# My God this Virus is a Demon. **URL:** \ **Category:** Factual Questions\ **Created:** [September 24, 2004, 11:14pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964 "2004-09-24T23:14:40Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Bear\_Nenno](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bear_nenno/32/3358_2.png) [@Bear\_Nenno](https://boards.straightdope.com/u/Bear_Nenno)\ **Post date:** [September 24, 2004, 11:14pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/1 "2004-09-24T23:14:40Z")
Besides a hard drive and possibly RAM, where else can a virus be stored on a computer?? Somewhere on the motherboard perhaps? I’ve completely reformatted and reinstalled Windows XP, and the virus is still there. I repeated the same process but removed then replaced the RAM chip before reinstalling. It is my understanding that RAM cannot store information without power, so removing it would whipe it clean… This did not work either. Then I completely disassymbled this stupid laptop (Holy Crap, could they have used any more screws??!!!) I was hoping to find a CMOS batter or something that I could take out to whipe out any stored information on the motherboard. I’m probably way out of my element here. But I didn’t find any battery on the motherboard. I took it apart into as many possible pieces I could. Then I put everything back together. The virus is still here. But I can’t find it. All I can find are its effects. It creates files like “directs.exe” which I’ve learned is a known worm file. I had my suspicions before with odd file creations like “bling”, “pwned”, “explerer”, “iexpIerer” etc. Right now, out of nowhere, the following files have appeared: In the C:\ directory: xsttgg - an application with an IE icon HideRun - an application with an unrecognized (to me) icon iexplerer, iexpIerer, wexpIerer, - all with unrecognized icons re11, re12 - both with registry icons swed, swin, swef, - MS-DOS batch files megshg, mghsese - applications with IE icons Anything I delete from the various RUN, RUNONCE, RUN SERVICES, RU1N (sic), registry keys will return upon restart. Same as anything I disable in msconfig. Further, msconfig and regedit appear to be disabled or blocked somehow. Because they will normally not open. If I delete enough stuff, I will be able to run msconfig or regedit temporarily. I’ll delete stuff and then it will all be back at restart and I will lose the ability to run regedit or msconfig. Keep in mind this is on a fresh installation of Windows XP. After about three days of fighting this thing, I will be unable to do anything on this computer because it will be so slow and bogged down and the internet will no longer function. So I will have to reformat and reinstall everything again. Any idea what I have or how to fix it? Is this even possible? Or am I losing my mind??? ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [September 24, 2004, 11:22pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/2 "2004-09-24T23:22:52Z")
Where did your WinXP disk come from? Did it come with the computer? ---
**Author:** ![Bear\_Nenno](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bear_nenno/32/3358_2.png) [@Bear\_Nenno](https://boards.straightdope.com/u/Bear_Nenno)\ **Post date:** [September 24, 2004, 11:34pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/3 "2004-09-24T23:34:43Z")
Good question. And in fact, I started to consider the CD after I posted. This particular CD is borrowed from a friend. Yes it is a burned copy, but I AM using my own WinXP Key Code. The one attached to the bottom of this laptop (So I am not pirating) Though it is a borrowed CD, and it could possibly be infected itself, it would have to have the exact same infection this laptop originally started with before I whiped it out to start with. That sentence doesnt make much sense. Basically, the laptop had a problem so I reinstalled Windows XP. I’ve lost the disk that came with her, so I borrowed a burned copy. After reinstalling, all the original problems are still present. So if the problem is now being caused by the CD, it would mean the CD has the exact same virus that my laptop had originally. Not impossible, but currently not likely. Especially since my friend has not noticed any issues. On an aside, he isn’t running WIN XP, he is running 2000. So he might just have a virus infected copy of XP, and not know because he’s never ran it. . . But again, it would have to have the same thing I had earlier. If there are no other thoughts or possibilities, I will go ahead and install WIN2000 on this thing and see if those files magically appear there too. ---
