I need HELP deleting Win32:Vitro virus from files

Viruses and worms
1

Hi! I connected a USB drive to my new computer today, intending to continue working on files for an exam. When I tried to open a folder with Adobe Illustrator files, Avast notified me of a threat. Scanning the USB drive I discovered 12 files and folders infected with the same Win32:Vitro virus! These files are now on Avast’s virus chest.

What do you recommend me to do? One of these folders contains material extremely important to me and it would be great if there was a way to get rid of the virus and recover the file!

Otherwise, how should I proceed? Should i leave the files there? Nothing else in the computer seems to be infected since I never got to open the files from the USB.

THANK YOU IN ADVANCE! :smiley:

2

Hi first wipe the USB drive, or ditch it. Virut can really ruin your system

Next get Avast to run a boot scan and let me know if it finds any further infected files

THEN

Download OTL to your Desktop
Secondary link

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
dir “%systemdrive%*” /S /A:L /C
CREATERESTOREPOINT

[*]Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs

3

Thank you @Essexboy! The Avast scan didn’t find any other viruses. This is the OTL report:

file:///C:/Users/Daniela/Documents/OTL.html

and this the Extras report:

file:///C:/Users/Daniela/Downloads/Extras.html

I hope you are able to see them in this way because there is a character limit, so I can’t paste them directly on here.

4
I hope you are able to see them in this way because there is a character limit, so I can't paste them directly on here.
that is why we say [b]attach [/b]the logs ;) (i know, it say post at the bottom of essexboys instructions)
5

Yes thanks @Pondus! But how do I attach the file from here?

6

below the txt box you write in you find … Attachments and other options

and Essexboy is in bed now, so check back tomorrow…

7

Thanks!

8

For some reason I couldn’t see the option before

9

Hi danehli,

logs also needed attached are mbam (Malwarebytes), AdwCleaner, and aswMBR,exe.

Now that you know how, should much less of a problem. ;D

10

The good news is that there is no sign of the dropper or driver associated with this :slight_smile: And the log looks good

The bad news is that the files are too dangerous to attempt a repair on, you would be best to get new ones. Ensuring that they are clean first

11

Shame! :-\ I’ll start working on that again then. So should I just leave the files at the Avast virus chest?

Thank you so much for taking the time though, I appreciate it! :slight_smile:

12

DONT PUT THEM ANYWHERE ON YOUR COMPUTER. OTHERWISE IT WILL INFECT YOUR WHOLE SYSTEM OVER TIME CAUSE ITS A FILE INFECTOR.

Just let them there and try to get new files.

You can hope that your system hasnt got infected. :frowning:

13

Empty the chest in case some-one tries to restore them. Also inform the author of the files that they are infected

14

Vitro is really nasty. File infectors are most probaply the badest things that you can get.

Trojan-Ransom.Win32.Krotten is also a nasty virus. :wink:

I dont want to have one of these File infectors on my system. ;D

15

Alright I’ve deleted them from the Avast chest as well. Who even makes these viruses and why? I have to start a project from 0 again… This is the second time I get a nasty virus by plugging in my USB key to another computer… In both cases it has been shops for printing! I’ve installed an antivirus on my USB key now hahaha… Thanks so much for the help, again!

16

Good Choice. You can also install MCShield on your system.

http://www.mcshield.net/

17

My father installed Avira Free on my Grandpas PC, but it has nothing for Zero Day, so i will uninstall it
and install Avast. :wink:

18
Who even makes these viruses and [b]why[/b]?
money, money....and more money. ;)

http://www.technibble.com/why-do-people-create-computer-viruses/

19

Well, I’d notify the shop(s) and use someone else. You can get an USB file cleanser and protector here: http://www.mcshield.net/

It’s the one we recommend and use.

20

:slight_smile: :wink: