most cases) and redirects the
entry vector to itself, the ending vector of the viral code then points to the original
entry of the host executable.
Because there are many variants around, it is recommended to re-scan a
previously infected system, although even cleaned up with tools, repeatedly,
from time to time as there are post-cleaning detections possible due to continued
signature updates by the scanners as well as for cleaning tools.

My tips are: keep installed virus scanners, Anti Spy- and Anti- Malware programs
updated daily if possible.
A non-updated scanner is like a nonexistent scanner running out of date
very quickly and just consuming system time for no sense.
(Against new infections appearing after the last update,
there won’t be any protection).

Last year I used Dr Cure-it to get rid of w32.virut.w. Had to scan several times to do this because it w32v would move around I guess. This last month I made the mistake of downloading Googols free antispyware (Norton)etc. Guess what? My PC was immediately infected with w32v. This showed up the first scan. On the second scan about 5 more showed up and was eliminated but one of the w32v resisted being deleted or wipe off.

I almost believe that Norton did this deliberately, ie, introduce w32v, to motivate the user to buy their non-free anti-spyware.

ANYWAY AS YOU MIGHT GUESS DR. CURE-IT WAS UNABLE TO GET RID OF IT … EVEN A NEWLY UPDATED ONE!!!

if you know what to do besides reformatting my HD please let me know.

TIA ;=)

Meanwhile I’m going to download an Update of Dr CureIt again and re-scan.

thanks hm2k – i been looking for a solution to this for days and now that other useful info helps with other things too now

for the people who dont have the computer knowledge, unplug your hard drive out of your computer, put it in an external drive or just plug it in on the inside of a non-infected computer, make sure all the antivirus programs are up to date and scan it, especially with the cure-it. then when you plug it back into the original machine, install windows repairing it, then you should be able to install all your other programs
knowing that the possibility you dont have all the programs that are on your computer because most likely source for this bug is from illegal software installations from certain websites and torrents. music downloading included. funny enough that is the easiest way to do it, so hope that could help a little further

Thanks man it worked somewhat to cure w32.virut but too many files were infected and symantec antivirus deleted them before I could recover them via cure it.
Thanks once again.

Alright, I’ve grown extremely frustrated at this point. Considering that the company that sent me my computer did NOT give me a disc of my OS, I pretty much can’t do what you’re saying. As such, would that count as me being fucked? Seriously, I can’t get rid of this damn annoying virus.

virut has a lot of variants dr.web can cure few of them not all

but it.s good to now that there.s some ppl tryin to get a cure for this infection

btw it spreads very fast and once if your pc is infected it pose a threat always

new
it comes through msn

old
it exist for a long long time still no cure and microsoft doesent try to get some firewall protection against this infection
or they can.t

Hi, I was wodnering if someone knows about W32.virut.cf !!! please help me to remove this virus from my system.
Thanks

This is absolutely wonderful, after I let AVG tear the crap out of files until a reinstall of operating system, only to get affected again the moment microsoft’s side let it right back in as always, I was kinda caught either deleting anything in my backup that was executable or just archiving it away and picking out files that weren’t executable. This Dr. Web Scanner actually FIXES the files, not just deletes them. And I wouldn’t have found it if it wasn’t for you. Thank you very very much.

Like many of you who posted here, I’ve been affected by this nasty virus for some time now and it has been a real headache trying to eradicate it from my system. Even though I was able to restore my system to working condition, the virus remained on my system constantly attempting to connect to the internet (luckily my BitDefender Firewall was usually able to block it).

After doing a bit of research, I was able to find and run a series of tools that so far APPEAR to have eradicated the virus from my system. As many of you know this is a very tricky virus that appears to infect everything it touches so try to follow my directions as closely as possible.

Note: My system is running Windows XP Service Pack 3, so those using other operating systems may have to tweak these directions slightly.

