Has a virus knocked out two of my PC's?

[byff]

First off, yesterday evening my Son tried to start his computer, but it wouldn't boot up and kept restarting windows (xp BTW)

After a bit of digging, turns out that AVG had spotted a virus, but instead of getting me, he just clicked heal and thats when the trouble started.

I managed to get windows to run in safe mode and ran a virus check (AVG) and found two viruses named Flooder.AKE, which was healed and we tried a restart, but it just kept rebooting again. Again, in safemode, AVG picked up the flooder virus again, but then crashed. It appears that the boot sector from the C: drive is missing with another bit I forget the name of now.

I've just gone into my daughters room to run the AV on her machine and would you guess it, on start up, tries looking for a boot disk. When I've gone into the BIOS, turns out the hard drive isn't installed, despite it physically being there. I know her PC was working fine last night as I had to kick her off it to get her to go to bed.

Have I picked up anything that can wipe out all my networked PC's? At the moment, I have 3 towers and a laptop connected.

The laptop is running fine and this one is running fine, but this one doesn't get switched off like my son's and daughter's. I'm now terrified that if this one should be accidently switched off, it'll never restart.

Is there anything I can check for to make sure all is well? AVG has been ran and is all clear but my restore points are still switched on. Is it worth running AVG again but with the restore points switched off?

The future is looking grim, please help.

[ThePassenger]

Flooder.AKE information said:

Flooder.Ake is a brand new threat that began to appear on people's computers on December 6th, 2006.

The symptoms of infection are an alert window which pops up reading "threat found, trojan horse, heal now". Clicking this popup quarantines a system file, which then restarts the computer and pops up the alert again. The computer is then stuck in an infinite loop. It appears at this time that neither restoring the file from quarantine nor restoring the system using a Windows restore point will fix the computer. Only a complete reinstall of the operating system will work.

This problem only seems to be impacting users of the antivirus program, AVG. Initial indications are that this not a true virus, but rather a bug in AVG that results in damage to system critical files.

If you are experiencing problems associated with flooder.ake, please post any pertinent information below. If you have a screenshot that we may share with our readers, please post a URL where we may find it. Thank you!

Step-by-Step Fix

1. Boot your computer to Safe mode. Power on (or restart) your computer, keep pressing F8 key until the Startup menu appears and choose "Windows in Safe Mode".

2. In the Windows Safe mode, navigate to following folder:

C:WINDOWSsystem32drivers

3. Rename rename the following files to avoid furhter deleting of "winlogon.exe".

AVGCLEAN.SYS -> AVGCLEAN.SY_
AVGRSXP.SYS -> AVGRSXP.SY_

4. Launch Registry Editor (regedit.exe) and remove the "__delete" value in the right pane from this key:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesAvgClean

5. Restart the computer back to Windows normal mode

6. Update your AVG program to latest virus base version. Launch AVG or open AVG Control Center and press F9 key to update your AVG.

7. Then rename the SYS files back to their original names

AVGCLEAN.SY_ -> AVGCLEAN.SYS
AVGRSXP.SY_ -> AVGRSXP.SYS

8. Restart your computer for to get AVG Resident shield loaded again

Well it was only a matter of time until someone did actually target AVG *shrug*

Edited by ThePassenger on Thursday 7th December 14:52

[byff]

Thanks for that chuck. I'll print it off and see if I can get his machine working again, but is there any explination for the daughters symptoms?

I take it that AVG has updated it's virus list to include this little glitch? I only say because all machines have just been updated in the last few days and this one and the laptop got updated again this morning, so should they be now safe?

[ThePassenger]

byff said:

Thanks for that chuck. I'll print it off and see if I can get his machine working again, but is there any explination for the daughters symptoms?

I take it that AVG has updated it's virus list to include this little glitch? I only say because all machines have just been updated in the last few days and this one and the laptop got updated again this morning, so should they be now safe?

Should be.

As for your daughters machine, I'd suggest making sure their are no USB drives attached and/or floppy disks in the drive. If this doesn't fix it then open the side panel and make sure that all the cables for the drive are firmly attached.
If it's still going "bugger off" then rip the drive out, throw it in another desktop, back up all the documents and stuff, put it back in the machine and reinstall Windows. If it goes again quickly, give the hard drive an evil eye and put an old known good part in instead, if it THEN complains about the disk being buggered, replace the mobo.

[byff]

The son's PC is working again, but I couldn't find the avgclean file, so just did the other one. Its booting up as normal, but the resident sheild isn't loading up, so think I'll try d/l'ing the update prog again and repair it.

Just got hers to sort out now, but got a feeling I might have disturbed a cable - I pulled a pen from underneath it this morning before switching it on - fingers crossed.

Edit to add:

Son's pc is ok now, the avg was updated to 7.5 fairly recently so don't know why the avgclean file isn't there, but to repair it, all I did was start it up in safe mode, rename the avgrsxp.sys file to avgrsxp.sy_ as described, then just restarted as normal. The filename was returned to normal and then the update file from the avg website used to repair the installation and everything was updated. PC is now running perfect again.

Daughters PC turned out to be a loose ribbon connection.

Phew, thank goodness for that - panic over.

Edited by Byff on Thursday 7th December 17:57