Computer infected with Win32/Hidrag.A Virus!!!

Status
Not open for further replies.
S

SHell

Broken In
I downloaded an ebook (using Limewire) from the net but it was infected
with Win32/Hidrag.A Virus. The ebook was downloaded in the C: drive
where my OS is also loaded.

The Virus infected all the .exe files not only in C but also in
my other partitions of Hard Drive.(D, E, H).
I scanned my computer using AVG and as AVG doesn't contain a
heal option , I have to delete all the files . :(

Now, many programs are not running and I am not able to uninstall
many of them from Control Panel but XP is still loading.

Plz tell me how to remove this virus. Have I to format only the C drive or all the drives.Also tell, if I have to reinstall the windows again.

I have Windows XP and Red Hat Linux as my OS. If I format my hard disk
will linux will also go and will there be any change in my hard disk partition.

Plz tell me how to solve this problem.

Eagerly waiting for your replies.........
 
R

rajas700

Youngling
The Win32.Hidrag virus has an alias that is known as W32/Jeefo.A. What I want you to do is download the virus removal tool for W32/Jeefo.A from Sophos. Here's the link

*www.sophos.com/support/cleaners/jeefogui.com

If you need more instructions on running the removal tool, here's the link for that as well:

*www.sophos.com/support/disinfection/jeefoa.html

Let me know if the tool discovers anything. When finished, reboot your system.
 
OP
S

SHell

Broken In
Hi rajas007

I downloaded the virus removal tool as instructed by you.
I run it but it didn't show anything.

Plz help.
 
swatkat

swatkat

Technomancer
Download Ewido and install it. Run it, you will receive a warning message saying "Database not found", click "OK" for this. Next in the main screen, click "Update" and click "Start Update".

After the update process, run a "Complete System Scan" and if Ewido finds anything, then choose the option "Clean" and "Perform the same action for all infections" and click "OK".
 
R

rajas700

Youngling
ok.Try this


Your virus is actually called Jeefo. AVG doesn't give any info on it but all the other AV manufacturers do. According to Panda you need to delete several registry keys, reboot and scan and delete any files. (I would run the scan and delete the files before you reboot though). Below is Panda's reg deletions... Good Luck! :D

How to remove Jeefo?

If Panda Antivirus or Panda ActiveScan detects Jeefo during the scan, it will automatically offer you the option of deleting it. Do this by following the program's instructions.

Finally, restore the original configuration of your computer by following the instructions below:

* In Windows Me/98/95 computers, delete the entry that Jeefo has created in the Windows Registry:

HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ RunServices
Power Manager = %windir%\svchost.exe
where %windir% is the Windows directory.

* In Windows 2003/XP/2000/NT computers:

Stop the Windows service belonging to Jeefo by accessing the Start menu, Run option, and typing the following command:
net stop PowerManager

Delete the entries that Jeefo has created in the Windows Registry in order to register itself as a Windows service, which are in the following paths:

HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Enum\ Root\ LEGACY_POWERMANAGER

HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Services\ PowerManager

HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Enum\ Root\ LEGACY_POWERMANAGER

HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ PowerManager
* Restart the computer.
* In order to make sure that Jeefo is completely eliminated from your computer, carry out a full scan of your computer using Panda Antivirus or Panda ActiveScan.
 
anandk

anandk

Distinguished Member
win32/hidrag is virus which affects ur .exe files, en masse. avg and some companies call it hidrag norton & sophos calls it jeefo

first turn-off systemrestore. then from diskcleanup utility, remove all systemrestore files. then use the sophos tool or ewidi, as advised above, in safe mode.

disinfection is difficult, with deletion/reformatting usually being the only option. hope these solutions work out.

see if this helps u
*forums.techguy.org/archive/index.php/t-188580.html
 
Status
Not open for further replies.
Top Bottom