1. Firstly, download these free tools from the internet and move them to the infected machine.

Symantec Virut Removal Tool – http://www.softpedia.com/progDownload/W32-Virut-Removal-Tool-Download-121930.html

Dr. Web CureIt Scanner – http://www.freedrweb.com/

ATF Cleaner – http://www.download.com/ATF-Cleaner/3000-18512_4-89432.html?tag=mncol

2. You want to disable System Restore on your computer. This can be done by viewing the System Restore tab in your System Properties. Next you want to disconnect your computer from any network cables it may be connected to. Make sure to disable any means your computer may have of connecting to the internet (such as disabling any wireless network adapters).

3. Start your computer in Safe Mode (login to the account with the highest administrative privileges, of course).

4. You want to open the file DrWeb.exe which you downloaded. As soon as it opens, it will run a quick system scan which won’t take very long (a few minutes). If you are indeed infected with this virus, the scanner will detect some of your infected files during this scan. Allow the scanner to cure/repair the files it finds (on my machine, the virus came up as “Win32.Virut.56”). When the quick scan completes, minimize the Dr. Web scanner for now.

5. THIS IS IMPORTANT: Like I said, this virus can spread onto other computers and devices quite easily, so you want to plug in any removable flash drives or hard drives that may have been connected to the infected computer while it was infected. Make sure you have plenty of time to allow your computer to sit idle while additional scans are performed with these peripherals connected (like 6 hours).

6. If Dr.Web managed to find some of the “Virut” infected files on your machine, you want to now go on to open the file FixVirut.com which you downloaded. It is a tool I found online which was recently released by Symantec to repair files infected by this virus. This tool is quite self-explanatory and simple to use, just run it. It may take a few hours. The tool may ask you to reboot when it finishes, but do not reboot yet(When i ran the tool it found 2700+ infected files on my system, mostly .exe files, and terminated two process threads running in my winlogon.exe file. The tool creates a simple log of infected files within the same folder the tool is run from.)

7. After FixVirut.com finishes running, you want to return to Dr.Web to run a complete system scan. Before you start the complete system scan, enter Dr.Web’s settings configuration (do this by pressing F9, not hard to find) go to the File Types tab and uncheck “Files in archives” (If you leave this setting checked, Dr.Web will take forever unpacking and scanning inside all the archive-type files on your computer. This virus doesn’t appear to attack the CONTENTS of archives in any case. If you think you need it and have the extra time to burn, you can leave it checked).

8. Running the Dr.Web complete virus scan is very important. It will pick up any infected files the Symantec tool may have missed. Also, it picked up a couple of Trojan downloaders and suspicious files I believe were affiliated with this virus. In addition, those connected peripherals that may have been infected as some time will be scanned and cured during this complete scan. Click “Yes to all” the first time this program asks to cure an infected file and it will basically do the rest. Be aware that the scan will pause and ask you what to do if it comes across a file it cannot cure. This entire process will take several hours.

9. When the scan finishes, go through the list of infected and suspicious files. Manually quarantine (move) or delete any suspicious files Dr.Web may have left alone, just to be on the safe side, unless those files are VERY important on your particular computer.

10. Be happy, because most of the hard work is done. When you are done with Dr.Web you can close it and open the ATF-Cleaner.exe file you downloaded. Click “Select All” at the bottom to select every category then click “Empty Selected” to begin the deletion process. This will basically remove all the TEMP files from your computer, which is OK because you really don’t need them. This step may not be necessary but I did it simply as a precaution.

11. Next I went into my systemroot TEMP folder and manually deleted all the files inside. (For me, the file path was “C:\WINNT\Temp”. For others it may be “C:\WINDOWS\TEMP”) Again this may not be necessary, but I did it as a precaution to be on the safe side.

12. And now you’re done. You can run another quick express scan in Dr.Web to double check if you want, but right now your computer should be clean. Restart your computer normally. If you don’t already have one, I recommend getting some sophisticated Antivirus and Firewall software (ie. not Windows Firewall). It was the lack of such software that got me in this mess in the first place.

