Re: HELP ME - ECCI.EXE virus/spyware keeps popping back Find, Notepad

From: Jim Watt (jimwatt_at_aol.no.way)
Date: 08/05/03 

Date: Tue, 05 Aug 2003 03:01:36 +0200

On 4 Aug 2003 17:11:26 -0700, electricbikesguide@yahoo.com (Electric
Bike & Scooter Guide) wrote:

>Is there anyway to get rid of the ECCI.EXE virus that has imbedded
>itself in my PC and keeps on replicating?
>
>I've deleted it several times (using Spybot to halt its live operation
>first) but it is resilient and even learns how to stop Spybot from
>ending it as a resident program.
>
>ECCI.EXE stealhily dials out and can remove ZoneAlarm from memory; or,
>by pass Zone Alarm's dial-out firewall. It has even deleted Zone
>Alarm's alert log.
>
>Right now, ECCI.EXE re-appears if Windows 98's "find" or "notepad" is
>used. However, Eudora doesn't cause it to re-appear, and this is just
>about the only program that doesn't cause ECCI.EXE to reappear from
>the grave.
>
>Using Spybot, I've removed ECCI.EXE from the startup programs, but
>once ECCI.EXE re-appears, the startup program sequence contains
>ECCI.EXE again.
>
>Using "Add/Remove Programs" and the German-made AntiVir9x (a.k.a. Luke
>Filewalker) also causes ECCI.EXE to reappear. Mouse and program
>operations slows down drastically.
>
>Is there a way to get rid of ECCI.EXE with using Find, Add/Remove
>Programs?
>
>This virus appeared on our system on 31 July 2003 possibly by email
>attachment with a subject header that sounded like "Current Currency
>Rates" or similar.
>
>Thanks in advance for all replies.

did you read the message from Colonel Flagg ?

do what he says. 

--
Jim Watt          http://www.gibnet.com

Relevant Pages

  • Re: HELP ME - ECCI.EXE virus/spyware keeps popping back Find, Notepad
    ... > I've deleted it several times (using Spybot to halt its live operation ... > Using Spybot, I've removed ECCI.EXE from the startup programs, but ... > Filewalker) also causes ECCI.EXE to reappear. ... > Is there a way to get rid of ECCI.EXE with using Find, ...
    (alt.computer.security)
  • Re: "cannot find about blank"
    ... I am attaching a screen-capture .jpg file called "screen capture file" that ... In Spybot you have the ADVANCED mode then selecting BHO's & BROWSER PAGES & ... In Spybot you have the STARTUP PROGRAMS. ... Best thing you can do is run Spybot & 'attach' the log file to ...
    (microsoft.public.windowsxp.general)
  • Re: [TECH] Does anyone know about the "Dynamic Media Desktop" adware trojan?
    ... I have other anti-spyware software installed, like Spybot and Adaware, ... How many HDDs are there in the box? ... or shown in the list of startup programs by Winpatrol or XP ...
    (uk.religion.pagan)
  • Re: Explorer opens on startup
    ... Grover wrote: ... I've looked in the startup programs (via Spybot), ... MS-MVP Windows - Shell/User ...
    (microsoft.public.windowsxp.basics)
  • cant get rid of favorites
    ... each time i start internet explorer. ... reappear. ... i've tried using spybot, spysweeper, and i've ...
    (microsoft.public.windows.inetexplorer.ie6.browser)