Virus eating my bandwidth!!

Try download the Avira AntiVir Rescue System, burning it to a CD / DVD and booting off it.

It's based off a Linux distro, so it runs independently of Windows. If it comes up in German, just click on the flag to change it to English. Also, make sure to change the options to actually remove / rename any infected files.

After your system is clean, hopefully you can boot in to Windows again and secure it. I recommend one of the following:

1) ESET Smart Security 5

2) ESET Smart Security 4 Business Edition

3) Comodo Internet Security

Also install Windows service packs / security updates, and update other commonly exploited software such as Adobe Acrobat / Flash, Java, Quicktime etc.
 
LightningSux said:
Try download the Avira AntiVir Rescue System, burning it to a CD / DVD and booting off it.

It's based off a Linux distro, so it runs independently of Windows. If it comes up in German, just click on the flag to change it to English. Also, make sure to change the options to actually remove / rename any infected files.

After your system is clean, hopefully you can boot in to Windows again and secure it. I recommend one of the following:

1) ESET Smart Security 5

2) ESET Smart Security 4 Business Edition

3) Comodo Internet Security

Also install Windows service packs / security updates, and update other commonly exploited software such as Adobe Acrobat / Flash, Java, Quicktime etc.
Click to expand...

And then see your PC chocking like an old drain.
I say, format. Make a clean cut and start fresh.



Sent from my Desire HD using MyBroadband Android App
 
sometimes something simple like control panel > recovery, and then restoring an "other" recovery point prior to when you first noticed the malfunction saves loads of effort
 
Last edited:
Thanks guys. Thisgeek, it was mortoworm after all, in an exe called svchost.exe in a few suspect folders, which I could only really detect after take the hdd out (thx gdiza). Combofix unfortunately does not run on servers.

Note to self: keep OS updated...
 
Last edited:
LightningSux said:
Try download the Avira AntiVir Rescue System, burning it to a CD / DVD and booting off it.

It's based off a Linux distro, so it runs independently of Windows. If it comes up in German, just click on the flag to change it to English. Also, make sure to change the options to actually remove / rename any infected files.

After your system is clean, hopefully you can boot in to Windows again and secure it. I recommend one of the following:

1) ESET Smart Security 5

2) ESET Smart Security 4 Business Edition

3) Comodo Internet Security

Also install Windows service packs / security updates, and update other commonly exploited software such as Adobe Acrobat / Flash, Java, Quicktime etc.
Click to expand...

Good to know, so there *is* a use for linux? :D Ok, easy tigers just kidding :)
 
System restore to the date just before it started. Usually fixes all issues with viruses.
 
It's back! I've cleaned the HDD totally with:
- ESET
- ClamAV
- AVG
- Malware Bytes
- MS's malicious tool

Put it back online and bam it's still sending out tonnes. The main culprit is svchost.exe in c:\windows\Offline Web Pages. I've put it in suspended mode with Process Explorer, but there's still trickle going out, but stops abruptly when I touch the keyboard or mouse.

Wow this is one sneaky bastiid. Windows 2003 SB firewall only blocks incoming connections as far as I can see. Besides I've read once the worm is active it will manipulate the firewall. So useless.

I can't find a third party firewall that works on Windows 2003 SBS ??

Any suggestions? Please don't make me format, please please please.
 
Let me give you a tip.

Install the free version of Comodo firewall. Then set it's defense to "paranoid" mode, where if the application's signature is unknown to the Comodo devs, it will be forced into a Sandbox preventing it access to the network. So while it won't clean out your PC for you, at least it will block the traffic, but it will also give you a list of the executable/s.

Now if its SVCHOST.exe causing the trouble, its probably not a normal application but something installed as a service, in which case you just ned to go through the installed services to find the culprit, anything that is not normally there at least.
 
delete all restore points.
turn off restore points

clean virus with proggies

after all is done & clean restart PC. should still be clean. turn on restore points.

IE there won't be any previous restore points on the PC from before you turn it on again..
 
If its a custom virus thats new, no AV scanner will find it. Trust me, to save yourself a lot of trouble just install comodo firewall, it blocks outside and inside threats.

Easy as that. Recover your time :P
 
Taqyon said:
It's back! I've cleaned the HDD totally with:
- ESET
- ClamAV
- AVG
- Malware Bytes
- MS's malicious tool

Put it back online and bam it's still sending out tonnes. The main culprit is svchost.exe in c:\windows\Offline Web Pages. I've put it in suspended mode with Process Explorer, but there's still trickle going out, but stops abruptly when I touch the keyboard or mouse.

Wow this is one sneaky bastiid. Windows 2003 SB firewall only blocks incoming connections as far as I can see. Besides I've read once the worm is active it will manipulate the firewall. So useless.

I can't find a third party firewall that works on Windows 2003 SBS ??

Any suggestions? Please don't make me format, please please please.
Click to expand...


Have you tried Comodo Internet Security with firewall and antivirus?

Srack0verflow said:
well either way you'll be better off cleaning sometime..

why's everyone so scared of format :)
Click to expand...

Cause they have to try find where they have hidden their discs and backup everything.
 
Merenwenrago said:
Cause they have to try find where they have hidden their discs and backup everything.
Click to expand...
heh... i remember when external drives were unheard of technology.
reckon you don't have to buckup everything, just maybe your contacts.. and mail. with gmail these days you dont worry about even that.
 
Last edited:
Srack0verflow said:
heh... i remember when external drives were unheard of technology.
reckon you don't have to buckup everything, just maybe your contacts.. and mail. with gmail these days you dont worry about even that.
Click to expand...

It's not copying the files - that's no trouble at all - it's the intricate little setups of every piece of software installed over the last 3 years. And it's a server, so it's A LOT. Databases, Web Sites, Service Daemons, Windows Config, finding all the drivers of some of the ancient devices again, setting permissions, re-establishing all the desktop connections, all the network routing, VPN setups, the browsers and their configs, then all those updates and reboots, job ticketing software, sheesh it'll take me a day just to list it.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X