I hope this information helps some of you clean your computers of this nasty virus. It was by reading a variety of other people’s posts that eventually allowed me to figure out how to get rid of Virut, and stay better protected in the future.

The Dr Web live CD gives me hope but, can someone please tell me how to keep the scanning engine running? I have this running on two systems. The scanning engine runs until the CD drive, or something else decides to sleep. A key stroke or mouse movement awakens the Linux OS but, the Dr Web scan refuses to continue.
Any suggestions?

Very helpful! solved my problem with this post, instead of using a WinPE bootdisk, I booted from a USB live linux (Ubuntu) and installed WINE (to run windows programs) then executed CureIT on the mounted windows volume. Thinking on ditching windows altogether now ; )

Hello, I got infected with Virut when my antivirus was uninstalled. I’m not an expert, I’d say I’m very familiar with computers and Operating systems.

I don’t recall wich version of Virut it was but I can tell you the latest tools (April 2009) and removals didn’t work:

Symantec, Avira, AVG, Trend Micro, Dr web, and a few other tools – All Failed. I kept cleaning the registry and I had system restore off, I even restored windows system files over and over from my other pc, but no luck.

After losing a week over this I decided to take some experts advise (who already had told me I was wasting my time) and backed up my data and formated.

So, what I can tell you is:

All Antivirus companies say Virut risk is LOW but take the experts advise, if you get infected, don’t bother, backup and format.

The only way to remove it is to simultaneously clean all the infected and that’s currently impossible I belieave.

I’ve got some new information about the virus I just picked up while infected with it myself.

Here’s a piece of fun info: Virut infects AVG’s cleanup tool when you run it, it will be picked up by AVG after it :p

Some variants, like the one I have, will do a few things too:

1) Change several policies that make it very difficult, if not impossible, to change specific settings:
a) Disabling Folder Options
b) Allowing hidden files
c) Removing extensions for known types
2) Creates a hidden log file in root with information on files downloaded to your computer and where they are gotten from!
If you can access this log, you will see several lists of links such as (made up) ://64.35.11.562:7000/bababa.exe and a bunch of chinese host redirection services (such as 6688.org). If you can, submit this list to your favored site or as many anti-virus sites as possible and list this as possible sources for the Virut virus. Hopefully we can get some of these hosts blocked!

Also, I found out with the Group Policy editor in Windows XP Pro, you can actually PREVENT reader_s from opening, by adding a policy to disallow the following program names:
*reader_s*
*TEMP/*.exe
*TEMP/*.tmp

Of course this may just impede the virus from going anywhere, you still have the damn thing.

Currently doing a second run on my hard drive to rid of Virut.

I’ve also noticed that it doesn’t just target ran executables but will also find it’s way to executables in the same FOLDER as the ran executable (one example is MSN Messenger: it loaded it with MsgPlus (an addon), but it also targetted the uninstallers for the specific software).

Hopefully we can rid ourselves of this (likely) Chinese pest.

-Paril

I’m a geek, and very experienced with computers. This is the second virus I get, that is annoying to deal with, the first was the famous CIH. Both are masterpieces.

Gabriel: It’s possible to clean this virus.
It’s a very hard work, but it is possible, I have done it in my PC with windows 2003. Took me almost 2 days to fully clean, this past weekend.

This virus is so clever, that it doesn’t let you access any antivirus URL to download any tool, so you have to find another way, like a
Linux Live CD, Bart PE, or an uninfected windows on another drive, partition or folder; it doesn’t infect the boot of the pc or MBR, but once it touches any infected .exe, it starts all over again. In fact, the windows boot is infected only when windows starts, not before that, because it puts some .sys files on \windows\system32\drivers. not outside of windows. If somebody knows better, correct me.
You can install another windows system on the same drive, and then put an antivirus there in the new windows, to start the removal. It’s important to make this with a resident in memory antivirus to work. I had to use avast, because it was the only one that I could download to run on windows 2003, kaspersky and dr web, dont have a way to download their “servers” product. I sent e-mail, but it was a weekend, and nobody answered. On XP it’s possible to try kaspersky kav or kis 2009, or dr web full product. It’s a license problem only.
Once you have the memory resident antivirus that detect it, you can start the removal or cleaning with avptool or dr web.