**Author:** ![Punoqllads](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@Punoqllads](https://boards.straightdope.com/u/Punoqllads)\ **Post date:** [September 24, 2004, 11:38pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/4 "2004-09-24T23:38:12Z")
There is flash memory on the motherboard for the BIOS where an insidious virus might hide. Depending upon the virus, you might be able to reflash the memory. Otherwise, you’ll have to replace the memory or replace the motherboard. ---
**Author:** ![cryptic\_j](https://avatars.discourse-cdn.com/v4/letter/c/898d66/32.png) [@cryptic\_j](https://boards.straightdope.com/u/cryptic_j)\ **Post date:** [September 24, 2004, 11:44pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/5 "2004-09-24T23:44:55Z")
If you still had it after all that - - are you constantly connected to the 'Net via a network or similar?? if so, disconnect when you do the following. Something you could try - which I found out a few days ago ridding a computer of some annoying spyware - - disable System Recovery before removing all the files etc… to do this, right click on the My Computer icon, and go to System Recovery - - you can disable it there… reboot in safe mode and then remove all the files… after that run any virus removal, Spyware removal software you may have… then reboot - and re-enable System recovery - in the same way you disabled it… As long as you are not connected to any external source - and have definitely removed everything - there is no logical way that the virus can re-infect… hope this helps… * * * Tales from the **cryptic** ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [September 24, 2004, 11:51pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/6 "2004-09-24T23:51:25Z")
Sounds like it might be a boot sector virus or similar; an ordinary wipe and reinstall might not do it - depending on the drive type and file system, the solution varies a bit and whenever you tinker with the drive at such a low level, you run the risk of rendering it inoperable. ---
**Author:** ![Revtim](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/revtim/32/1042_2.png) [@Revtim](https://boards.straightdope.com/u/Revtim)\ **Post date:** [September 24, 2004, 11:53pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/7 "2004-09-24T23:53:50Z")
> [@Punoqllads](#): > > There is flash memory on the motherboard for the BIOS where an insidious virus might hide. Has this actually happened before? ---
**Author:** ![ouryL](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ouryl/32/6067_2.png) [@ouryL](https://boards.straightdope.com/u/ouryL)\ **Post date:** [September 24, 2004, 11:55pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/8 "2004-09-24T23:55:36Z")
Time to exorcise your warantee! :rolleyes: ---
**Author:** ![Punoqllads](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@Punoqllads](https://boards.straightdope.com/u/Punoqllads)\ **Post date:** [September 25, 2004, 12:20am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/9 "2004-09-25T00:20:31Z")
> [@Revtim](#): > > Has this actually happened before? [http://www.google.com/search?sourceid=navclient&ie=UTF-8&q=bios+virus](http://www.google.com/search?sourceid=navclient&ie=UTF-8&q=bios+virus) ---
**Author:** ![Bear\_Nenno](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bear_nenno/32/3358_2.png) [@Bear\_Nenno](https://boards.straightdope.com/u/Bear_Nenno)\ **Post date:** [September 25, 2004, 12:21am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/10 "2004-09-25T00:21:35Z")
> [@Revtim](#): > > Has this actually happened before? It is likely that this was a file intentionally installed by my sister’s malicious roommate and not something downloaded by mistake. So ANYWHERE a virus could hide should be considered. **Punoqllads** , how does one go about reflashing memory? **cryptic\_j** , I don’t know why I didn’t think about going into Safe Mode. At the very least it will allow me to access regedit and msconfig. Even if the changes aren’t permanent, it allows me to get it working for at least a little while. The main problem is that I can only erase the changes this file is making. I don’t know where the changes are coming from. In the software/microsoft/windows/current version of HKEY Current Users, HKEY Local Machine, and HKEY\_User/Default, I had a RU1N file containing “directs.exe” And I had RUN, RUN Once, Run Services, Run Services Once, all containing the following crap: yosxbbynigsve iexplore netstun syshelper swef.bat sdin njerhe localsrv I was able to delete one or two of them from the System32 file. But I couldn’t even find the rest of them, even with file search. (Not counting ieplore) The only place I could find anything close was in the Prefetch folder. What the hell is Prefetch for?? Also, peculiar is the fact that I can’t seem to get some things to dissappear from msconfig. They are unchecked and disabled, but I can’t get rid of them. In WIN98, I was always able to get rid of every listing under startup files. I can’t get rid of: hkcmd - even though I disbled this under display options igfxtray - not sure what it is msmsgs swef swin stacmon localsrv Wont be long before I start seeing “bling” and “pwned” again… Right now as I try to open regedit and msconfig, I realize nothing is fixed because they wont open. Is sending this thing off to Dell my only option. ---
