Viruses, DVD burning, external drive questions...

bill-kranz wrote on 2/11/2010, 7:19 AM

Salutations!

I am having troubles getting my Sony Vegas Pro .avi movies to record to a DVD-R internal drive due to a viral infection. My main DVD recorder crashes with an "Access Violation" message or just cannot complete/hangs in the burning process.

The virus is a 2003-originated worm called W32.BLASTER.WORM that jumps in through networking TCP Port 135 via DCOM/RCP (Remote Call Procedure.)
My AVG 8.0 – free version – and Windows Firewall failed to block this worm attack. One of the tell tale marks it leaves are the words "NT AUTHORITY SYSTEM."
These words are in my User ID with AVG and also in my listings of startup programs via System Explorer views. These listings are mainly a flood of .dll's and number 82 pages double-spaced type.
My desktop machine does not do the close down in "X" seconds as some folks who have been infected report. The main effects are the listed, visual evidence, the balky DVD burner, and a slowed down system. For instance it takes about 5 minutes for my Sony program to launch.

I have an older non-networked PC that I can use and here is my main question. I have .avi movies stored on an external Firewire Accomdata hard drive. I want to take this drive off the infected machine and hook it up to the older PC and burn my movies there on the DVD burner. Will doing this cross-infect this second PC? I have a wild assortment of files on the drive. Sure I can scan it for viruses and such but someone told me doing this would carry the virus to the older desktop that is safe at the moment.

What are my other short-term options to burn these .avi movies? (if I can't get this virus patched?)
Wireless transmit?
Take the external drive in to a business that could burn them?
Buy a new external drive, load up one movie at a time, take to old machine, etc.
What are your ideas?

Any advice appreciated. I am using these movies to help build up my theatre venture.

Thanks,
Bill K.

(I am sending this in part in case others get infected and can learn what to do if I get ideas other than reformat my entire system or pay money for the Geek Squad to help me...)

Comments

Former user wrote on 2/11/2010, 7:22 AM

I am no expert on viruses, but I would certainly not move any drives or files until I removed the virus. If it is that invasive, there is a good chance is has infected all connected drives or files.

Have you tried other virus programs or online virus scanners to help get rid of it?

just my humble opinion.

Dave T2

bill-kranz wrote on 2/14/2010, 7:01 AM

DaveT2:

Hi. Thanks for your reply.
I am going ti implement the patch and hope for the best.

Will post an update later.

Thanks,
Bill K.

lynn1102 wrote on 2/14/2010, 5:24 PM

If you google that virus, there are all kind of fixes. Symantec has a removal tool listed, but I'm not sure it's still good. It can be done manually, but takes time. Instructions can be found using google. I'm pretty sure the window virus tool will get rid of it. I had it many years ago and it was a real bummer trying to get rid of it.
I would make that my first priority before doing anything else.

Lynn

bill-kranz wrote on 2/14/2010, 8:19 PM

lynn1102 and viewers:

I ran the Symantec patch and it said the Blaster virus was not found. I dl'd the Windows update in question and it said that update had been performed already.(Which it had, my security updates for XP are current.)
My free AVG has been scanning and putting various Trojans, viruses and cookies in the quarantine area.
My Windows Firewall has been enabled.
Now I plan to scan with Malwarebytes and see what happens.
The Kaspernisky scanner wants you to first DL a trial version which I am not going to do.
I plan to defrag the rest of my system and see if that improves anything.

Then I'll try to burn another 37 minute DVD .avi and see what happens.

The big question is is who is "NT AUTHORITY SYSTEM" ????????????

Thanks!!
Bill

bill-kranz wrote on 2/14/2010, 10:20 PM

Update:

The Malwarebytes did a great job for a free scan.
It found 250 malwares and 2 Trojans. trojan.downloader and trojan.vundo
They have been deleted.

I will now do my defrag process and check my user id's later.

One other new problem has cropped up. My Accomdata external drive has had the "In Use" red/blue lights flickering non-stop. I didn't do the Malware scan on it at first. Now my Explorer view shows zero files on it. It is hooked up properly, I will research this also.

Thanks,
Bill

ushere wrote on 2/14/2010, 10:33 PM

i would, given your position, simply wipe everything and start again from scratch with os and program install!

i should imagine your video files are ok, but can't advise how to copy them without, perhaps, transferring a virus etc.,

obviously you, or someone has used your computer to go places where no novice should go.

if you're doing video professionally, get another 'cheap' pc to connect to the net.

practice safe cyberspace ;-)

amendegw wrote on 2/15/2010, 3:23 AM

Bill,

Some suggestions when using Malwarebytes (a very good tool, IMHO).

1) Turn your system restore off. Sometimes the bad guys hide there and re-appear. You can turn it on again after you're through.
2) Run Malwarebytes in Safe-mode (make sure the updates have been applied in "normal" mode i.e. via the internet).
3) Reboot and run Malewarebytes again - sometimes it takes two passes to remove everything (don't know why).

Good Luck,
...Jerry

bill-kranz wrote on 2/15/2010, 6:46 PM

Well those who have been following my struggles with the evil minions of the internet the news is not good.

Despite no fixed indication I even had the blaster worm from the standpoint of Malwarebytes I now have a locked up external hard drive. My test burn of a .avi. through AVS Video Burner gets a 8-9 minutes into it then cancels out. The drive makes a clunky looping sound, the drive light flashes on and off and just nothing else happens. It's in a endless loop of death.

My main programs seem okay and I can use Vegas Pro, I can access safe mode, I can defrag okay, etc. I have sent a request for help with Accomdata maybe the drive had a mechanical failure. And maybe the ASUS DVD Burner went belly up also. Both could have nothing to do with a Trojan or Worm infection.

It would not be terribly expensive to get a used or new DVD burner and test that aspect for now. I can take in the other drive for someone to get at the 180 GB of files inside it and see whats left. I do not want to reformat it at this point. Most of that data can be re-created or was not original files.

I am using the Internet as little as possible and unhook the Ethernet cable when I am away from the machine.

God Help Us, God Help Us All...

Bill

bill-kranz wrote on 6/3/2010, 9:39 PM

Hi.
I just want to add that Accomdata has totally failed me in any sort of help with their locked up
drive unit. "F"

If I have to get a new external drive I will shop elsewhere.

Bill