Virus despite new H Drive

  hawthorn59 03:33 16 Sep 2004

I am having terrible trouble at the moment. Norton detected netsky last week and deleted it. Since that i have installed a new HD, and reinstalled XP, but very little else.Was running for 2 days before installing Norton, as PC was running incredibly slow and i was writing to various forums for help.

Today at PC Pitstop Forum I did a test of my PC and it said I had Netsky. Also I d/loaded Stinger and IT discovered and deleted 2 worms and 2 viruses.

And Trend Micro House call discovered 4 more worms/viruses and deleted them. I presume i picked them up in these last 2 days.

But none of them detected Netsky, although Pitstop still does. I wondered if a reformat would be best, but i got a few replies telling me that Netsky could survive a reformat! i quote

"Yes it is. It can make itself undeletable with a reformat, I had one like this last week.

To guarantee its removal, you must use your HD utility disk and write 0s to the HD. Then it will be gone. When you reformat, win only knocks off a few zone bits and technically does not delete the files.

You can do a clean install and have a virus the minute you boot for the first time. Theres also a chance that the virus or virus repair files are hidden in your BIOS program. This is the purpose of 'Dual Bios'. If the Bios are corrupted by a virus, you can load a new clean copy of the Bios program from within BIOS .

So yes, a Virus can also live in your BIOS software."

What I also wonder is could it have survived a new HD being installed?

And more important, what will i do now!!??


  Valvegrid 07:05 16 Sep 2004

I'm not sure how it can survive a reformat of the data part of the disk, but it certainly could lurk in the Master Boot Record sector. Thats why I've got floppy rescue disks courtesy of AVG for this eventuality.

  temp003 07:21 16 Sep 2004

I'm not aware that the Netsky virus attacks or is embedded in the BIOS. Although there are some viruses that do this, they are not that common.

There are a number of ways in which a freshly formatted and reinstalled OS can be infected, especially with XP, before you should conclude that your BIOS has been infected or that there is some virus which can survive a reformat.

You said you had been using XP for 2 days before installing Norton. During those 2 days presumably you were on the internet (writing to various forums). Probably also using email. Your computer was without virus protection for 2 days.

XP also has a lot of security holes which viruses can exploit without your active participation. Even if your CD is XP SP1, there are about 20 critical updates since SP1, many of which are security patches.

If I were you, I would install the Windows updates, update the virus defs, disable System Restore, do a complete scan, remove any detected viruses and see how it goes.

If you want to reformat, before you do that, I suggest you download all critical Windows updates (released since the version of your XP CD) on to your hard disk (if you have broadband), burn them to CD, and after the reinstall of XP, and before you connect to the net, install the updates from the CD. If you're not sure about SP2, download SP1a and the critical updates since SP1. Then install Norton. Update Norton.

  ventanas 08:28 16 Sep 2004

Good advice from temp003. Before I connect any reformated computer to the Internet I always make sure both SP1 and 1a are installed, as well as Norton.

  hawthorn59 02:40 17 Sep 2004

The latest situation is this:

I downloaded AVG and its updates, it found 4 virus/trojans and removed 3 of them, leaving a Trojan Boxed.B virus.

I loaded and ran adaware and Spybot search and destroy, ran AVG again, and no virus showed.

However, Im convinced there is something there still. Occasionally certain web pages wont open, and earlier the pc just hung, and i had to turn it off manually.

Now when I turn on the pc a screen opens (explorer type screen) System 32, showing loads of folders. I simply close it down and continue.

So thats it for now! The pc is running faster now, but occasionally the CPU usage shoots up to 100%.

Thanks all for patience and help so far.


  temp003 10:25 17 Sep 2004

If you've decided to use AVG, that's fine, but make sure you disable Norton from startup, better yet, uninstall it. Norton is very much integrated into Windows, and with XP, you will find that it's integrated into background Windows services. Click Start, Run, type services.msc and press Enter, and you will see Norton Antivirus as a service. Change it to manual. If you have uninstalled it already, ignore the above.

Web pages don't open properly, that can be due to other reasons, not necessarily viruses, and more often than not, it's not viruses.

The System32 folder opening at startup - that is not an uncommon appearance. It can be caused by a number of things. Often it's to do with an incorrect entry in the registry dealing with startup applications - usually the file in the system32 folder that is supposed to be loaded at startup doesn't exist on your computer, so Windows opens up the system32 folder using Explorer. If you have a Creative soundcard, that may be the problem. Search for a fix.

If you don't have a Creative soundcard, it may be caused by an uninstall of a program which had a startup entry; the files have been removed, but the registry startup entry has not. Check your startup applications in msconfig startup tab. Check entries that show the "Command" as an .exe file either within the system32 folder, or with no folder, just the bare .exe file (that is because in XP, for startup, if the exe file has no path, it means it is supposed to be in the system32 folder). Check that the file exists in the system32 folder. If the exe file does not exist in the system32 folder, untick that entry in msconfig, OK, restart, and see if the system32 folder opens up again. Often this problem is not easy to locate. But try anyway.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

OnePlus 5T review: Hands-on

Illustrator Andrés Lozano on his improv line work, brazen use of colours & hand sketching

iPhone X review

Comment envoyer gratuitement des gros fichiers ?