Re: What infection might these "symptoms" indicate?

From: Cliff Wragg (cliffwraggnospam_at_nospamcsi.com)
Date: 07/07/04 

Date: Wed, 7 Jul 2004 18:22:26 +0000 (UTC)

Yes....I have a friend with exactly the same problem.

Eventually, we found that he had 4 trojans on board (BOClean was the
only program that could catch them). They were: wserv32, pornkey,
keylogger and netsky.

One or all of them shut down all the protection such as ZoneAlarm and
Norton and AVG.

After many attempts to cure the problem, we had to reformat the drive
and reinstall XP. The damage was too great. Even then, I had to do it
twice because first time I reimported the rogue emails when I restored
his data. (I needed to scan the back-up CD and avoid the culprits)

Good luck

CliffW

In article <3yuGc.6863$oD3.5505@newsread1.news.pas.earthlink.net>,
garret@garretswayne.com says...
> I'm posting this in behalf of a friend of mine whose computer seems infected
> with a worm or virus of some sort. Here are the "symptoms":
>
> 1. Somehow her Internet Exporer is prevented from visiting the Norton or
> McAfee websites for help. Whenever she navigates to one of these anti-virus
> sites, she gets a "This page cannot be displayed" error. She can visit
> other sites on the web, but not these anti-virus sites. We haven't tried
> them all, just the two primary ones I know of--Symantec (Norton) and Network
> Associates (McAfee). And the sites are not just "down". I check with my
> non-infected computer, and those websites display fine. But she can't from
> hers.
>
> 2. I got her a copy of Norton Anti-Virus 2004 and installed it on her
> machine (a Sony Vaio lapton running Windows XP home edition). Supposedly,
> it installed fine. But whenever we'd try to execute the AntiVirus program
> or the Live Update program, it would open a window and start executing, but
> then the window would unexpectedly and inexplicably close. Like the program
> was being internally terminated by something.
>
> 3. She's noticed some other odd behaviors but can't exactly describe them.
> But outside of what's mentioned above, her computer seems to function fairly
> normally. She can get her email, she can surf the web, just not the sites
> mentioned above. But she's scared to do any of that because she doesn't
> have any functioning AV protection.
>
> Do any of you AV experts out there know what kind of infection might cause
> symptoms like these? We installed Norton Anti-virus software, but the
> apparent infection is not allowing it to execute! What shall we do? I
> presume the first step is to identify and get rid of the current infection
> which seems to prevent the AV software from running. Is there a way to
> maybe boot up her computer in DOS and run the AV program from DOS? But if
> this infection is a very recent one, the AV program running under DOS
> wouldn't be able to detect or fix it unless the program could first obtain
> the most recent file updates. And there's no easy way to get the computer
> to go online and do that under DOS, correct?
>
> Anybody have a solution? Or can you point us to where we might be able to
> find a solution? Any help or advice would be most appreciated.
>
>
> =-=-=-=-=-=-=-=-=-=-=-=-=-=
> Garret Swayne
> garret@garretswayne.com
> www.garretswayne.com
> =-=-=-=-=-=-=-=-=-=-=-=-=-=
>
>
>
>

Relevant Pages

  • Re: What infection might these "symptoms" indicate?
    ... if these are the only 2 site you can't get to try for google ... But whenever we'd try to execute the AntiVirus ... >> Do any of you AV experts out there know what kind of infection might ... >> maybe boot up her computer in DOS and run the AV program from DOS? ...
    (microsoft.public.scripting.virus.discussion)
  • Re: What infection might these "symptoms" indicate?
    ... Yes....I have a friend with exactly the same problem. ... But whenever we'd try to execute the AntiVirus program ... > Do any of you AV experts out there know what kind of infection might cause ... > maybe boot up her computer in DOS and run the AV program from DOS? ...
    (microsoft.public.scripting.virus.discussion)
  • Re: What infection might these "symptoms" indicate?
    ... if these are the only 2 site you can't get to try for google ... But whenever we'd try to execute the AntiVirus ... >> Do any of you AV experts out there know what kind of infection might ... >> maybe boot up her computer in DOS and run the AV program from DOS? ...
    (microsoft.public.security.virus)
  • Re: What infection might these "symptoms" indicate?
    ... Somehow her Internet Exporer is prevented from visiting the Norton or ... But whenever we'd try to execute the AntiVirus program ... > Do any of you AV experts out there know what kind of infection might cause ... > maybe boot up her computer in DOS and run the AV program from DOS? ...
    (microsoft.public.scripting.virus.discussion)
  • Re: What infection might these "symptoms" indicate?
    ... Somehow her Internet Exporer is prevented from visiting the Norton or ... But whenever we'd try to execute the AntiVirus program ... > Do any of you AV experts out there know what kind of infection might cause ... > maybe boot up her computer in DOS and run the AV program from DOS? ...
    (microsoft.public.security.virus)