Backup and Pendrive Question

[NotVeryTechie]

Hi there

I hope I am posting in the right place.

I have been doing some work on my sister's computer and she has been badly infected. She has found a worm and it looks as is there is a problem with scvhost. We have been cleaning the computer and using various tools, etc. Problem is we ran a backup to CD just when the problems started and I have also used my usb pen drive on her computer.

1) Will the backup be infected? How do we reload the files in the event of a complete crash without reloading the virus?

2) How do I find out if my pen drive is ok? I have tried various scan options and most of the antivirus software and the online scanner for scvhost don't allow for scanning of usb devises. I also understand that this particular trojan doesn't show up on most virus scans. I really don't want to lose the files on my pen drive and I don't want to infect any other computer. So is it possible that it has written itself into my files? How do I find out?

Hope you can help

[Katana]

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

----------------------------------------------------------------------------------------

Hi NotVeryTechie,

We will need a bit more info before we can answer most of your questions, as it depends on what the infection was/is.


Click here to download HJTinstall.exe

• Save HJTinstall.exe to your desktop.
• Double click on the HJTinstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\Hijack This.
• Click I accept
• Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
• Click Save to save the log file and then the log will open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

[NotVeryTechie]

Hi Katana

Thank you so much for the reply. The thing is that I very seldom get to my sister's computer (the one that is infected). She has posted on this site and will be working with one of you guys to clean up her computer. My problem is that we ran a backup of my photos (which were on my sister's computer) just when things started going wrong and we are worried that there is now a virus on the backup CD. And more importantly, I copied some data and downloads from her computer onto my pen drive just around that time and now I am worried that I am infecting other computers with this pen drive.

I don't know how to run a hijack log of a pen drive (removable usb memory stick) and how to check the CD. I am not at my sister's computer, I am using a friend's.

Thanks again for the help. Hope you can let me know how to check for nasty things on these devices.

[Katana]

Which thread/username is your sisters ?
If I know what infection it is, I can give you better advice.
I don't want you infecting your friends machine

[NotVeryTechie]

Her username is Angelicusblue

[Katana]

Looking at your sisters log, it doesn't look like she has a USB type infection.
Having said that, the infection that is showing is quite an old one so it may have been altered by now.

Depending where the infection came from originally, it is very possible that the backup is infected.

The best thing to do would be as follows
(This may take some time so allow yourself a good two - three hours on your friends machine)

Put the CD into the computer, and insert the USB drive as well.

Kaspersky Online Scanner .

This WILL take a while, because it will scan the CD as well as the USB drive if you follow the instructions below

Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
Go Here http://www.kaspersky.com/kos/eng/partne ... bscan.html

Read the Requirements and limitations before you click Accept.
Allow the ActiveX download if necessary
Once the database has downloaded, click Next.
Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK.
Click on "My Computer" and then put the kettle on!
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.



Deckard's System Scanner (DSS)

Please download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.

1. Close all applications and windows.
2. Double-click on dss.exe to run it, and follow the prompts.
3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

Please post all logs in your reply

[NotVeryTechie]

Thank you! I am not going to be able to get to my friend for a few days. Will that be ok? I don't have internet access so I have to keep asking people to use their computers!

[Katana]

That's fine, thanks for letting me know

[Gary R]

Due to lack of response this topic is now closed.

If you still need help open a new thread in the Malware Removal forum and wait for a new helper.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Gary R