Help. FDISK and FORMAT(ed) hard drive and VIRUS is still present!

[Wyluli]

I'm trying to fix a computer for our neighbor. It appears to have a nasty virus on it. I fdisked and formatted the hard drive, but I'll be darned if the evil virus isn't still there. I am guessing it must have infected the master boot record?
How can I get rid of it????

I can't install any anti-virus software or anything. The virus will not allow any programs to run. I can boot into safe mode.

O/S is Windows XP home edition

 

[Apokalipse]

go to the XP recovery console, and type 'fixmbr' and 'fixboot'

 

[EricB]

download the utility in my signature it will erase the mbr too.

 

[Wyluli]

So doing a low level format will erase the MBR?
Then installing Windows XP Home Edition will get her up and running again?

"go to the XP recovery console, and type 'fixmbr' and 'fixboot'"

I know that doing fixmbr and fixboot does not always eliminate viruses. I'll give it a try tho.

Thanks.

 

[EricB]

So doing a low level format will erase the MBR?
Then installing Windows XP Home Edition will get her up and running again?

yes and yes

 

[TheMajor]

How do you know there's a virus?
Did you scan with AV?

 

[EricB]

most of the time, your AV will miss a boot sector virus

 

[Wyluli]

How do you know there's a virus?
Did you scan with AV?

I know there is a virus because the system is all screwed up. Programs keep popping up and .exe files do not work etc...
There is a program called HWCLOCK.exe running in task manager which appears to be malicious.

I did a low level format, reloaded everything, the computer is STILL infected.

I guess I will try going into safe mode and see if I can delete this file from there. (when I try to delete it, it does not allow me to do so from windows)

This is a really evil virus, formatting didn't get rid of it, it spreads like wildfire, anti-virus can't clean it all out. I'd love to get hold of the person that wrote it and bash there head in.

 

[ShadowFalls]

when you went and did all that, it did infact remvoe the virus... what happened is you got it again, are there any other computers on the network? did you have the network cable plugged in (internet access) were you running a firewall at anytime?

 

[EricB]

I know there is a virus because the system is all screwed up. Programs keep popping up and .exe files do not work etc...
There is a program called HWCLOCK.exe running in task manager which appears to be malicious.

I did a low level format, reloaded everything, the computer is STILL infected.

I guess I will try going into safe mode and see if I can delete this file from there. (when I try to delete it, it does not allow me to do so from windows)

This is a really evil virus, formatting didn't get rid of it, it spreads like wildfire, anti-virus can't clean it all out. I'd love to get hold of the person that wrote it and bash there head in.

do you do the full format with the power max ultility? they have 2 option. high and low level