Should i flash my bios to get rid of infection

[vicvic]

Hi all

Need a little advice. Still dealling with the nasty infection. I have done a clean install where i wiped my hard drive for about 4 hours.

I am still dealling with the infection when i place a blank disk in the drive it will type into the start menu. I am a little unsure if it would be suitable to reinstall again and flash my bios or get hackthis logs done

If i should flash my bios how do i do this?

 

[Dark Nova Gamer]

Its extremely unlikely that will do anything to the virus.

 

[vicvic]

ok thats cool over this

hackthis logs then

 

[Zidane24]

You clean installed the OS and the virus is present? What peripherals are attached to your PC?

 

[Dark Nova Gamer]

Have you attached that infect USB each time? A USB doesn't need to auto-run to spread a virus as far as I know. You may need say your farewells to the data on that USB.

 

[Jacee]

Hi all

Need a little advice. Still dealling with the nasty infection. I have done a clean install where i wiped my hard drive for about 4 hours.

I am still dealling with the infection when i place a blank disk in the drive it will type into the start menu. I am a little unsure if it would be suitable to reinstall again and flash my bios or get hackthis logs done

If i should flash my bios how do i do this?

What infection are you dealing with?
Ahh.. never mind, I just read this topic http://www.sevenforums.com/system-security/39816-window-7-infected.html

 

[vicvic]

Sorry just clean installed again and wiped the hard drive using the 7 passes.

The infection runs of usbs and cds. I think i might have reinfected myself as i went through all my disks months ago on another machine that is infected. (i was unaware at the time because i had split water on the keyboard- in the mad rush to back up my data i would have shoved in the usb with the infection on it) It cause you to type backwards and you are unable to select a folder or program without it opening something else. It seems to have written itself on all cds or dvds that are entered my drive as soon as they are entered. I have just marked all my disks as i don't think i will be able to uses them ever again. All that data photo extra gone.

all good fun

 

[vicvic]

no i haven't attached the usb drive yet to scared.

 

[jimbo45]

Hi there

1) ON A DIFFERENT machine write BINARY ZEROS to the USB device - better still just bin it.
(If you can re-write binary zeros on to the usb with a Linux system you'll be OK - do it at step 2 or 3 - the virus won't be able to load on to a "Live CD" OS).

2) on the INFECTED COMPUTER boot up a CD image of GPARTED and WIPE all partitions.

3) If you can get hold of a Linux LIVE CD boot from that and do a secure erase of the entire DISK. -

if you don't want to use linux create a "Bartpe" type of Disk (you need a Windows XP image but look on the Bartpe pages). UCB4WIN also has a bootable CD with "Erase" type tools.

4) Now you should be able to clean install windows.

It's no point using the OS that's infected to get rid of an infection like you've got. You need to load a separate OS from a non writeable media such has a live CD to really cleanse the system.

(Once you've done a clean install -- before installing ANY applications install any drivers you need such as video and then take an image -- you can use this as a restore reference image if you get re-infected - saves re-installing).

You shouldn't lose any data unless the virus has erased it. You can scan your photos etc etc.

Cheers
jimbo.

 

[vicvic]

thanks jim

I have hackthis logs up on beepingcomputer to do with seven system at the moment.

I know i will most likely have to bin the external hard drive, its a wait and see. I can lose most of the data on the drive except the tax returns

the other problem i have is that the infection seems to have attacted itself to every disk i owned because a couple of months ago i checked these disk.


Any idea if the dvd-r might be ok or cd-r - I scanned in all my photo and work a couple of years ago and they are all on these disks. -I have most likely lost it all my school photo, portfolio and a data base of notes with a years worth of work.

The most infurating thing is i work from this computer and can't do any work until this is sorted out. I can't risk logging into my accounts.

Oh well nothing i can do about it at the moment.

