Please help me! My Seagate 20GB hardisk was infected by viruses, and crash my hardisk. Anti-vir and AVG anti virus detected VBS/Redlof.e, heur/cryted/ spr/destart and wpcb.3207 virus. Anti-vir had clean the spr/destart and wpcb.3207 virus and I though had cleaned also the vbs/redlof.e, and heur/cryted virus. But when I scan my hardisk again, the virus is still there, i try deleting the folder.htt file manually which the vbs/redlof virus created but with no avail. What makes things worst is my hardisk seems to be unusable. I try repartioning and formatting my hardisk with Seagate's Disk Manager but still the virus, the old files and partition is still there. I performed a disk scan and it detected a bad sector in sector 170,171,9708,9709 and 11 other sectors. Can I still use my hardisk? Do I need to manually edit my hardisk to fix this problem? I really don't know how to edit my hardisk manually but if someone out there who can teach me how to manually edit my hardisk, I'm eager to learn. I really need your help guys! Thanks in advance! God bless!
crazywheels
Distinguished
- Jan 11, 2006
- 334
- 0
- 18,780
http://www.sophos.com/security/analyses/vbsredlofe.html
If you tried re-partitioning and re-formatting, does this mean you have more than one hard-disk? If so the worm may be on both drives.
A machine description would help.
If you tried re-partitioning and re-formatting, does this mean you have more than one hard-disk? If so the worm may be on both drives.
A machine description would help.
zenmaster
Splendid
- Feb 21, 2006
- 3,867
- 0
- 22,790
Bad sectors are not a major problem.
They are expected to develop over time, especially one as old as your
1) Create a Local Windows user who is only a member of the user's group.
2) Boot in Safe Mode and logon as the new user.
3) Try your AV Software again. This process can help the cleaning process in some cases because safemode may prevent parts of the virus from loading and the lesser user rights may help stop it from doing things that lets it replicate itself from one place to another as you clean. This does not always help, but sometimes it does.
They are expected to develop over time, especially one as old as your
1) Create a Local Windows user who is only a member of the user's group.
2) Boot in Safe Mode and logon as the new user.
3) Try your AV Software again. This process can help the cleaning process in some cases because safemode may prevent parts of the virus from loading and the lesser user rights may help stop it from doing things that lets it replicate itself from one place to another as you clean. This does not always help, but sometimes it does.
Thanks guys for all your replies, I only had one hardisk, I tried repartitioning and reformatting my hardisk in the belief that the mbr was corrupted by the virus, BTW I also try wiping and low level format my hardisk but in my amazement it still have the files and the virus in my hardisk. Its ok for me to completely wipe-out my hardisk, my goal is to make my hardisk usable again. I'm not planning to save or restore my file/windows. Will manual editing of my hardisk help to solve this problem?
Viruses are a PAIN to get rid of once you get one. You need to zero out all the sectors on your drive. I can't remember if the IDE/SATA spec called for writing data to the sectors, or only a verify read. But you need to do the following:
1. Wipe your drive with a program that will WRITE zeros to ALL sectors(eradicating your MBR, partition table, etc).
2. Install windows XP. Install your antivirus program. Do a FULL system scan.
3. Connect your computer to the network and begin a cleanse of your files on CD/Floppy/Network.
Seems easy right? You've done this and it's still around, right? Not so easy. See, ANY media that you intend to boot or read from BEFORE step 3 MUST(and I can't stress the must enough) be verified to be virus free. No exceptions. The drivers you install, everything. Unfortunately, the only way to verify that is with a computer that you are certain doesn't have the virus, which could be hard. Viruses have many 'features' that allow them to hide themselves from antivirus programs after they infect. The only way to catch them is before they infect your computer. After they infect your computer there the only way is with a boot CD with a virus scanner and then do a scan of your computer. Any and all storage media you have should be considered 'infected' until you know it isn't.
Your sector's going bad is not a product of the virus. It's more likely that you've found bad sectors because you are having to fix the virus and are doing alot of formatting etc of your hard drive. Normally all the sectors on your drive aren't tested, so when you format you can often find them thinking they are new, when they could have been there for months or years.
The best thing you can do is use your XP CD and your AV CD that came with your computer to set up your machine.
The only other way is to go somewhere(maybe work) and download a linux live CD that has an antivirus scanner thats up to date and boot from the CD at home and do a scan. Not to start a flame of which AV is the best, but I have had good luck with Symantec AV Corporate. I get to use it being in the military. Kaspersky is supposed to be tied with Symantec AV Corp. in terms of being the most thorough.
1. Wipe your drive with a program that will WRITE zeros to ALL sectors(eradicating your MBR, partition table, etc).
2. Install windows XP. Install your antivirus program. Do a FULL system scan.
3. Connect your computer to the network and begin a cleanse of your files on CD/Floppy/Network.
Seems easy right? You've done this and it's still around, right? Not so easy. See, ANY media that you intend to boot or read from BEFORE step 3 MUST(and I can't stress the must enough) be verified to be virus free. No exceptions. The drivers you install, everything. Unfortunately, the only way to verify that is with a computer that you are certain doesn't have the virus, which could be hard. Viruses have many 'features' that allow them to hide themselves from antivirus programs after they infect. The only way to catch them is before they infect your computer. After they infect your computer there the only way is with a boot CD with a virus scanner and then do a scan of your computer. Any and all storage media you have should be considered 'infected' until you know it isn't.
Your sector's going bad is not a product of the virus. It's more likely that you've found bad sectors because you are having to fix the virus and are doing alot of formatting etc of your hard drive. Normally all the sectors on your drive aren't tested, so when you format you can often find them thinking they are new, when they could have been there for months or years.
The best thing you can do is use your XP CD and your AV CD that came with your computer to set up your machine.
The only other way is to go somewhere(maybe work) and download a linux live CD that has an antivirus scanner thats up to date and boot from the CD at home and do a scan. Not to start a flame of which AV is the best, but I have had good luck with Symantec AV Corporate. I get to use it being in the military. Kaspersky is supposed to be tied with Symantec AV Corp. in terms of being the most thorough.
Facebook
Twitter
Instagram