Help me!! Can't remove virus.

[razibhasan]

Hi to all,
A few hours ago a friend of mine came to me because his pen drive was affected by virus and he wasn't been able to kill them.

I have NOD32 on my Windows XP professional OS. I scanned that pen drive but nod32 didn't find any virus in that. But, there were 3 files in that pen drive.

Please look at this screenshot .... http://img235.imageshack.us/im.../20070617223418ue1.png

I have tried to format that drive. But i couldn't. Even I couldn't delete them. So, I tried to delete them after renaming them. I renamed them (just removed the *.exe extension). Then I was able to delete them. However, within a second those files were appearing on that pen drive again and again.

I rebooted my computer and then I couldn't open the task manager it says ... "Task Manager has been disabled by your administrator". But, I am the administrator of my PC (I mean I have the administrator account).

So, I rebooted my PC again and that time I logged on to Windows XP 64 bit edition (note that I have dual boot system). In there I installed Kaspersky Anti-Virus.

Kasper found a Virus in that pen drive and I was successful to delete that virus. Look here --- http://img262.imageshack.us/im.../20070618000408bu4.png

Unfortunately, Kasper couldn't find anything wrong in my XP 32 bit partition.

What can I do now? How can I remove the virus? Or, how can I access task manager again??

Please help me if possible.

Should I have to re-install windows again?

 

[mechBgon]

Hi razibhasan, can you use System Restore to go back to before your other Windows installation got infected? Otherwise, you may want to uninstall NOD32 from the infected Windows installation, then install a 30-day trialware of Kaspersky, configure it for maximum detection in all the areas of the Settings panel, and scan for infection.

Also, this Symantec tool might help you afterwards: http://www.symantec.com/enterp...id=2004-050614-0532-99

One preventive strategy against these "AutoPlay" infections is to use a Limited user account, at least when you are inserting USB drives or burned CDs that came from someone else's computer. If you have Windows XP Professional Edition, you can easily add a Software Restriction Policy on top of the Limited account to further prevent malware from even trying to attack.

 

[razibhasan]

Dear mechBgon,
Thank u for ur response. Sorry to say that System Restore was disabled. So, no way to get back to the previous status. I will soon install Kaspersky and report the result here.

I have tried that symantec tool posted by you. Still now I can't access task manager. However, previously I couldn't access regedit, but now I can access regedit.

And finally, thanks again for your tips about Limited User Account and Software Restriction Policy.

 

[orbiter]

First you could try Trend Micro's online Housecall AV scanner.
http://housecall.trendmicro.com/


If you manage to get rid of the using the above, Avast antivirus for future protection is a good choice, I've used it for years on XP Pro & now Vista and its always protected/detected any problems and on instrution deleted it.
http://www.avast.com/eng/avast_4_home.html


You could also try Heidi's Eraser to get rid of certain files, This is a wiping tool though so you must be careful with it,
http://bbs.heidi.ie/viewtopic....3c037e05733dafd8f3142e

None beta's are also available for XP etc.
http://www.heidi.ie/eraser/