Question regarding my neighbor's computer

[Denholm]

It's got a very pesky bug...

Anyways, let me get started explaining the situation. Firstly, the bug will disable the Task Manager in a way that you can only access the, "Applications" tab of the utility and nothing else. The bug also prevents explorer.exe from starting, and if it does manage to start, it only stays up a minute maximum before going offline again. Not a problem though, I can still browse the computer's folders through the task manager's browse feature to launch new processes.

Now this is the interesting part. When my neighbors first got the bug they installed PC Tools Spyware Doctor (Free Version) because they read it was the best. So, I used the utility to see if it could find the bug, or some of the bugs. Well, after the scan finished it found a Virtumonde entry that appeared to have listings of the bug I am encountering. Spy Doctor reported that Virtumonde was embedded into WinMgmt.exe and some other critical OS processes making it impossible to not boot the virus (Yup, even from safe mode) to get rid of it. UNFORTUNATELY it was the free version, and the utility would not remove the bug. Afterward we waited (was late that evening) and the next day I returned with a flash drive and a copy of VundoFix.exe. This utility will supposedly find and eliminate the Vundo virus (Virtumonde is a form of the Vundo Virus.)

When I launched the VundoFix.exe utility, it returned an error:

Run-time error '-2147023174 (80070706ba)';

System Error &H800706BA (-2147023174). The RPC server is unavailable.

Alright, no big deal, I'll just start the RPC server / service. *Caugh* WRONG! Well, surprise surprise. The virus restructured itself. Now the services can no longer be accessed, instead this error is returned:

Unable to open service control manager database on .

Error 1307: This security ID may not be assigned as the owner of this object.

Well, I'm logged in as the administrator, so this is strange. Well, I carry on and attempt to run an online scan with NOD32 or the OneCare safety scan. Unfortunately, neither firefox nor Internet Explorer manage to connect to websites. So I check the connections panel. Well, that doesn't load. So I decide to download the trial version of NOD32 and Ad-Aware 2008 to install onto the system. Well, I stick in the flash drive and upon attempting to install the Antivirus another error is returned that the Windows Installer Service is offline and can't be reached. That's just great, since I can't access the services of the system to activate any of these crucial services. So obviously installing bug removal software is out of the question.

This virus just has me beat. I'm going to try one more thing, which is the last idea I have before giving up and suggesting a reformat. My question is in regards to this virus. Can anyone suggest something that will unlock the services and Internet so that I can launch the Windows Installer service and access the web to get the latest security definitions? Or does anyone else agree with me and think this is a lost cause?


A side-note. Could the hard-drive jumper setting have anything to do with this? I managed to forget which slot it was in when I took it out to set the hard-drive as slave so that I could scan it on a different system (No, that other computer did not get infected.) The reason I'm asking, when I set the jumper as primary the dell BIOS doesn't recognize the Hard Drive. However when I pull the jumper out, set it as CS, or set it in a slot without a label, the BIOS picks it up and boots without a hitch. There's one jumper setting that I have not tried out yet. It's labeled PM2.

Anyways... Thanks in advance for any assistance. Been battling this sucker for quite some time now.

[Fulmar]

Honestly, the three times I've had viruses on my main machines in 8 years (both my fault and others using it), I generally just end up saying 'F it' if I cannot remove the virus within say 30 minutes.  I back up what I haven't backed up before (backing up files is a religion to me) and I format.  I generally format about once a year and the infrequency I have with virus problems, I don't lose too much sleep.

I find comfort in knowing I'm just wiping the slate clean.  I'd rather not spend X hours trying to find where its embedded and trying to remove all of it only to find out that I didn't get all of it and its back with a vengeance.

[Denholm]

I'm at about the point where I am going to suggest reformatting. However I have a nag for negotiating situations instead of nuking them.

[Fulmar]

I'm at about the point where I am going to suggest reformatting. However I have a nag for negotiating situations instead of nuking them.

