Win32/Heur is rendering my other computer useless (no internet,slow speeds) XP sp3

By Beep06 · 7 replies
Nov 9, 2010
  1. I have been plagued by the Win32/Heur virus for just under a month in which my dad has tried to fix it. Due to no joy i have decided to take matters into my own hands and fix it myself. Unfortunately since my computer is so slow that doing anything on the internet is almost impossible. I have visited many sites to try and fix this problem but each one has been unique to that person's post so i thought it best if i made my own post. As i am not using my main computer (the one with the virus) it is difficult to post specs and bare in mind that i still go to school so don't have much time in which to try and fix my computer. If any specs/results are needed i will post them in my next post.

  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    There's not much we can do without information- but see if you can get this on a flashdrive, then run on the problem computer:
    Eset NOD32 Online AntiVirus scan

    This should be the executable for the installer. Once it's on the flashdrive, connect to the computer and follow below:
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Re-enable your Antivirus software.
    10. A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

    I'd like you to do this because there are some file infectors that 'show' as Win32/Heur, but are actually much worse.

    If this doesn't work to do first, use a flash drive for the scans in the Preliminary Virus and Malware Removal thread HERE.

    When you have finished, leave the logs for review in your next reply .

    Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.
  3. Beep06

    Beep06 TS Rookie Topic Starter

    HUZZA! i have (sort of) got internet working on the infected computer and can now post specs :D. I got it working by using a boot disc that has a bunch of programs for when you have a virus/problem etc. specs are still hard to get though as i cant run dxdiag (the boot disk is only a representaion of windows) but i will try my best to get what you need.


    EDIT: hmmm "unexpected error 103" when i try to scan :| i think i may have to switch between HD booting and disc booting. I do have hijackthis on this computer, do you think you could use that or is the program you suggested what you need exactly? please respond soon.
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    Did you disable Mcafee virusscan prior to starting the scan?

    Eset is an online virus scan. There is another online scan you can try, but if you do have McAfee, you're likely to get the same error.

    And if you still can't run the sca, please being the steps in the Preliminary Virus and Malware Removal thread. We don't 'screen' with HijackThis.
  5. Beep06

    Beep06 TS Rookie Topic Starter

    i do not have Mcafee but i do have AVG and remember this was on a boot disc so it might be the problem.
    I will try and do the scan while using HD and see what happens.

    EDIT: virus re-directs me on all browsers when i try to download the file :mad: how ever i am planning on passing it into this computer with a USB key.

    EDIT2: HO HUM! the program is scanning as we speak. I will post results once it is finished

    Attached Files:

    • log.txt
      File size:
      124.3 KB
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    Bad news- but not unexpected. The system has a Ramnit infection, which we consider not curable:

    Win32/Ramnit.A is a file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

    -- Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.
    With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

    Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of infection can vary.

    Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

    In my opinion, Ramnit.A is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

    Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:
    Backdoors and What They Mean to You

    This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.
    Important Note:: If your computer was used for online banking, has credit card information or other sensitive data on it, you should disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised. You should change each password using a clean computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach. Failure to notify your financial institution and local law enforcement can result in refusal to reimburse funds lost due to fraud or similar criminal activity.

    Courtesy Broni
  7. Beep06

    Beep06 TS Rookie Topic Starter

    No install disc!

    I am reluctant to format as i cannot find my windows xp home install disc. I only have a windows xp professional disc which i have no CD key for! The computer i am using at the moment has 14 days left until i will need to activate and (as i have no activation key) it is impossible for me to bypass this. Luckily i am planning on getting a new computer at christmas but as the activation period is 31 days i would be without any computer for 11 days :dead: however i will format anyway as a computer without a virus is better than one with one.
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    You really don't have a choice. This computer cannot be cleaned. Continuing to use the system not only could infect others but will very possibly get you to a situation where you will not be able to boot the system at all!

    I'm not understanding the activation comment- is you Windows OS a legitimate copy?
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...