Weird Virus found

Hi all

Just went to a company. They have 3 computers hooked to a switch. The computers are able to ping each other however they cannot get to network shares.

The error in the attachment keeps popping up on all workstations.

The virus that AVG Network edition picked up a virus :Win32/Heur - Cant seem to find any information on it.

I ran a virus scan, ad ware, scan disk and normal troubleshooting. Couldn't find anything except the virus.

Now before I haul all the machines away I just wanted to find out if anyone has any information on this virus and/or can troubleshoot my problem.

They are all running XP Professional and AVG. However one of the machines had F-Secure on which I removed and placed AVG on it.

Thank you for your time.

Can you try an online scan...get a second opinion??

Where does the virus live??? what directory??

What are the file names??

MLF

assuming AVG cleaned the virus ok, try reinstalling the netbios protocol and recreate the shares.

Is there a firewall installed that is blocking anything?

See the discussion in the link below on "possible" false positives and how to confirm whether a file is actually infected.
"Heur" is short for heuristic which means a malware signature wasn't detected but something about the files was suspect enough that AVG reported it to you.
http://forum.grisoft.cz/freeforum/re...,100014,100026

Try this:

1. Check that the switch isn't defective.
2. Look in the AVG virus vault/scanning logs and see what files it has quarantined or deleted.
3. You can try to reinstall them from the Windows CD if you know what they are.
4. Run a system file check.
5. Reformat and reinstall if none of the above work. Try a repair install first.

did you try connecting via IP address rather than hostname? it may be a simple dns issue.

"Heur" stands for heuristic as DjM said. A virus that avg cant possibly identify. Try another
antivirus program like avira, my favourite, you can find it free at free-av.com
IF it is a virus issue ofcourse.
If it is a hardware issue as nihil said, try yo run 2 live cd's with something like
linux or winpe to see. But anyway, ping is working...
Did you check if NetBIOS service is up and running normally on each workstation?

Thanks for the info guys. I will be going back there today with all your thoughts and hopefully the problem will be sorted out. Ill let everyone know what the problem and solution was.

Thank you again.

You didn't say what type of environment you're in too. Just a workgroup? Domain? Trying to connect to another workstation's share? Server share? As suggested, try with ip, not computer name. Is the computer browser service running? netbios? What bout server service on the machine doing the sharing? Can you scan and connect to the correct ports? Try to delete/recreate the share. Make sure file/print is enabled. Check the logs for permissions problems. (enable auditing for a better idea of what is going on)

If you're going to run the online virus scan, try to do it in safe mode (with networking) after the activex/java client has been loaded on the machine. I'm not sure if the activex/java client will install if you go right to safe mode. You may have to load it first.

Peer to peer, non server based. We already tried with trying with ip. Using the ip address we were unable to bring up the pc at all however it returns pings.

It's hardware?

Change the router/switch?

;)

My hunch is Avg has removed files due to a false positive...restore them from quarantine and see if you can connect again.

I would run an online scan from Panda or Trend to see if you are infected after you restore the files.

MLF

I will be going there tomorrow morning. I will check AVG and sort that out. If it still doesn't work I will implement a new switch...

however will the switch cause that error in my first post?

Quote:

---

however will the switch cause that error in my first post?

---

Normally when things die they do it in a very obvious fashion. They stop working; period. However, there are situations where things deteriorate more slowly or suffer traumatic partial damage. These circumstances are much more difficult to diagnose as the results are unpredictable (and may even be intermittent, although that is not the case here).

You have three independent boxes with the only common denominator being the switch. So, IF it is a hardware issue, it has to be something wrong with the switch?

What I would do is (on one disconnected machine):

1. Disable AVG's interactive scanning.

2. Look at the AVG settings and see what it is instructed to do if it finds malware. If it is "quarantine" then look at what is in there. I only have instances of the free version, where there are no options other than to ask it to attempt a repair ("heal") of an infected item. By default it will put things in quarantine if it cannot heal them or is not instructed to do so.

If you have a commercial version (which they should, being a business?) there should be enhanced settings options. Check to see that it has not been set to delete uncleanable files. If it has, you obviously won't find anything in quarantine.

2. If there is stuff in the quarantine, you are only interested in items immediately before the problem starting. Make a note of what they are, then use AVG to restore them.

3. Submit them to:
http://www.virustotal.com/?9f4b11a2b...bc0b1f8617:eng

That should give you a number of opinions as to whether they really are malware, rather than a false positive. If other AVs come up positive, then rename them with a .vir suffix (Don't forget to delete them later).

If they don't come up positive, or only AVG says so, then follow the same procedure to restore the files on the other machines (the one that didn't have AVG to begin with might be OK, so don't worry about it, if that is the case:))

REMEMBER TO DISABLE AVG ON ALL THE MACHINES IF IT STILL REPORTS THE ITEMS AS VIRAL

4. If the files actually are infected (positive), or they have been deleted, then boot from the Windows CD and select the "repair" option.

To see if anything was deleted (if that option is there and is set) look in the "Test Results" and "Event History Log" in the AVG application.

If none of that works then try replacing the switch. The reason I suggested trying that early on, is I happen to have a couple lying around for testing purposes and you only have to test two machines' connectivity to confirm or rule out a hardware issue. That takes a few minutes ;)

Hi all, Thank you all for your replies it was really appreciated. Nihil thank you for the in-depth look as always.

I installed Spybot, Clam AV and Adware remover. I updated and ran all the scans.

When I was about to hand the problem onto my colleague windows security center popped up asking my about the firewall. I enabled windows firewall and bam it works.

Wierd ....

I didnt notice another firewall on when I first checked out the machine.

Why would windows firewall not being enabled be the problem ???

It shouldn't. You can disable the Windows firewall as many people do because they have another product or a hardware solution, for example.

The Windows Security Center will warn you (if enabled) that the firewall is turned off, unless it recognises an alternative firewall product.

IMHO you did the right thing. Although the Windows firewall isn't the sharpest tool in the box it is much better than having no firewall at all.

Hey Cider, please don't get me wrong, as this is not a criticism................ being the sort I am, I would have briefly turned it off on one of the boxes to see if I could get the problem to come back :D

Haha. Well another week at work. The problem came back but one of the other techs sorted it out. they can use the network shares around the office however the error still pops up that I included with my original post.

Now I assume that it is a virus trying to attack from the outside, only thing I can think of is turning off some ports on the router...

anymore suggestions?

OK,

You activated the Windows firewall and it started working. What were the messages or logs relating to this new occurrence.............were they exactly the same as last time?

What did the other tech do to fix it this time?

Nihil: Ill have to get back to you on what the tech did. To my knowledge he reinstalled the network. I will get back to you on this.

The new occurrence is just those Win32 error messages popping up. Everything works fine just abit irratating with those messages. Ill post when I am at work tomorrow.

Thanks.

The other guy did a winsock reset and it seemed to work...

Now just the popups to fix...

Have you checked that Windows is fully updated/patched on all the machines?

You might also run HijackThis! on them to see if there is anything suspicious.

;)

Yes they are all running Service Pack 2 fully updated. Ill run hijack this and see what comes up.

Thanks.