My wife opened a file that appeared to come from UPS and that was
the end of my computer. It tried to install files called Antivirus XP,
then it tried to install an XP Security Center and wanted me to
register to rid my computer of the virus and give them my credit card#.
My McAfee is disabled on every boot and Spybot won’t run. It also wants
to change a registry value and run buritos.exe. It has also changed my
wallpaper with “Warning!” message that can not be changed. A diagnostic
through one of the geek services says my hard drive is damaged. Is
there any way to get rid of this virus without having to pay a fortune
in a new hard drive plus all the other geek service charges? Or should
I just get a new computer?
Your hard disk is not physically damaged. I’m hoping that the
technical service company didn’t really mean that. (If they did …
well, I’d use a different service next time.)
But you do have some work ahead of you nonetheless.
]]>
Bottom line: a virus is not going to physically harm your hard disk in such a way that you would need to replace it. And certainly nothing that would require a entirely new computer.
Viruses impact only the software installed on your machine and software can be fixed.
It just might be a painful fix.
It sounds like you got a double-shot of virus activity. The UPS (and Fedex, and USPS and other) phishing attempts showed up a few months ago, and I have to say that as a business owner who also ships UPS, they almost got me too. As usual, there were many signs that the email was a phishing attempt, but I had to look closely to make sure I wasn’t about to delete an important issue relating to an actual customer shipment.
In addition, AntiVirus XP is another particularly nasty virus making the rounds right now. The major anti-virus programs are only just now catching up and detecting and removing it.
The real question boils down to this: if your machine is heavily infected by malware, what can you do to clean it up?
As I’ve mentioned before, there are two schools of thought:
-
try to clean it up
-
reinstall everything from scratch
The common attempts to clean it up boil down to running anti-malware software, possibly several different packages, repeatedly until the system comes up “clean”. You might have to reboot into safe mode in order to do so.
And, because the alternative is so conceptually costly, “try to clean it up” is the option that most people attempt.
Sometimes it works. We think.
As I’ve also said before, though, once your computer has been infected by anything, it’s not your computer any more. There’s no guarantee that any amount of clean up will actually eradicate whatever was placed on your machine.
The only alternative is to start over.
And sometimes your machine is in such a bad state that you can’t run any anti-malware programs.
The only alternative is to start over.
And starting over is simply this:
-
Reformat your hard disk, erasing everything on it (typically as part of the next step)
-
Reinstall Windows from scratch using your Windows installation CD or DVD
-
Reinstall all your applications from scratch.
-
Restore data (only) from your backup.
It’s a huge pain.
But you know what? It’s often less pain than all the failed cleanup attempts. And you know what you’ll end up with when you’re done.
But replacing hardware, be it a hard disk or an entire computer, is not part of the solution.
If you choose to replace something at this time, it’s only because this is a convenient time to do so. If you’re reinstalling everything, it’s a fine time to upgrade your hard disk – or even your computer – for example.
But it’s not required.
I had a similar problem a couple of months ago and Leo did an article.
http://ask-leo.com/how_can_an_infection_like_antivirus_xp_2008_happen.html
Maybe I was just lucky and caught the problem quickly enough, but the instructions at bleepingcomputer.com coupled with the free removal tool from Malwarebytes’ Anti-Malware worked well.
I’ve used UBCD4Win to clean up malware. I’ve also been the computer repair guy and had to explain these same choices to a customer: I can clean your system, but it will take me at least 6 hours at $30/hr, or can reinstall at the same rate for 2 hours. Most choose option 2, but, fortunately for the bank balance some choose option 1…
03-Nov-2008
In order to remove Antivirus XP from a computer I first boot the computer into Safe Mode then run a program called Smitfraud fix from the link below.
http://siri.geekstogo.com/SmitfraudFix.php
Now reboot.
Next I scan with whatever updated anti virus the customer has. If they have none, the usual situation, I install either AVG Free or Clam Win, depending on the speed of the computer and the amount or RAM. Slower computers get Clam.
