A B***h of a Virus. Help if you'd like. :|

Discussion in 'Tech Support' started by DSix, 12 Sep 2006.

  1. DSix

    DSix What's a Dremel?

    Joined:
    12 Sep 2006
    Posts:
    5
    Likes Received:
    0
    Gah. It happened after two long years. I got a virus.

    I ran a semi-trusted .exe, turned out to be ****.

    At first it wasn't showing any activity or traces of **** happening besides a bunch of random processes. I went into safe mode and delete them all.

    Then something called DxC.exe appeared, located in the directory
    C:/Program Files/DeluxeCommunications/.

    And of course I can't delete the files because they're in use. I tried in safe mode, still said the same thing. Is there an even more basic list of processes I can boot-up with besdies safe mode?

    I tried making the process not run at start up by using MSCONFIG.

    Too bad that was a disatser, if I uncheck the boxes and re-open MSCONFIG.
    The DxC processes are checked again.
    http://img176.imageshack.us/img176/7373/dxctm2.jpg

    I recently found out my command prompt has been disabled. ****.
    http://img118.imageshack.us/img118/323/commandpromptiw0.jpg

    I tried using hijackthis, it helped me locate the files, but will not let me get rid of them. I try using the program, but the DxC.exe always reappears.

    Here's a list of all my current running processes.
    http://img176.imageshack.us/img176/9201/processesjz4.jpg

    I'm using Windows XP. :|

    Help! It randomly opens IE windows, even though my default browser is firefox and my command prompt is disabled. I have hours of work on this computer that I need.
    I've backed up most of it, I just don't want to start over.

    EDIT: I forgot swear words are censored. ha.
     
  2. sui_winbolo

    sui_winbolo Giraffe_City

    Joined:
    25 Sep 2004
    Posts:
    1,544
    Likes Received:
    29
    Do you have an antivirus program?

    If not, try Avast Antivirus. It's totally free and is pretty damn good.

    Also do you have spybot s&d? another free great program, will get rid of that program before it starts up.
     
  3. thecrownles

    thecrownles What's a Relix?

    Joined:
    27 Feb 2004
    Posts:
    733
    Likes Received:
    0
    run ad-aware? :sigh:
     
  4. Colonel Sanders

    Colonel Sanders Minimodder

    Joined:
    25 Jun 2002
    Posts:
    1,210
    Likes Received:
    4
    I'd load up AVG - free anti-virus. You could also try a bootable Linux CD, I think Linux can mount NTFS partitions in read and limited write mode- I'm sure you cant use Linux to reliable save a file to an NTFS partition, but you might be able to delete the offending files.

    L J
     
  5. DSix

    DSix What's a Dremel?

    Joined:
    12 Sep 2006
    Posts:
    5
    Likes Received:
    0
    Avast, i'm re-installing it now.
    Ran S&D, just located them but couldn't delete it, even with the restarting and end process deal.
     
  6. sui_winbolo

    sui_winbolo Giraffe_City

    Joined:
    25 Sep 2004
    Posts:
    1,544
    Likes Received:
    29
    You had Avast but deleted it? Why?

    If there is a problem with Avast getting the file or running, you would need to run an Antivirus from a different computer and get rid of it that way.
     
  7. DSix

    DSix What's a Dremel?

    Joined:
    12 Sep 2006
    Posts:
    5
    Likes Received:
    0
    Don't remember, I had it quite a while ago.

    I ran the whole pre-boot scan. It didn't the files I wanted as a virus.
    Scanned it now, still didn't see it as a virus.

    It says it deleted 39 files, but they were mostly temp files. Everything else is still there basically.
     
  8. Bbq.of.DooM

    Bbq.of.DooM Custom User Title

    Joined:
    12 Feb 2005
    Posts:
    1,477
    Likes Received:
    1
    Back up data, format. it's the best choice at this point, with a hopelessly infected box.
     
  9. sui_winbolo

    sui_winbolo Giraffe_City

    Joined:
    25 Sep 2004
    Posts:
    1,544
    Likes Received:
    29
    I went to their site (with Firefox and scripts disabled) and found this.


    Without a doubt a problem with that program you or someone installed.

    Maybe try to uninstall it the way menitioned? Since apperently their program won't allow you to uninstall it in any other way.
     
  10. hydro_electric_655

    hydro_electric_655 Dremelly Dude

    Joined:
    13 Jul 2006
    Posts:
    1,492
    Likes Received:
    0
    Go all haxor on it. Or you could try a normal clean uninstall. But his will make me read more user license agreements. Holy smokes you wave every computer right I can think of.
     
  11. WireFrame

    WireFrame <b>PermaBanned</b>

    Joined:
    24 Feb 2003
    Posts:
    2,257
    Likes Received:
    2
    I was going to rant, but its not even worth it. Killbox, hijack this, and good ol' Find will solve all your problems. The rest is down to you.
     
  12. Solid_Puffs

    Solid_Puffs What's a Dremel?

    Joined:
    20 Mar 2002
    Posts:
    38
    Likes Received:
    0
    If you're using WinXP Pro, you can disable the rights for this file to execute in the properties tab. That way it won't be run on each boot and you're able to delete it.


    You can also use this handy program called Unlocker. Whenever Windows encounters an fault about not being able to move, rename, delete files because they're in use. This program comes up, shows why you can't do that particular command and gives you the option to kill it, and thus delete/rename/move it. You can also call it up from the shell command.

    These, of course after running a new virus scan, I'm partial to AVG
     
  13. ch424

    ch424 Design Warrior

    Joined:
    26 May 2004
    Posts:
    3,112
    Likes Received:
    41
    Put in a Linux boot CD, edit DxC.exe (just to corrupt it - you cannot change NTFS files unless the new version is the same size) then reboot into windows. Should break itself.

    ch424
     
  14. cpemma

    cpemma Ecky thump

    Joined:
    27 Nov 2001
    Posts:
    12,328
    Likes Received:
    55
    Turn off System Restore, run Regedit, delete all keys mentioning the program?

    However, if your command prompt is missing it may also have disabled Regedit, see this post.
     
    Last edited: 12 Sep 2006
  15. DSix

    DSix What's a Dremel?

    Joined:
    12 Sep 2006
    Posts:
    5
    Likes Received:
    0
    I forgot to mention that, I tried deleting keys through regedit too, wouldn't let me.

    That is if I had a linux CD. ;_;

    Like I said, hijackthis did nothing. And several other anti-virus programs have done absolutely nothing.

    Yeah it might come to that, but that means I have to go find a few CDs of **** I need to reinstall. :|
     
  16. DSix

    DSix What's a Dremel?

    Joined:
    12 Sep 2006
    Posts:
    5
    Likes Received:
    0
    ASDFASDF.

    It either wasn't an option before or I over looked it before when looking through the add/remove programs list.
    I uninstalled it, but my command prompt is still disabled. I'm still trying out a few things other people mentioned.
     
  17. kenco_uk

    kenco_uk I unsuccessfully then tried again

    Joined:
    28 Nov 2003
    Posts:
    9,696
    Likes Received:
    308
    Download F-Prot for DOS and the associated update files, bung them all on a bootable cd, boot from it, set it up to scan everything and auto clean. This cleared a headache of an infection off four networked computers at work.
     

Share This Page