I had to run Linux Live CD (PClinuxOS MiniME) to download dr web and kaspersky and others antivirus that didn’t work, Bart PE (that is very slow…) and later use AVPTOOL from kaspersky and Dr. Web.
The worst was F-PROT, it never detected anything, making me reinstall and clean everything again, c’mon guys, you were good on old dos days… get yourself together.

The only antivirus programs that clean 100% this virus, that I know are, Dr. Web and Kaspersky. Some others detect but don’t clean it.

It’s very important to say that, RMVIRUT.EXE from AVG, and SYMANTEC free TOOLS to remove it, are from 2007, THEY DON’T WORK ON NEW VARIANTS, they don’t even detect it.

Both have FREE TOOLS that are capable of doing that.
http://avptool.virusinfo.info/en/
http://www.freedrweb.com/download+cureit/

Dr Web Live cd could do the trick too, but I haven’t tried.
I think Kaspersky is a better solution, I trust it more, but it is slower. Kaspersky seems to be the best antivirus out there, now in 2009, you know this things change.
Some files gonna be corrupted, but that’s a minority. if need them rescue the backups made by the antivirus, and try to clean with different tools, or reinstall the programs.

It’s good that this antivirus is very “loud” you notice right away when it infects, because it puts .exes and programs in memory all over the place, otherwise, it could be much more dangerous, but the .exe infection is very fast. I had almost 13000 .exes infected. in few hours.

That’s it. What a painful thing it was 🙂

I dont know who can help. My pc is infected with the win32 Virut. I have tried several times but unable to clean it. My biggest problem is that I have another 2 hard drives connect to my pc which are very important. Anytime I reformat my pc, installed CA Antivirus update it and do a full scan on those harddrive before accessing them. But as soon as I tried installing softwares or programs that asrre saved on them the virus will be back again causing me to reformat again and again. I am now looking for a tool or antivirus that can remove the virus from the hardrives as i have done a full system scan and waiting now

FOUND A SOLUTION THAT WORKED FOR ME.I still can’t believe that all of this big guys Norton, CA and the rest cannot provide a simple removal of virus that was created by a single hacker. It’s really as big shame on Microsoft and this big guys if all exe files that run on windows can be modified easily by this virus which means windows is not safe. Pls before you go ahead with this my simple instruction that help me removed the virus completely from my pc. Copy all you important files and back them up on a removable media be it a flash disk or external hardrive. Do not run any scan with any antivirus program at this moment as you might risk infecting more files. Uninstall you antivirus from your pc as the scanning will corrupt more files. Once you are done backing up your files. Unplug or disconnect from the internet. I must tell you that it’s only Avira that can remove this virus. I have reinstall windows more than 10 times and my pc keep getting infected after I connect my external hardrive which contained my backup files after fully reformating my pc and updating my antiviru. So it’s very useless paying for subscription for an Antivirus software if they cannot protect or clean your pc. A free Avira was able to clean what a paid version of AVG, Kasperky and CA cannot clean. The worst out of the 3 antivirus was CA which get disable automatically after reboting with my external hardrive connect. Here is the simple instruction you dont have to reformat your pc

Download Dr.web cure it (Free)
Avira Antivir (Free)
Win Xp (if your not reformat) which means the damage is not too much

Keep this two files on a clean storage media and make sure you download them from a computer that is not infected with this virus. Write them on a CD or a flash drive that can be locked (readonly) so that the files are not corrupted.