Next I install and run Spybot Search and Destroy.
If this doesn’t finish the problems I run HijackThis. If one is not experienced with this program I’d suggest that a trip to one of the many forums where they interpret HijackThis logs.
AG
I was hit with Antivirus XP 2008 last month (AVG didn’t catch it) but, like Mary above, Malwarebytes cleaned it up. It’s a good download with step-by-step instructions. Thanks to Leo for the article and link.
Believe it or not, the HP agent in my country refused to honor the warentee on a work Laptop drive, as they stated that a virus had physically damaged the drive, and so was not covered! We had to purchase a new drive. Unbelievable. As Leo and others state, a virus can NOT physically damage your drive. Thanks Leo.
Re the five “starting over” steps mentioned in this article, if you “back up” then at the end “restore…from your backup”, will you not be transferring the virus to your backup external hard disk (or whatever ) and then transferring it back on to your cleaned pc? Also, re “reformat your hard disk”, is this the same thing as “rolling back to the factory settings”, which is a description I have read somewhere I’m sure?(Layman’s language please in any explanation. Thanks)
“Reformat your hard disk” is not the same as “Restore to factory settings”. A reformat erases everything on the disk, leaving it empty. Hence the additional steps to reinstall everything.
05-Nov-2008
Leo – the two options that you mention in the article (either find an effective malware remover or reformat your hard drive and reinstall everything) are NOT your only choices! I’ve found that reverting your machine to an earlier state via a Restore Point is often an effective way to rid yourself of malware that the anti-malware package that you have installed does not detect (they ALL have their particular weaknesses). Another option, admittedly more exotic, is to set up and use a virtual machine as your primary means of defense. Virtual machine get infected? Blow it away (and the malware with it)! I suspect that this last option will become more popular as zero-day attacks become more frequent and virtualization software becomes easier for us mere mortals to use…
The problem with VM’s is in its complexity for the average user, and this concept of “just blow it away” – you’d be blowing away all the customizations made within that VM, and potentially any data you saved within the VM. It needs to be very well understood what’s in and what’s out of the VM for it to be used effectively.
05-Nov-2008
Following a devastating malware attack I was left with a machine which would no longer boot up in Windows XP. I had to reinstall to factory default settings XP SP1 using the manufacturers rescue disk, losing all data and programs in the process. Fortunately I had some data on a backup disk (more than a month out of date) but it was a long and painful process restoring all lost programs. I still can’t identify the Trojan responsible as it effectively suicided in the crash. I have a 320Gb USB backup drive which I am certain is infected. How can I access/clean/recover data on this drive without reinfecting my PC again – not something I would risk lightly!
An alternative would be to boot into a Linux Live CD (Ubuntu, Knoppix, others…) and use that to copy only the files you want off of the external drive.
05-Nov-2008
I think your 5 steps would be much clearer if you changed it to 6 steps and included a step before the step to reinstall all your applications to first install all your protection ie antirus, firewall, anti maleware software and windows updates.
Just thought this might be worth trying. My friend’s PC was infected by Malwarrior. It prevented her anti-virus programmes from working and prevented her from downloading any others. I suggested that she try downloading SuperAntiSpyware, which is available free from FileHippo.com. The programme downloaded successfully and destroyed the viruses. At another time, her brother’s PC became infected with several viruses, only these viruses would not allow him to access the Internet for more than a few seconds before closing it down. He therefore could not download this anti-virus programme. I copied the programme onto a data disc-pen and he was able to run straight it from there. Again, it got rid of all the viruses. Hope this comment is useful.
Leo, on some of the comments the last part of these comments are not readable. They are covered up. Am I doing something wrong?
