Post-wmupdate virus issues: slow file copy, photoshop runtime errors

tygadub · 27 Dec 2011

My computer contracted wmupdate virus the other day and wiped my computer. I system restored and had to run a couple disk checks and eventually managed to get the majority of my files back in order (albeit as hidden folders, which i manually changed back).

However, a few of my programs now won't run properly; for instance when i try to open Google Sketchup it loads but then immediately exits the program. Also, Photoshop throws up a runtime error:

An unexpected and unrecoverable problem has occurred. Photoshop will now exit.

Runtime Error!

Program: C:\Pro...

This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.

I have uninstalled both programs and reinstalled and the errors still occur.

I figure the best thing to do would be to backup my files and reinstall Windows. I dont have enough room on my external hard drive for a complete backup, so i have been trying to copy files from it onto another external hard drive, but when i try to move my files over the copy speed slows down to around 50kb/sec and seemingly freezes.

So i have a dilemma. I can't copy my files, so i can't backup my computer in order to wipe it in order to try and fix it.

Being an architect it just so happens that the two programs i predominantly use are the ones that get shafted! Any advice that could be given to solve my problem would be greatly greatly appreciated.

GianniDPC · 27 Dec 2011

Please do a Hitman Pro and MBAM scan.

Hitman: Home - SurfRight
Mbam: Malwarebytes : Free anti-malware, anti-virus and spyware removal download

And report back if it did find any viruses

Arc · 27 Dec 2011

Download malwarebytes Anti Malware Free edition ... install it, update it, and scan your entire computer. If there is anything malicious , it will detect all, and will kill all.

Then, in order to make your computer completely workable, what you are to do is Repair Install . After that, you are to reinstall the programs like Photoshop etc, which are not working properly now.

EDIT : GianniDPC posted it earlier ... nice suggestion mate :)

tygadub · 27 Dec 2011

Thanks both for your advice. Downloaded and ran Hitman and Mbam, they did both find issues which i deleted.

Upon restart now there are still issues with my external hard drive. When I try to copy files to it now i receive an error stating that it could not find the item:

This is no longer located in G:\. Verify the item's location and try again.

I have tried richcopy to move my files, receiving error

The system cannot find the path specified

Also, i'm not sure if this is relevant but a new folder has appeared in my hard drive containing MPSigStub.exe. Virus-scan on this file suggeests it is clean, but i can't delete it.
As well as this, my files currently on the hard drive appear as empty folders, despite the drive being almost full. Unplugging the power supply and reconnecting seems to fix this, and i think when i try to access error-checking (which fails to load) this causes the files to disappear.

Again, any help greatly appreciated

GianniDPC · 28 Dec 2011

tygadub said:

Thanks both for your advice. Downloaded and ran Hitman and Mbam, they did both find issues which i deleted.

Upon restart now there are still issues with my external hard drive. When I try to copy files to it now i receive an error stating that it could not find the item:

This is no longer located in G:\. Verify the item's location and try again.

I have tried richcopy to move my files, receiving error

The system cannot find the path specified

Also, i'm not sure if this is relevant but a new folder has appeared in my hard drive containing MPSigStub.exe. Virus-scan on this file suggeests it is clean, but i can't delete it.
As well as this, my files currently on the hard drive appear as empty folders, despite the drive being almost full. Unplugging the power supply and reconnecting seems to fix this, and i think when i try to access error-checking (which fails to load) this causes the files to disappear.

Again, any help greatly appreciated

Use the FileAssassin option in Malwarebytes to delete such files :)

tygadub · 28 Dec 2011

Gianni thanks for your advice. I have deleted the MPSigStub folder using File Assassin, and changed my drive from G to F hoping this would solve the problem with file transfer.
Unfortunately my external drive is still unable to copy certain files, again claiming that:

This is no longer located in F:\. Verify the item's location and try again.

I don't quite understand this error, as i'm trying to copy the files to F, so why should they be there?

The guy at PC World today reckons there are still fragments of files that are corrupted from when the virus struck.

Anyway i'm at a loss now, any help appreciated.

Jacee · 28 Dec 2011

MPSigStub.exe is related to Windows Defender.
Please be aware of this infection and change ALL your passwords, using a non infected machine!

How Dangerous is wmupdate.exe Infection
This infection will change your registry settings and other important windows system files. If wmupdate.exe is not removed it can cause a complete computer crash.
Some wmupdate.exe infections contain trojan and keyloggers which can be used to steal sensitive data like passwords, credit card, bank account information etc. So it is very important to remove wmupdate.exe as early as possible before it steals your information. wmupdate.exe Virus will display numerous fake infections of exaggerated security threats on your computer and then state that you should purchase the program in order to remove the infections. Do not trust the warnings shown by wmupdate.exe.

GianniDPC · 29 Dec 2011

You can try this: Anti-rootkit utility TDSSKiller

I also recommend Combofix in this case: http://www.bleepingcomputer.com/comb...o-use-combofix here is a Tutorial. Good luck :)

Golden · 29 Dec 2011

GianniDPC said:

I also recommend Combofix in this case: A guide and tutorial on using ComboFix here is a Tutorial. Good luck :)

This is bad advice. Do NOT attempt ComboFix without instructions & guidance from a trained malware removal specialist - the software is far too powerful, and dangerous in untrained hands, to use without professional help.

Regards,
Golden

GianniDPC · 29 Dec 2011

Golden said:

GianniDPC said:

I also recommend Combofix in this case: A guide and tutorial on using ComboFix here is a Tutorial. Good luck :)

This is bad advice. Do NOT attempt ComboFix without instructions & guidance from a trained malware removal specialist - the software is far too powerful, and dangerous in untrained hands, to use without professional help.

Regards,
Golden

But he has the instructions from the TUT