Followed the 8 rules, but didn't work until..

[aoshater]

I'm writing this post for two reasons:
1) I fixed my PC so it might help others.
2) The pros here could maybe explain further how what I did helped.

Well, to explain the problem:
I have a C: drive and a D: drive. Lately, on startup I would find a strange cmd window opening automatically w/ a title like this:
C:\windows\..\cmd C:\.X
And Control Panel in the startup menu wouldn't appear. A CTRL-ALT-DEL won't bring up the task manager and opening any text file using notepad would always give " File is being used by another program". Registry Editor is restricted by administrator.

Since I had nothing valuable on C:, I decided to carry out a clean FORMAT and re-install Windows. I did that twice. And right after installing windows, as soon as I perform my first reboot, the exact symptoms appear again.

I followed the 8 steps to the point, but nothing would be found, neither on C: or D: drive.

I ran ComboFix.exe but it would finish and reboot and no real change.

I kind of followed around and got the hint that a process C:\.X.exe is the main culprit. But it was impossible to find it and delete it or kill it. The solution was by using a software called Unlocker. I went to C:\windows\system32\regedit.exe and found that .X process locking it. As soon as I killed the process .X, I could actually do everything. But upon restart, again, same symptoms. The trick was the combination of:
1) Unlocking regedit in windows and deleting it.
2) Unlocking notepad.
3) Running ComboFix after that.

After that restart, It was finally totally removed. That's it. Pros, your comment.

 

[kimsland]

Since I had nothing valuable on C:, I decided to carry out a clean FORMAT and re-install Windows. I did that twice. And right after installing windows, as soon as I perform my first reboot, the exact symptoms appear again.

I'm not sure on your definition of "Clean Format"

But here is the process to cleanly install Windows XP

Microsoft's Windows XP Professional Repair Install step by step (* Including Delete Partition)
http://www.windowsxpprofessional.windowsreinstall.com/sp2sp3installxpcdoldhdd/indexfullpage.htm

Microsoft's Windows XP Home Repair Install step by step (* Including Delete Partition)
http://www.windowsxphome.windowsreinstall.com/sp2sp3installxpcdoldhdd/indexfullpage.htm

* Warning deleting the Partition will remove all User data and Windows system files

----------

But I'm pretty positive that HijackThis would have shown the entry for "C:\.X.exe" of which could have been removed from there, or using OTCleanIt would have got it

Best to always do this guide: UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions
And submit the logs so as Malware removal specialists can advise you further removal steps, if required

Anyway, glad you got it resolved

 

[aoshater]

In reply to your reply

Clean Format : During the first phases of the Windows installation, it asks if I would like to carry out:
1) Format partition NTFS (quick)
2) Format partition NTFS
3)Leave filesystem intact

I go for the second option. My guess is that this virus is located on my D: drive.

Regarding HiJackThis, yes, It showed the .X.exe entry, and i'd repeatedly say " Fix this" and then i'd run the scan again, and it's still there. I have another PC with the same exact problem! So i'll try the OTCleanIt.

Thanks for the reply,