08-Nov-2008
Since XP hit the market I’ve managed to attract a virus on twelve or fifteen occasions. It’s a price I pay for traveling to the dark side of the net. Over the years I’ve found that the virus’s have become more complex and downright malicious,so please allow me to offer some points to consider in making your computer healthy again. With the exception of a couple of times I’ve found the only way to get rid of a virus is to reformat as indicated in the article. If you suspect that you have a virus DO NOT shut down your computer. I’ve had several infections that would’t allow a reboot in safe mode and several that wouldn’t allow a reboot at all. The boot process would go into a continious cycle of trying to boot. If you can still navigate in your machine attempt to backup any pictures,music,or documents to CD or DVD. It may be the last chance you get. If you use an external hardrive for backup DO NOT attempt to backup anything to it. If you’re lucky the virus might not be on that drive. I never backup to my external drive until I have disconnect from the IP and run a full system scan. If you use a external drive for backup some of the software programs for conducting the process have a catalog file that tells your computer where everthing goes when you do a recovery or you may have created a recovery disk as part of the program. If you know where this file is burn it to it’s own CD. Once you’ve gotten to this point you can try some of the methods mentioned in the article and the comments section. If a reformat is the only way out then load you installation disk. As it goes through the process of loading windows you’ll have the option to format the hardrive. There are actually two format options with one being identified as a fast format. Do yourselve a favor and use the slow format. It takes a lot longer but I used the fast format option once and it didn’t get rid of the virus. Your engaged in a operation you don’t need to repeat immediately. After you reload the OS you can get your updates. The Windows firewall should offer enought protection to complete that task. If you have a full system backup it’s time to load and run the program to recover your data and all will be right with the world. If you have a full backup you’ll need to install the updates or the recovery program is going to have a problem. If you don’t have a full backup its one program at a time starting with security. One more point on external hardrives for backup. If for some reason you can’t use the program to restore the data, like maybe someone stole your catalog file. Don’t panic! All your files are still there. Turn on the hardrive and go to my computer, Windows should reconize it. Your backed up files will most likely be a set. You can download the whole thing to your documents and use exployer to open the set and pick out the individual files (pictures,music,documents)and move them where they need to be. Twelve Gig,76000 files,five evenings,piece of cake! Hope this helps.
Backup, Backup, Backup!!!
Once a month, after Microsoft updates on Tuesday, I use Acronis TrueImage to make a full image backup of my disk drive to an external disk drive. Weekly I make a backup to an external disk drive of my “MY Documents” folder. And during the week if I make any updates to documents I copy them to a USB pen drive. I keep several months of Acronis TrueImage backups so if necessary I can go back farther than the past backup if somehow some virus slipped through my anti-virus scans.
Reformating and reinstalling everything is like torture, and to be avoided at all costs. Acronis TrueImage is simple, easy, fast, and has saved me a couple of times.
PS: The virus I got seem to have come from geek sites I went to researching some problem.
Many thanks for answering my query re your article a few days ago. A latte should be with you by now.
I had the same thing happen with the cryptic ‘warning’ message and the inability to access or upgrade my Norton anti-virus software.
I had a virtual Symantec technician look at it and they thoroughly destroyed my system to the point where it was virtually inoperable… after that, I took it to a local shop and they are unable to wipe the HD and get rid of the virus so I do need a new drive. Before doing this, I had a computer person at my office try to fix it.
Vicious, ugly virus! Now if only people put their time and effort into the common good instead of hurting unsuspecting people the world would be much better off…
25-Feb-2009
My laptop is a windows vista. I was working normally on subtitle workshop when suddenly it said the the program had a problem and had to shut down. When I restarted the program, I had a black screen and I was unable to boot my computer. Now it would not even want to reinstall Vista and I get a message saying that my hard disk is dammaged. I don’t understand what happened.
“ATTENTION” “EARTHLINGS” “NEVER,NEVER,NEVER USE RESTORE ON YOUR COMPUTER,TURN IT OFF”If your computer gets even a smell of a virus it is saved on this section of drive and when you restore you also restore virus or malware!
i scanned my computer and it says its infected but it can’t get rid of it what do i do? it says its in archives
Hi, DEALING WITH INFECTIONS PART ONE
I think I have come up with a reasonable strategy for dealing with PC infections. In my opinion it is not worth the trouble of trying to clean them off both time wise and also you can never be completely sure that they have been totally eradicated.