**Author:** ![Daizy](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@Daizy](https://boards.straightdope.com/u/Daizy)\ **Post date:** [September 25, 2004, 12:31am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/11 "2004-09-25T00:31:00Z")
You’ve not said, unless I’ve missed it, whether you’ve attempted a virus scan? If you’re able to go online, run [Housecall](http://housecall.trendmicro.com/housecall/start_corp.asp) If that’s not an option, download and run [Stinger](http://vil.nai.com/vil/stinger/) It’s somewhere to start. ---
**Author:** ![Punoqllads](https://avatars.discourse-cdn.com/v4/letter/p/d2c977/32.png) [@Punoqllads](https://boards.straightdope.com/u/Punoqllads)\ **Post date:** [September 25, 2004, 12:50am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/12 "2004-09-25T00:50:35Z")
> [@Mangetout](#): > > Sounds like it might be a boot sector virus or similar; Now that I think about it, putting it in the boot sector is probably much more likely than hiding it in the BIOS. A BIOS virus would have to be motherboard-specific. ---
**Author:** ![World\_Eater](https://avatars.discourse-cdn.com/v4/letter/w/f04885/32.png) [@World\_Eater](https://boards.straightdope.com/u/World_Eater)\ **Post date:** [September 25, 2004, 1:01am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/13 "2004-09-25T01:01:32Z")
Scrub the drive and install Linux, that’ll teach it. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [September 25, 2004, 1:49am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/14 "2004-09-25T01:49:19Z")
The best way to get to the root of the problem is to download and install [hijackthis.](http://s89223352.onlinehome.us/mirror/hjt/) Run it, do a scan, then save the log. Then post the log here. I (or several others) can analyze the log and get right to the root of the problem. ---
**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\ **Post date:** [September 25, 2004, 4:30am UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/15 "2004-09-25T04:30:26Z")
It is very unlikely that you have virus hiding in notebook’s BIOS flash memory. The only thing that is normally going to survive a re-format is a boot sector virus (per Mangetout’s note), or if your notebook drive has a hidden partition containing setup files and drivers, it might be hiding there. You need to blow out your partitions, then re-partition, then format. If the virus survives that you need to call the Center for Disease control in Atlanta or check the XP install disk (and/or driver disks) you are using. You can use a Win98 or WinME boot floppy image from here [www.bootdisk.com](http://www.bootdisk.com) to make a bootable floppy that can delete partitions, re-partition and then format the drive. Make sure the floppy you use to do this has the little write lock tab on the side of the floppy disk engaged, so the virus cannot write to it. When you re-install XP it will offer the option to do a NTFS format at that time. Choose yes to that option. BTW just a head’s up, some people thing re-installing windows on top of a corrupted install “re-formats” the disk. It does not. It just replaces files. A true “format” is typically where you boot with a floppy (or a CD in some cases) and all data is scrubbed from the disk prior to the install of the OS. When you say you have done a “format” of the disk what specifically did you do? ---
**Author:** ![Myglaren](https://avatars.discourse-cdn.com/v4/letter/m/f1d935/32.png) [@Myglaren](https://boards.straightdope.com/u/Myglaren)\ **Post date:** [September 25, 2004, 12:20pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/16 "2004-09-25T12:20:57Z")
After repartitioning I would advocate running fdisk mbr, then fdisking the drive to clear the master boot sector. ---
**Author:** ![absoul](https://avatars.discourse-cdn.com/v4/letter/a/bc8723/32.png) [@absoul](https://boards.straightdope.com/u/absoul)\ **Post date:** [September 25, 2004, 1:45pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/17 "2004-09-25T13:45:46Z")
If you fully format and delete all the partitions, using MS utilities you may still leave a boot virus on your computer. To fully “clean” your harddrive of any information you will need to write zeroes (0’s) to your disk. This is called a “low level format”. If you visit your drive manufaturers website they should have a utility to do this for you. If they don’t you can search google for “disk wipe utility” or “low level format”. You’'ll need to download this program to floppy and then boot to it. Some of these utilities only write zeroes to the first 128 sectors on the drive. I would suggest getting a program that writes zeroes (or random data) to the entire drive. This helps to diagnose problems with sectors on the drive. Most of these prgram will first scan the drive for problems and attempt to repair any damaged sectors prior to writing zeroes. It’s a fantastic way to revive/diagnose damaged drives. It’s also a great way to “clean” data from drives. Some of these utilites will write random characters 25 times or more to your drive. Even CSI Miami wouldn’t be able to get any info from it. ---
