Help with a virus!

Aleks · Oct 20, 2009

Hi, im having some problems, and i am fairly sure that this is a virus
(for your information, i am fairly experienced with computers in general)

What happened, was that one day i plugged in my usb flash drive, and i couldnt delete or edit anything on it because it said that it was write protected. I found that you can turn off write protection by going into the registry editor, and setting the write protection value to 0. I did this, and nothing changed.
I then noticed that all three of my usb's became write protected when i plugged them in. So my first thought was : virus! I read more about these viruses, and i disabled autoplay and showed all hidden files. I looked back to my usb, and hidden there was "winlog.exe" (avg immediately responded that this was a Trojan, but when i tried to delete it, it said "Action Cannot be finished because Windows Vista UAC Settings are switched off. Please turn UAC on and repeat the action ).

How do i delete this virus? Where is it on my computer? (it has to be because it infected all of my usb's)

BeeCeeBee · Oct 20, 2009

Hello and welcome to Computer Help Forums, Aleks!

Our malware removal specialists have suggested some preliminary steps that will help them get to the bottom of your problems. Please have a look at the following link and perhaps, if you follow these directions, you will get ahead of the problem.

http://computerhelpforums.net/malware-removal/46793-preparation-for-malware-removal-help.html

starbuck · Oct 23, 2009

Hi Aleks

Most references to 'winlog.exe' are not good.
If you still need help please follow the step below and post the report for me.

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with the running of ComboFix.
For more information read:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Then:

Double click on Combo-Fix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

If you are running Vista, you may not see this screen

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Thanks.

I'll move this thread to the malware section.