So instead invest in an external hard drive, they are really affordable now and can serve more than one purpose [storing films or a music library for instance]
Next download a Disk Imaging programme.There are great free ones available. I use Macrium Reflect Free version which is very easy to use and reliable.
Make a disk image on to the external as a fall back. This will include everything on your PC.
Then make a backup on your documents and music etcetera although you have already got this in your full disk image.This documents back up is done by copying to your external and not via the Disk Image programme.
Now you have the fall back use your rescue CD or Windows disk to reinstall your system to when you bought it. Depending on your disk you may have to reinstall drivers as well so make sure you have that sorted.
Now comes the painful bit.You will need to reinstall all your programmes from the web or any disks you may have. You will also need to visit the Microsoft Updates site to bring all software up to date. This can entail several visits and a lot of time depending how old your PC is.
Next replace your documents from the external to your PC.
At this stage I usually run CCleaner to get rid of rubbish but that is just my preferance.
DEALING WITH INFECTIONS PART TWO
Now we have a clean up to date system so before you do anything else,ie before you visit the web,make a Disk image using your chosen programme. We can date this and it is your day one image. It is better than your manufacturers CD because it is up to date and contains your present programmes. You can delete the initial Disk image if you wish as that is of your old system.
Now you can use your PC and if you get an infection just restore from your external.
In order to keep up to date I make a note of any changes I make to my system and a keep this on a notepad document in My Documents.After say a month I will put the previous Disk Image on after moving that note pad document to the external along with any other updated files. When the month old disk image is in place I will apply all the changes I made in that month[with the help of the word pad ] update my security products and then take another disk image for use a month down the line. This way I believe I minimise software rot and I always have a recent clean disk image to fall back on.
Yes, it does entail some work but it gives great peace of mind. Never again will you be left with vital System 32 files in quarantine and wondering what to do ! Regards Alex {If I can do it anyone can
my laptop was destroyed by virus. the screeen was dead.. teh connector of the screen to the body was a bit damged .. waht was the cause? can i use my lenovo laptop computer now?
29-Nov-2009
Actually, if you have an old computer with a certain type of hard drive, i forgot what kind, a virus can force a very dangerous “memeroy check” that can cause the pin on the hard drive to spin erratically and cause it to shatter the drive.
I have a Sony Viao with Windows xp prof, and a few months ago my wife downloaded a update, so she thought, for Adobe Flashplayer 10.47!! Well I have lost all my configurations, accounts and I couldnt even run a scan. I tried to fix it by repairing and the computer will function like its supposed to for 3-4min afterward, then it blinks and all my configurations and functions are gone again. Do I need to start all over? I have my recovery disk for windows but do not have one for the drivers. Also if I can back anything up can the virus hide in anything I do and reappear? Thankyou for any help you can give me, this has been a real pain!!!!! THANKS!!!!
I had a virus on my computer similar to the one mentioned. It told me my disc was damaged and the usual give us your Card details and we will fix it! The screen was black and very little worked it seemed all was lost. Then I remembered the computer was split into family names I went on my sons name and Started Ad aware and Windows Defender they both found malaware and deleted it a restart was required. On restarting I went for a systems restore to a previous week. It worked wonders the Virus has now gone and all things on my own name are working. Lucky I had two users on the machine or it would have been hard work knowing what to do.
I received an E mail from a known sender which contained a link to what I thought was a website to look a wedding pictures. Well, that was the end of my computer’s hard drive. I have access to internet explorer,but I lost all of other programs and my hard drive is damaged. The computer is about 6 years old. Can a hard drive be fixed or is some damage beyound repair? How did this happen? How did I get a fake e mail? I had no idea it was not from the known sender
Recently I made the same mistake with the UPS Virus (file) I was in a hurry and was waiting for a UPS tracking number, OUCH.
