Member Avatar for MinstrelPA

I am currently on a Gateway laptop because I cannot boot my other computer. The problematic system is running WIN XP w/SP3. I somehow picked up a virus called Win32.virut.ce. As I was trying to extract it by running Norton Internet Security's Anti-Virus, Spy-bot Search & Destroy, MalwareBytes and Panda Online Anti-Virus, it just kept replicating and downloading more and more viruses and spyware. At this point, I tried to restore the registry with a 3rd party application called RegCure. This is where the trouble occurred. Apparantly, the OS couldn't recognize the restore file and it changed the Boot Record to one that was possibly corrupted, either by the virus or to one that was too old to be recognized by the OS. Now I'm in a constant re-boot loop. I can't access Safe Mode, Windows Directory Repair mode, or even the Recovery Console. I keep getting a BSOD and the system re-boots. HELP! I just got the system back after a major upgrade and I didn't have a chance to do a system backup! I can't afford to lose all the data on the OS, it is over 300 GB filled with personal data, music files, business data, etc. There is no way I can transfer it to DVD's, there is too much data. Is there anyway I can get back to my MBR and continue extracting this virus?

  • 3 Contributors
  • 5 Replies
  • 212 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by MinstrelPA

Dani AI

Generated

describes a classic, high-risk scenario: a Win32.Virut variant plus a third‑party registry change left the XP system in a boot loop and unable to reach Safe Mode or the Recovery Console. Priority one is data preservation — the infection and an unstable repair attempt both increase the chance of permanent loss.

First-step checklist (preserve before repairing). Remove the laptop disk or attach it externally (SATA‑to‑USB or install as a secondary drive). Make a full sector image of the drive to an external disk (tools commonly used for this are Clonezilla, dd/ddrescue, or imaging utilities like Macrium). Imaging captures the current state and allows later forensic recovery if a repair goes wrong. If imaging is impossible, copy only personal data (user profile folders, Outlook PSTs, My Documents, Desktop, pictures, music) — avoid copying .exe or unknown binaries because Virut is a file infector and will carry in executables.

If the Recovery Console is usable, the canonical XP repair steps are:

fixmbr
fixboot
chkdsk /r

Those commands must be run from the XP Recovery Console. Because ’s suggestion to use the install CD failed with a BSOD, use a different boot environment: a reputable AV rescue disk, a Windows PE / WinPE-based repair USB, or a Linux Live CD to run offline scans and attempt MBR repair. As noted, attaching the disk to a clean machine is a sensible way to access and copy data without booting the infected OS.

Final steps: treat the OS as compromised — even after MBR repair, a full reinstall of Windows (format the Windows partition) is the only way to guarantee removal of file‑infecting malware like Virut. Before restoring any user files, scan them with up‑to‑date antivirus on a clean system. If local recovery is not comfortable or time‑sensitive, handing the drive to a trusted technician for imaging and data extraction is a reasonable course.

Recommended Answers

All 5 Replies

Member Avatar for reganstar

It's no need to lose all data, it's your HDD partitioned ? Always you can access recovery console from installation disk!

Member Avatar for crunchie

The only way I think you can save your files is by removing the HD and connecting it to another pc and copy the files over.
The virus you have calls for a reformat. There is no other guaranteed way to remove it.
This virus infects executable files, so be careful what you transfer.
Here is the link I posted in your other thread; http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html
Please do not double post.

Member Avatar for MinstrelPA

Yes, my HD is partitioned into C/D/E/F with the OS and User accounts on the C:\ drive. I've tried booting into the Recovery Console from the WIN XP CD, but it goes through the load screen then goes to a BSOD and back into the boot loop.

Member Avatar for crunchie

See my post above yours.

Member Avatar for MinstrelPA

Yes crunchie, thanks for the reply. I did see your posted reply. I just wanted to reply to reganstar so he didn't think I was ignoring him. Thanks for the input, sending the system to my techie nephew for recovery/blasting!~minsrelPA

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.