Getting a message while booting in XP "surabaya in my birthday" Please help

Status
Not open for further replies.
ajayritik

ajayritik

Technomancer
Whenever I start up my PC I get the following message:
81u3f4nt45y-24-01-2007 surabaya
surabaya is my birthday
don't kill me i m just send massage from your computer

I have formatted my C: and reinstalled Windows XP but still the problem persists. Do I have to format all the drives? I tried installing Kaspersky and scanning my computer but after installing it I'm unable to scan my PC. I tried installing NOD 32 and then I get a message repeatedly from NOD 32 telling system infected by WIN32/Satity.Nam virus. Even after I click on delete that window comes up back again asking again to delete.

I have tried to search for a fix for this but didn't find anything substantial on the net. Has anyone experienced this problem?

One more thing this is not my PC this is my friend's PC. He doesn't have internet at home so we can't update the antivirus definitions.

Please help!
 
Ecko

Ecko

Wandering In Tecno Land
Try Avast 4.8 & choose Yes when asked 4 bootitme scan on installation
 
OP
ajayritik

ajayritik

Technomancer
Which antivirus is free as well as we can download the definitions from the internet and then update them? As my friend doesn't have internet at home.
 
raksrules

raksrules

Youngling
Go for Avast. It is free (you do need to register). You can also find it in the Digit CD/DVD under essentials. There are updates available in the magazine CD/DVD too. Incase you have internet connection at home, avast will update the virus definitions so you need not worry about that.
 
R

rakesh14021983

Broken In
Firstly ... the virus is called Win32/ Sality and NOT Satity (i think??) ...

check the link given below.. it has detailed instructions for removal of the same.
*www.symantec.com/security_response/writeup.jsp?docid=2006-011714-3948-99&tabid=3

Also, you could do an online scan here ---> *www.pandasoftware.com/products/activescan.htm

Note: If u use avast, then u will get a false alert when you try to download the activex for Panda...

Also... try doing a scan with Hijackthis and post the log... it shud tell us wat nasty entries u got...

Hope this helps..
 
OP
ajayritik

ajayritik

Technomancer
Do you think formatting all the drives will solve my problem? As I have mentioned the problem is with my friend's PC and he doesn't have internet at home. If at all I try to get the logs of hijackthis from his PC and then copy to my PC to post it here then my PC also may get infected with this worm. Anyways I will try the resolutions provided here. Thanks to all of you for your responses.
 
OP
ajayritik

ajayritik

Technomancer
It's been years since I did a low level format. I remember doing it using the DM CD which came with my Seagate Hard disk. Do we get any other tools with which we can do a low level format?

Can you let me know more about flashing the MBR? Do I have to do it before formatting or after formatting.

Also as I mentioned earlier I had formatted the C: but still the issue persisted. Do you think this could have come from other infected drives which I didnt format.
 
thewisecrab

thewisecrab

AFK
Perform an AV scan with NOD32 or Kaspersky Trial versions (the trials should suffice for removing the stupid virus)
I advise against formatting if you have too much data on your entire HDD, not C: drive alone as I guess the virus must have created entries in the roots of the other drives.
Try this:
*www.techsupportforum.com/security-...p/220766-81u3f4nt45y-24-01-2007-surabaya.html
 
OP
ajayritik

ajayritik

Technomancer
thewisecrab said:
Perform an AV scan with NOD32 or Kaspersky Trial versions (the trials should suffice for removing the stupid virus)
I advise against formatting if you have too much data on your entire HDD, not C: drive alone as I guess the virus must have created entries in the roots of the other drives.
Try this:
*www.techsupportforum.com/security-...p/220766-81u3f4nt45y-24-01-2007-surabaya.html
Click to expand...

Dude I had installed Kaspersky trial version but it was not working. When I try to scan using Kaspersky I found it to be disabled. Then later when I installed NOD32 it did find the Sality.NAM virus which was detected multiple times and later the PC hung or got stuck.

Data is not an issue since there isn't any critical data in the other drives. The only concern is that the virus shouldn't resurface again so I wanted to be cautious about it.
 
T

TheIndian

Right off the assembly line
Use INNOBATE AntiGen to detect this worm on your computer system for free. It can be also removed with this software specifically designed to remove this threat from your computer system.

Download it from:- *www.thedownloadplanet.com/catalog/item/64333/ and also downloaded directly from the software publisher's website:-
*www.innobate.com/Products/InnobateAntiGen/Index.HTM

This software will remove this virus from your computer system.
 
prateek007391

prateek007391

In the zone
Go to Start ----------> Run

Type system.ini

and tell me what is written there

also download HijackThis

*www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

install it on you system and run a system scan and generate report and then

and send me the report
 
OP
ajayritik

ajayritik

Technomancer
TheIndian said:
Use INNOBATE AntiGen to detect this worm on your computer system for free. It can be also removed with this software specifically designed to remove this threat from your computer system.

Download it from:- *www.thedownloadplanet.com/catalog/item/64333/ and also downloaded directly from the software publisher's website:-
*www.innobate.com/Products/InnobateAntiGen/Index.HTM

This software will remove this virus from your computer system.
Click to expand...

prateek007391 said:
Go to Start ----------> Run

Type system.ini

and tell me what is written there

also download HijackThis

*www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

install it on you system and run a system scan and generate report and then

and send me the report
Click to expand...
Dear Friends it's been so long since I had that problem. It has been rectified long back. Anyways thanks for timely response from both of you!
 
prateek007391

prateek007391

In the zone
yes I realised this when I posted on ur thread

I don't know how this thread appeared on my CP, I never subscribed for it

This is just because of that "TheIndian" spoiling his name and the name of crores of Indians, he wasted his first post on such an old article

May be he is too new
 
it_waaznt_me

it_waaznt_me

Coming back to life ..
Though OP's problem was solved by formatting the system,this is for the benefit of others who get the same problem, here is the simple cure for it: Most infected files wouldve been removed by the antivirus , but to remove the stupid message at startup, you need to delete two keys from registry :
Start > Run > Regedit {Press Enter}
Navigate to
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
And delete LegalNoticeCaption and LegalNoticeText keys and you wont get that prompt at startup.
 
Status
Not open for further replies.
Top Bottom