Virus or system failure

[lonewolf]

Hi my friend called me and I went to his house. His XP had stopped working properly. He said he turned it on and it took a long time to get to the desktop then it just showed the wallpaper for about 5 minutes then the icons slowly started coming on. It took another 5 minutes before they were usable but anyhting you tried to run was real slow or didn't run at all.
I checked the ATA controller and it said it had downgraded the UDMA speed because of multiple transfer errors. I ran a diagnostic on the drive and it came back saying the file system had errors in the index.
We tried doing a repair using the XP CD and during the install this came up in a DOS window.

C:\windows\system32\drmupgds.exe (along the top)

The text was:

$ Attack :::: Coming Soon
>> Call Me #SIOUX# ?Virus

Is this a virus or has he been hacked.
I've never seen this before.
After the reinstall it was working pretty good until we loaded SP2 on then it went right back to the same thing. It boots to a desktop wallpaper and it takes 5 minutes for the icons to show. During the 5 minutes I can bring up task manager anytime and it doesn't show any program hogging the memory.

This is XP Pro, 160 GB Maxtor hard drive, K8N Asus MB.
LG DVD-RW, 1GB RAM.

Any help would be appreciated.
Dave.

[Robert M]

Did you see if anyone tampered with the CMOS settings for the hard disk or any other settings in the CMOS?

What diagnostic did you run?

Where did you see the message about UDMA? With Device Manager? With the Diagnostic?
Not familiar with that message, but it certainly seems ominous.

Do you have a bootable floppy or CD you can boot from that contains a virus scan program?

[lonewolf]

Checked the CMOS settings it seems normal. The only thing not enabled in the hard drive section is 32bit transfer.

I ran Seatools it said the everything was good except when it ran a file system check and said the index had errors.

UDMA was in device manager, actually since the reload it says UDMA 6 now and that message is gone.

He has Norton installed and ran it in safe mode, the computer works in safe mode. It came back with a virus but he didn't write it down. He deleted the file. It was a W32 Cal.... something like that.

I tried the shellfix.reg fix but that didn't work.

[dunedin]

Hello lonewolf

File system errors, run chkdsk /r
Start/Run and type
cmd
OK

At the prompt type
chkdsk /r (there is a space before /)
ENTER

Elaine