**Author:** ![Testy](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@Testy](https://boards.straightdope.com/u/Testy)\ **Post date:** [September 25, 2004, 3:17pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/18 "2004-09-25T15:17:28Z")
I’ve had a few uglys loaded on my system and my usual remedy is to break out a fdsk floppy and remove all partitions. Then recreate the partition, do a format and re-install the OS from a known-good source. I usually use Win2K. Be damn sure the FDSK floppy is write-protected BEFORE you put it into the drive. I think I’d try this before I started tearing the poor thing to bits. Regards Testy ---
**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\ **Post date:** [September 25, 2004, 4:07pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/19 "2004-09-25T16:07:16Z")
> [@absoul](#): > > If you fully format and delete all the partitions, using MS utilities you may still leave a boot virus on your computer. > > To fully “clean” your harddrive of any information you will need to write zeroes (0’s) to your disk. This is called a “low level format”. If you visit your drive manufaturers website they should have a utility to do this for you. If they don’t you can search google for “disk wipe utility” or “low level format”. You’'ll need to download this program to floppy and then boot to it. > > Some of these utilities only write zeroes to the first 128 sectors on the drive. I would suggest getting a program that writes zeroes (or random data) to the entire drive. This helps to diagnose problems with sectors on the drive. Most of these prgram will first scan the drive for problems and attempt to repair any damaged sectors prior to writing zeroes. It’s a fantastic way to revive/diagnose damaged drives. It’s also a great way to “clean” data from drives. Some of these utilites will write random characters 25 times or more to your drive. Even CSI Miami wouldn’t be able to get any info from it. Ummm…no. Writing “zeros to your disk” to your disk is not a “low level format” of a IDE drive. A low level format is something specialized hardware at the factory does that actually defines the physical tracks for servo, sector layout, and defect management areas of the disk platter. So named “low level format” utilities are simply normal partition/format/data overwrite utiltiies. Many drive manufs (deliberately it seems) use the term in sloppy way as a pacifier to let users _think_ they are really getting into the nitty gritty of the drive. They are actually simply partitionting, formatting (high level), “zero fill” utilities. You are not alone in the confusion on this term BTW, there are many anti-virus and PC hardware articles on the web that use the term incorrectly. Even Seagate acknowledges they are kinda-sorta playing word games and after putting “lowl evel format” in quotes start calling it a “Zero Fill” process. From Seagate [How Do I Low Level Format an ATA (IDE) Hard Drive](http://www.seagate.com/support/kb/disc/faq/ata_llfmt_what.html) From Microsoft- see [Detailed Explanation of FAT Boot Sector](http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q140/4/18.asp&NoWebContent=1) See also Low Level Format > [@](#): > > Short for low-level format, a formatting method that creates the tracks and sectors on a hard disk. Low-level formatting creates the physical format that dictates where data is stored on the disk. Also see high-level format. > Modern hard drives are low-level formatted at the factory for the life of the drive. A PC can not perform an LLF on a modern IDE/ATA or SCSI hard disk, and doing so would destroy the hard disk. Older MFM drives could be low-level formatted to extend the life of the disk, but modern hard drives no longer use MFM technology. > > A low-level format is also called a physical format ---
**Author:** ![Joe\_Mahma](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@Joe\_Mahma](https://boards.straightdope.com/u/Joe_Mahma)\ **Post date:** [September 25, 2004, 5:59pm UTC](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964/20 "2004-09-25T17:59:25Z")
There’s no “h” in **wipe**. [Next page](https://boards.straightdope.com/t/my-god-this-virus-is-a-demon/265964.md?page=2)