Member Avatar for mangel.murti

hi all,

It went 6 days,when i unable to handle this then i think Daniweb......
my pc effected by win32:junk poly[cry]............or i think other viruses are also there in my ,exe file,php files,html files all are effected by virus.i am using bit defender internet puchase it for 1 year.when i connecting to internet my traficc is being so high and because of this virus it connecting to malicious web site dns:// .....and so on..... i saw automatic files are comming to windows directory and effecting winlogon.exe,Explore.exe

when i see my php,asp html pages, below of those pages these lines are automatically adding <iframe scr="" style="......."></iframe>
i format my pc 5 times use track0,DM tools and then installed new windows xp sp2.but when open html files i saw that it is still effecting and above lines are automatically adding to every pages.i search internet they are providing some tools i used those tools also but no result........................................

for saving my important data i first remove these above lines and save my data in txt file because i read in some blogs that txt file are not effected by this virus.then i mail these file to my own account for saving data but rediffmail domain rejected sending mail and show error suspicious activity found ..................
guys i want to know that how to handle this type of virus.Please provide me how to save and remove this virus.


thankx in advan......................

  • 3 Contributors
  • 2 Replies
  • 344 Views
  • 4 Months Discussion Span
  • Latest Post Latest Post by JunkPolyKiller

Dani AI

Generated

Short summary and practical next steps to stop reinfection and recover clean data. The symptoms you describe match a polymorphic file‑infector that appends or injects code into executables and web pages; those families are notoriously hard to disinfect reliably without an offline, rescue‑media approach. Take the repeated-format + reinfect behaviour as a sign that either (a) an infected backup/USB or (b) a compromised network/FTP/router is reintroducing the code. (threats.kaspersky.com)

Immediate triage (do these now): unplug the PC from the network, stop using infected USB sticks, and work from a known‑clean machine. Create a forensic image if the data is critical. Boot the infected box from trusted rescue media (offline scanner / rescue ISO) and scan the offline image before restoring anything. Copy only personal documents (no .exe/.scr/.dll or server scripts) to an external drive and scan that drive on a separate, up‑to‑date computer before opening files. Example quick file checks (run from a clean Linux environment):

# find pages with injected tags
grep -R --line-number -I -E "<iframe|<script" /path/to/www/

# remove lines that contain an obvious injected iframe (backup first!)
sed -n '1,200p' file.html   # preview
sed -i.bak '/<iframe/Id' file.html

Run these edits only after you have backups and have inspected the suspicious code in a text editor. (learn.microsoft.com)

If web files keep getting reinjected, the FTP/CMS credentials or the hosting account are probably compromised, or an infected machine on the network is pushing changes. Change all hosting, FTP, CMS and database passwords from a different clean computer, replace core site files with fresh copies, and search/clean the database for injected payloads and backdoors. Many mass iframe campaigns capture FTP credentials or inject via automated bots; cleaning the site without fixing credentials or the local PC will fail. (lexiconn.com)

Finally, check local DNS/hosts and the router (DNS hijacks can redirect traffic to malicious servers). Reset the router to factory defaults, update its firmware, set a strong admin password and use trusted DNS. If a polymorphic file‑infector is confirmed and you cannot guarantee all executables and boot sectors are clean, a full disk wipe and OS reinstall from trusted media is the only certain fix — then restore only scanned, non‑executable data. As recommended, start with thorough scans; and as warned, do not restore executables from infected backups. (securelist.com)

Recommended Answers

All 2 Replies

Member Avatar for jholland1964

What were the tools you used?
Try this one:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Reboot the computer.
Then run and save the log.
Post back here with both log.s

Member Avatar for JunkPolyKiller

How I got rid of Junkpoly Win32:JunkPoly [Cryp].

I backed up all my important documents onto a USB stick.

But DO NOT back up any .exe files as they are likely to be infected. As soon as you run these junkpoly will come straight back.

Full format of the hard drive.

Copy files back onto PC after fresh install.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.