virus.win32.virut.ce

[mchorev]

Hi,

My computer was infected with a virus, provbably virus.win32.virut.ce, and McAffe wasn't able to remove it. It seems like it has infected svchost ccevent and so on..

Hope you can help me. I'm quite desperate.

Thanks,
Michal

[drongo]

You have a classic virus, avz will not help to cure, moreover it is now infected itself.
Please execute this script in avz:

begin
 QuarantineFile('J:\WINDOWS\fprbhbwj.exe','');
 QuarantineFile('J:\WINDOWS\TEMP\init.exe','');
 QuarantineFile('J:\WINDOWS\bndexcyd.exe','');
 QuarantineFile('J:\WINDOWS\system32\drivers\restore.sys','');
 QuarantineFile('j:\documents and settings\aba\desktop\avz4\avz.exe','');
end.

Please send us quarantine by link http://virusinfo.info/upload_virus_eng.php?tid=40211

Do you have a friend with virus free computer ? It is good idea to write an antivirus scanner on cd, for example cureit(ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe you should unpack to some folder, before write it on cd) or live CD with an antivirus scanner on board.(http://ftp.kaspersky.com/devbuilds/R...escue_2008.iso , ftp://ftp.drweb.com/pub/drweb/livecd/ )

Of cause, antivirus should know exact your virus modification and know to cure, if it doesn't it will not help either.

[mchorev]

Hi,

I sent you the quarantine on Sunday, and ran Kaspersky Rescure disk.
It seems like it pretty much disinfected/deleted anything that was infected by the virus. But I just ran a scan of McAffee on my computer again, and it has warned me about a root script that may be running on my computer,
and that I should switch to safe mode and run the scan from there.
This is what I'm doing now. So far, it seems like the scan didn't find something serious.
What should I do next?

Thanks again,
Michal

[drongo]

Uninstall McAffe after it will finished his scanning. Run in safe mode with fresh cureit, all your hard disks. Download avz in my signature and make a new logs with it.