[TilDeath]

Try NOD32 from eset. www.eset.com  Get the whole suite.  IF your running another AV, Firewall etc disable them.  There is a 30day full working trial version.  Usually catches anything before getting onto a system (the suite).  It should fix your current situation, but I cant say for sure.

[llama]

+1 for "Don't spend more than 30 minutes on it" advice.

When I'm not writing for a magazine, I'm a professional computer consultant. I clean off about 10 computers a month, and lately I've been encountering more and more machines that just can't reliably be cleaned from the infected machines themselves. I can usually pull the drive and use another machine to clean it to the point where it can run antivirus and antispyware utilities on its own again, and then have a reasonable chance of success against whatever's on it, but even that is no guarantee. And even then, it takes 3 or 4 hours of work.

In less time, I can usually connect another hard drive, boot with a Linux LiveCD, pull off any data files, erase the hard drive (or even better, install a fresh one - these things are usually 3 or 4 years old anyway, and 5 years is an average HD lifespan) and reinstall windows (or use the vendor's restore CD), and copy the data files back, and the result is a guaranteed clean system. With a new hard drive (that's probably lots faster than the original), the resulting machine is faster too.

And it costs the client less overall.

-Llama

[Getback]

I've noticed that particular bug is listed on the Spybot program.

[Denholm]

Try NOD32 from eset. www.eset.com  Get the whole suite.  IF your running another AV, Firewall etc disable them.  There is a 30day full working trial version.  Usually catches anything before getting onto a system (the suite).  It should fix your current situation, but I cant say for sure.

*Slams forehead into desk, three times*

I tried that.... As I mentioned, Windows Installer won't start, so I can't install the darn thing. Thanks anyways.

Thanks for the info Llama. I did try something you mentioned, before you mentioned it. I pulled out the disk, stuck it into another system, scanned the infected hard drive, and quarantined any infected files found. However when I took out the infected hard drive and stuck it back into it's case the darn thing took 20 minutes to start up. I'm guessing it's because the windows OS processes are looking for the infected files and it's overloading the processor. So afterward I restored the infected files in hopes of getting the computer to run without such a horrible processor hit. Well, then it restructured itself and now the system is locked down.

GetBack, could I get a link to what you're mentioning?

[Getback]

http://www.download.com/Spybot-Search-amp-Destroy/3000-8022_4-10122137.html?tag=mncol;pop

It's located on many sites but I trust cnet.

Best of luck and hope it does the trick.

[Denholm]

Oooh, I misunderstood something. Spybot is already on that system, but it never picked up the bug.

[Getback]

Oooh, I misunderstood something. Spybot is already on that system, but it never picked up the bug.

Is it updated? You may want to try avast. When installed it runs prior to booting windows.

[Fulmar]

Sorry I'm no real help

[TilDeath]

*Slams forehead into desk, three times*

I tried that.... As I mentioned, Windows Installer won't start, so I can't install the darn thing. Thanks anyways.

Thanks for the info Llama. I did try something you mentioned, before you mentioned it. I pulled out the disk, stuck it into another system, scanned the infected hard drive, and quarantined any infected files found. However when I took out the infected hard drive and stuck it back into it's case the darn thing took 20 minutes to start up. I'm guessing it's because the windows OS processes are looking for the infected files and it's overloading the processor. So afterward I restored the infected files in hopes of getting the computer to run without such a horrible processor hit. Well, then it restructured itself and now the system is locked down.

GetBack, could I get a link to what you're mentioning?

You can install an AV on a USB drive, pull the drive and put it as a 2nd drive on another machine.... go into BIOS and have the machine boot from USB stick with an AV on it...

[Denholm]

Okay. So let me make sure I have this correct so that I don't make errors.

I'm going to install NOD32 onto the removable drive, no special folders? So just straight to the E:\ drive? Want to make sure I get this right the first time. And when it boots, do I have to do anything other than tell the BIOS to boot off the USB stick? Or will the AV automatically start scanning?

[Dragon]

(Image removed from quote.)

Sorry I'm no real help

I'm with Fulmar.  Time for a new hard drive.