HDKiller

[madeleine]

I installed Avast a couple of days ago and it detected several infections of which one was called HDKiller. It looked different since it did not say that a specific file was infected with the virus. It was not possible to put it into the chest and since I didn't know anyting about it I ignored it and left it for later. But I have now scanned the computer 4 times since then and Avast cannot find the virus again. Does this mean that it has been taken care of or is there a problem???
Greatful for a response

[DavidR]

- What Operating System are you using ?
- What avast! version and VPS file (virus database) number, e.g. 0630-2 (see about avast!) ?
- What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast Log Viewer (right click the avast icon), Warning section, which should contain details about the detections.

Why was it not possible to put it in the chest (what eror messages, etc.) ?

[madeleine]

Well, the reason to why I didn't give a whole lot of info is that I don't have any  I didn't really look coz I thought I could scan it again and then my plan was to call a friend who was supposed to solve it... however, that did not work and the only thing I know now is that it looked strange since it did not give a lot of info at all. No C-something file as far as I could see.
The only thing I can tell you is that I use Windows XP and Avast! 4.7 but I don't know how much it helps. It is not mentioned in the log viewer which is hope it was a false positive but I'm a bit worried still. If you can figure anything out from this I'd appriciate it. thanx anyway though

[DavidR]

Unfortunately that doesn't help and there is no way to confirm one way or another what it was without being able to either scan again or upload to multi-engine scanner.

If avast hasn't found it again, it could be because it is hidden by something else. Was this detected in the first scan after installation, a boot-time scan ?
If so try that again if you didn't try that. Right click the avast icon, select Start avast! Antivirus, Menu, 'Schedule boot-time scan...' that will run a scan before windows starts but only for the next boot (it doesn't happen each time).

If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode.
Ewido, a.k.a. avg anti-spyware or a-Squared free.

[mauserme]

HDKiller is an older boot sector virus spread by booting from an infected floppy disk.  Was there any removable media in any of the drives when you did the scan?

[madeleine]

Yes, It was detected the first time during a boot-time scan. I have run that twice since then to try to find it but it has not been detected again. During the first scan there was no removable media in any of the drives but this is my parents' computer and they still use floppy disks all the time. I have something called Spyware terminator. It has not found the virus either. Is that equivalent to what you suggested or should I install and run that too?

[Lisandro]

Is that equivalent to what you suggested or should I install and run that too?

It's equivalent but it's not the same... ewido and a-squared could have better detection 

[DavidR]

Yes, It was detected the first time during a boot-time scan. I have run that twice since then to try to find it but it has not been detected again. During the first scan there was no removable media in any of the drives but this is my parents' computer and they still use floppy disks all the time. I have something called Spyware terminator. It has not found the virus either. Is that equivalent to what you suggested or should I install and run that too?

It is indeed strange that it no longer detects it and stranger still that HDKiller as mauserme said a boot sector virus, which would likely to be detected in a floppy or the system memory. If detected in memory avast would usually suggest a boot-time scan, which by you comments not mentioning this, I assume didn't happen. The fact that no floppy was present makes this even more strange.

A google search for hdkiller returns many hits and this is just one and gives a good description of what it is trying to do and the fact that the system may become unstable, so I should check this out and see if any symptoms match, http://www.f-secure.com/v-descs/hdkiller.shtml.

It may be worth doing an on-line scan as a further confirmation one way or another if nothing is detected I guess it is a watching brief to see if anything returns (and make notes).
Bit Defender On-line Scanner
TrendMicro's Housecall
F-Secure On-line Scanner ActiveX required

More On-line Virus Scanners and other useful Links Security-Ops.eu.tt

[madeleine]

Thanx for all your help. I'll try to look those things up and see what I can find out. According to my mom some documents have gone missing but that's all, not other strange bahaviour as far as I have been told. And I guess that could have happened if she has saved them in some strange place on the computer. I'll try the on-line scanners and see what results they come up with. Thanx for all...

[DavidR]

Glad we could help, welcome to the forums.

Let us know what the results turn up.