Re: Did an online scan wondering if I have a virus or remants of headers

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 02/28/04 

Date: Sat, 28 Feb 2004 09:06:08 -0500

Pam:

My suggestion is to delete the posts from the Outlook Express News Reader.

Dave

"Pam" <pfloresatcharterdotnet> wrote in message
news:O$y4iDe$DHA.3188@TK2MSFTNGP09.phx.gbl...
| Hi: I'm posting this a second time in case my first subject
| line was misleading. Along with some of you I to got a NAV
| virus alert after
| opening the above post. NAV said it could not clean or
| delete, and it is not in my quarantine file. Nav logs say
| basically the same thing. I ran a scan with NAV, and it shows
| nothing. I'm not worried about this per se, after reading the
| various post's, but I did an online scan at RAV (maybe not the
| best choice) and found several other things from this
| newsgroup and alt.comp.virus.
|
| I'm not having any noticeable computer problems, and I have
| "all" of the MS patches/fixes, properly configured firewall,
| and up to date virus defs. Also, several seconds after the
| NAV alert my firewall blocked an inbound attempt by Ultor
| Trojan Horse. Then I decided to run Adaware and found 68 new
| objects, which is really unusual for me because I generally
| only get 2-3 new objects on each scan.
|
| So my questions are these things related? And do I actually
| have the viruses RAV found? I had a similar problem when
| there were Swen attachments posted to this board, and
| according to Phil, Veronica and an MVP who I can't remember,
| said it was only a matter of removing these from my dbx files,
| and clearing out all the headers from OE news. The problem is
| I don't remember how to do that...
|
| XP Home SP1 -IE 6-xpsp2
|
| Scan results:
|
| C:\Documents and Settings\Default\Application
| Data\Identities\{03FA7420-3FCC-11D3-A1EB-AF89CC02843C}\Microso
| ft\Outlook
| Express\microsoft.public.security.virus.dbx->Message.1721:
| ("?" [Re: swen virus])->(part0000:ZekeZip.bat) -
| BAT/ZekeZip* -> Infected
|
| C:\Documents and Settings\Default\Application
| Data\Identities\{03FA7420-3FCC-11D3-A1EB-AF89CC02843C}\Microso
| ft\Outlook Express\alt.comp.virus.dbx->Message.3384:
| ("sam1967@hetnet.nl" [VIRUS ATTACHMENTS LAUNCHING
| AUTOMATICALLY])->(part0000:)->(part0000:)->(... -HTML/IFrame_E
| xploit* -> Infected
|
| C:\Documents and Settings\Default\Application
| Data\Identities\{03FA7420-3FCC-11D3-A1EB-AF89CC02843C}\Microso
| ft\Outlook Express\alt.comp.virus.dbx->Message.1108: ("Bruce
| Hendry" [Swen questions])->(ContentMismatch*) -
| MIME/ContentMismatch -> Suspicious
|
|
|
|
|
|