I spen several hours working with Dell Tech fixing the problem,
I keep getting the UPS/Fedex emails all the time. However Yahoo filters them into the spam folder where I can look at them without opening them. From there I can see the From: url which tells me if it is actually from UPS or Fedex. If the url dosen’t look right I just delete te email. Better safe than sorry. Also I don’t download anything I don’t know for sure will come back to Haunt me. Only download from trusted sources and even then scan it with a good virus scanner. I use Norton Insight!
I think I have a bad virus. A few days ago I was at Facebook.com where the hackers are hanging out according to CNN News and suddenly I had problems with my Ethernet. Yesterday my hard drive started failing and it would not allow me to reinstall Win XP and gave a message that it was unable to format my hard drive. I ended up running CHKDSK and formating my hard drive manually. Then I tried reinstalling WIN XP and I still had problems with corrupt files as it was installing. I have two copies of Win XP and neither worked. I finally got a message “SMART Failure Predicted on Hard Disk 0: FUJITSU MHT2060AT PL – (PM). WARNING: Immediately back-up your data and replace your hard disk drive. A failure may be imminent.” I’ve only used that Laptop for a year and I don’t think the hard drive failed on its own, I think it had help from a virus and that the hacker got in thru my Ethernet. I have read that I should be using a password on my hard drive and will do that in the future.
@Claudia
Once you’ve reformatted your hard drive, all traces of the virus would have been eliminated. As Leo says, a virus can’t physically damage your hard drive. As for your computer being only a year old, I’ve seen newer hardware fail.
that’s good to know i recently opened a file supposedly containing a free PC booster should’ve know better no i have a virus and says hard drive is damaged ram is slow yada-yada but i least i know if the tech support where i took my computer at come up with “oh you need to replace the hard drive” or something i am a bit more informed thanks :)
hi,
No. Computer viruses are software code designed to spread to computer files and other computers, delete files, and cause other problems with the data on the computer. So if you’re experiencing an issue with a hardware device such as your printer, video card, sound card, etc. it is not due to a virus.
That being said, it is possible that a virus could corrupt data on the computer including the software drivers that are used to allow your hardware devices to communicate with the computer. If this were to occur it may prevent the device from working but would not physically damage the hardware.
If you’re experiencing a hardware issue make sure you have the latest drivers installed on the computer. You may also want to try to reinstall the drivers.
{url removed}
Hi Leo,
I recieved a terrible virus recently and after I used the recovery disc to try to get a complete fresh start with the computer it will only work for a few hours and crash again. I’ve recovered it with the recovery disc 4 times and it still continues to crash, are you sure the virus can’t do permanent damage to the hard drive? Any suggestions? Thanks, Erin
@Erin
Here’s another article with some virus recovery advice:
How do I recover from a bad virus infection?
i have downloaded free pc scan antivirus after 4 days that locked my drives and ask for registration by autorun.
how i can solve this proble
Some antvirus companies do this please tell me right wa
thanking you
06-Jan-2012
Hi, I am just curious but is it possible for viruses to mess with temperature regulation and causes CPUs to overheat and lead to physical damage?
20-Mar-2012
You could always try rebooting your computer into safe mode, then running your AV. My computer got something similar to Antivirus XP (except worse, since it said that literally every program I attempted to use either was a virus or was infested by viruses, and wouldn’t let me use it), and that’s how I managed to get rid of it.
Hi,
Won’t be able to access my email for a while.
I rebuilt my computer twice this month – 2 major viruses –
last one was in Google Earth file (192 Giga- yes Gigabite). I finally maneuvered this one out after many days of hard work. Retrieving my files from my infected backupdrive (virus took up space of all the 200Gigabite in the backup drive), I am having some kind of hanging problems again. Are data files also infected??? I am a nervous wreck now and feel like throwing all my files out. Each re-install took me several days working several hours a day. Thanks.