Member Avatar for Davepl

We're wondering has anyone seen this type of virus/worm before?
Our antivirus software (AVG-8) was not able to detect it.
It occurred on an XP pro-SP3 workstation, (on a LAN, with internet access).
The virus installs the following software, spontaneously:
MS SQL server 2004, SQL server native client, native support files, vss writer, SQL writer, MSXML 6 SP2, ms compression client pac 1 for xp, ms office 2003 web components, ms office small buisiness connectivity components, visual c++.
In the programs folder, there were 60+ copies of an sql directory, containing hotfix.exe, amounting to several GB!
Trying to delete those folders gave "access denied", until we went to the security tab of each folder, gave ourself rights, to delete it.
Then we manually uninstalled the bogus programs, and disabled suspicious looking processes. That seems to have fixed it, so far.
But while the affected hard drive was connected to another XP machine, (through a USB adapter), the virus jumped on the other PC and did the same thing! requiring the same manual process to delete it. We would appreciate any feedback or additional information on this.

  • 4 Contributors
  • 3 Replies
  • 211 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by MidiMagic

Dani AI

Generated

This looks like a persistence-focused infection that drops lots of installer-looking files, hardens permissions on those folders, and can spread via attached media. Manual uninstalls and killing processes can remove visible symptoms but often leave behind persistence points (services, scheduled tasks, autorun entries, WMI subscriptions, drivers, or hidden startup items) that will recreate the payload later. The safest approach is a containment + forensic-first workflow rather than ad-hoc deletions.

Recommended checklist (ordered, concise):

  1. Isolate and image — remove the machine from the network and take a full disk image (forensics or backup) before any destructive steps.
  2. Use a clean boot/rescue environment — boot from known-clean media (Linux live USB or vendor rescue ISO) and scan the offline image with multiple engines or a trusted rescue scanner.
  3. Hunt persistence — examine services, scheduled tasks, Run/RunOnce registry keys, startup folders, driver store, LNK files on removable media, and WMI event subscriptions. Tools designed for startup/persistence discovery are appropriate here.
  4. Handle locked/ACL-protected files offline — either take ownership from a clean OS/restore environment or delete files from the offline image. On XP-era systems, GUI Security tab or command-line ACL tools can be used when booted into a clean environment.
  5. Treat all credentials as suspect — rotate local and administrative passwords, check database/service accounts, and scan other network hosts and removable drives that touched the infected disk.
  6. Reimage if doubt remains — if persistence mechanisms can’t be fully proven removed, a full reinstall from known-good media is the only certain recovery.

Practical examples (run from a trusted admin workstation):

# open a SYSTEM shell with PsExec (Sysinternals)
psexec -s -i cmd.exe

# grant Administrators full control to a folder (XP-era tool)
cacls "E:\infected_folder" /E /G "Administrators":F
rd /s /q "E:\infected_folder"

Because reported cross-infection via attached media, imaging and offline cleaning are especially important. The suggestions by and (alternate scanners and logfile collection) are sensible as part of the process; ’s note about web-delivered components is worth remembering when auditing browser plugins and recent site access. When persistence is confirmed or credentials are likely exposed, reimaging and credential rotation are the safest next steps.

Recommended Answers

All 3 Replies

Member Avatar for Godsp3ed

Download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then

click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily.
* Immediately Reboot the computer..

Then Download

Trend Micro HijackThis 2.0.2
Install it and click on 'Run a scan and save the logfile'.

Provide the logfile of MBAM and Hijackthis Here..

Member Avatar for MidiMagic

I thought something like this was happening, and found out that a website I access for my job was installing software on my computer without my permission. It was a player needed to use the website. This might be happening to you.

Have we gotten to the point where websites have the right to install programs on our computers without first asking for permission?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.