One more quick question. I had to install my memory technology device driver. It seems to have uninstalled the intel ich9m Lpc interface controller 2919 and the microsoft acpi compliant system. This is all the infection stuff isn't it

 

[jimbo45]

Hi there
1) DISCONNECT MACHINE FRON NET AND LAN

1) scan the DATA FILES for infection - Disk by disk and copy OK data to brand new CD / DVD -R. After copy when each disk is full FINALIZE it this will stop any further writes to the CD / DVD so clean files won't get infected.

2) once you are happy you have a clean computer with clean HDD's you can then copy your data from the CD's / DVD's you've just made to HD.

3) Now you can re-connect to LAN and net - but scan your machine regularly.

You shouldn't have to "trash" most of your old data files.

(Actually the idea of sending back a Tax return to the tax authorities with a virus in it sounds very appealing - but unless the thought of doing serious jail time doesn't bother you - don't do it).

Cheers
jimbo

 

[vicvic]

thanks Jimbo

i feel better knowing that i might be able to get my data off. I will wait until we work out what it is because scans are not locating anything at all. I just know by the common behaviour across 3 generation of microsoft computers.

I did think just hang onto the harddrive and if i get auditored by the tax office i just say here we go have this but there is a virus on the drive - lol

thanks for the advice

 

[Jacee]

I've read both topics at Bleeping ... One thing I want to ask you, after reformatting and doing a 'clean' install, did you change your passwords? This is very important because whoever or however your machine was infected, most likely knows how to get back into it when you're on the Internet.

If you had Virut, then all your backups of .exe files (during that time) will be infected. Usually this infection doesn't touch your personal pictures or Documents.
It's a buggy file infector so the files can't be disinfected.

 

[Etihtsarom]

Hello,
Do you have a second computer somewhere? If so, secure that computer with HIPS (you can get excellent HIPS from Comodo's IS Suite), you can also use Returnil to fortify your computer, then:
1. Disable autorun on your computer
2. unplug turn all the drives from the infected computer into external drives
3. Plug them into the clean computer, scan them all with your AV, then scan them again with various online scanners. If you need a list of those, let me know.

If the scans do not show any infection, enable autorun, replug those drives and let the HIPS pick out the offenders. Hope it helps and sorry if it confuses you.

 

[frontech]

I don't think so! Repartitioning the hard disk may help?

 

[vicvic]

thank yes the passwords have been changed.

I have 3 computers infected the seven one - newest 2-3 months old, my old laptop with vista on it very infected and an xp desktop which is bsod in the middle of reinstallation it could be hardware as the machine is 5 years old can't run checks on the system at the moment as can't burn the disks.

I am now in wait mode i will do nothing until i hear back from beeping

turning off auto run doesn't work. when you open files on the disk it will infect the computer. It will reactivate auto run so everything placed in the drive will auto run from that point.

It will be worked out

thanks for your help guys

 

[Jacee]

I hope the laptop is not connected to your network or the Internet!

 

[vicvic]

Not that laptop it is turned off. The only one plugged in is the seven machine. It seems to be running ok but one doesn't know with what ever i have

cheers

 

[Jacee]

I've looked at your HJT post (windows 7) and I don't see a problem with the running files

Can you do this for me please ...
Click Start =>Run, type in CMD, press OK.
Copy and paste this into the Command prompt:
netsh winsock reset catalog
Press Enter
Then copy and paste this in:
netsh int ip reset reset.log
Press Enter.
When finished restart your computer.

Also, do this to disinfect your flash drive ...
http://download.bleepingcomputer.com/sUBs/Flash_Disinfector.exe
Next, turn off the Autorun feature in Windows
http://www.howtogeek.com/howto/windo...nd-usb-drives/
*** Note: Be sure to insert your flashdrives before you begin!
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.

 

[vicvic]

hi jacee

I did the cmd thing- little unsure that i should have but is should be ok as they are only internet reset

when i restarted my computer i had to force restart as i have a blank disk in the drive. This is a new disk out of a packet.

Avast was mentioned and it said that identified a disk in the drive, I have never seen this before

I then scanned the disk once restart and have this message. Unsure what it means

Disk D: Boot record unable to scan: The parameter is incorrect

Any ideas