After backing up your important files, do a reformat. Not the quick one but a full reformat. once done with reformating. Or if you feel you dont want to reformat you pc you can now run dwebcureit and let it run to remove the virus from the memory. Now right click on my computer and click on properties, select system restore and turn it off. After that is done, press F9 and file type and click on user masks add .exe to it and unchecked Files in archives apply and click ok and run the scan. Let drwebcure cure the files and delect the ones that cannot be delete. After the scan. Restart in safemode and scan with drwebcure it. Run windows normally and run drwebcureit again following the sames procedure. After the 3rd scan install Avira run a scan with it. You dont have to update it. After the scan with Avira, restart again in safemode and run another scan with avira. The run windows normally, update avira and run another scan. After the scan is done and windows is clean, connect you external or backup drive. DO NOT RUN OR TRY TO OPEN THE EXTERNAL DRIVE. scan all the drives with avira. if some windows files are currupted or missing you can now run Go to Start -> Run, type: sfc /scannow

And that’s all

Step by Step
(1) Download Dr.web cure it (Free)
(2) Avira Antivir (Free)
(3) Win Xp (if your not reformat) which means the damage is not too much
(4) Run drwebcureit (normal windows) to check for virus in memory
(5) Disable system restore
(6) Run drwebcureit (normal windows) full scan
(7) Run drwebcureit (safe mode) full scan
(8) Install Avira and run Avira (normal windows)
(9) Run Avira (safe mode)
(10) Update and run Avira again (Normal windows)
(11) Connect your back up drives and run a scan

Pls if this help you post a comment back to help other. I have battle with this virus for a week now

What about infected backup documents? End up reinfecting windows.

huuuuufff……… thanks alot…….
i’ve been hopeless and helpless for 2 weeks.
thanks again

What’s the best way to get the virus off an external hard drive with the Virus on it?

Thanks
Gary

I really need some quick help here please. I’ve got this awful virus. Does this work if I have Vista installed on the infected pc? I don’t know if bart’s pe will work, if not is there something for Vista?. Thanks

Hi all

For the last week i have been dealing with this Virut and what a nightmare it has been. Previously decided to follow a sequence of anti virus programs…1. Malwarebytes, 2. Superantispware,3. Combo fix, 4. Root repeal, 5. Mgtools. All free downloads. 1 and 2 went ok but when i got to installing 3 it informed me the virut had infected set up file. So here i am about to try the advise on this page. Normally I would just format and carry on but it is not my computer and there is alot of personal programs and data. Fingers crossed, will let you know of progress. Learning alot!!!!!!

PS. This was virus was originally downloaded as a Heur virus i beleive.

BIG BRAINS WANTED:
Please if you are a super smart geek please help me find a way to use windbg.exe (microsoft file via filestube) to reset the Kernel.
Win32 VIRUT patches the Kernel, (IMO) and this makes it imposable to delete/fix. Help us use a Kernel Debugger and prevent this evil crap fuck of a patching virus from repatching our Kernel on every reboot.

To find WinDbg.exe: Google ” Filestube WinDbg_20v6.6.07.5.exe” – to download a legit copy of MicroSoft’s WinDbg Kernel Debugger.

Questions I have are:
In WinDbg.exe, I will use command, ‘!chkimg -f nt’, without quotes,
and need to know if “symbols are required for this action? Symbols are data sets for the debugger, and are like 650Mb.
Are they needed for an !chkimg command?

Is there a way to run WinDbg.exe in DOS before WinXP boots up? If so, How?

You see, I know alot, but I’m also missing basic PC programming fundamentals. HELP US!!!
I KNOW THIS WILL WORK, I JUST DON’T KNOW HOW TO IMPLEMENT THE PROCEDURES.

REFORMATTING IS NOT AN OPTION, IT”S FAILURE!
HELP US BRAINIACS!!!!
Nerds Unite!

Blakey