Re: Question - what virus was it?

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 10/27/04


Date: Wed, 27 Oct 2004 11:57:01 -0700

1) Download the following three items...

         Trend Sysclean Package
         http://www.trendmicro.com/download/dcs.asp

         Latest Trend signature files.
         http://www.trendmicro.com/download/pattern.asp

         Adaware SE (personal free version)
         http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download sysclean.com and place it in that directory.
Dowload the signature files (pattern files) by obtaining the ZIP file.
For example; lpt218.zip

Extract the contents of the ZIP file and place the contents in the same
directory as
sysclean.com.

2) Update Adware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
        http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full
Scan of your
        platform and clean/delete any infectors/parasites found.
        (a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform
using both the
        Trend Sysclean utility and Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply
any
        System Restore preferences, (e.g. HD space to use suggested 400 ~
600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point

You can also try some of the below online scanners.

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

Kaspersky:
http://www.kaspersky.com/de/scanforvirus

Symantec:
http://security.symantec.com/

BitDefender
http://www.bitdefender.com/scan/license.php

Freedom Online scanner
http://www.freedom.net/viruscenter/index.html

* * * Please report your results ! * * *

Dave

"Thur" wrote:

> The virus was undetected because Norton was immediately disabled.
> Most of Norton's manual assumes you have windows up and Norton
> files run.
> Running in "Safe Mode" seemed to be useless as all services were denied.
> Trying to tinker in DOS was beyond me as Drive C was unrecognised.
> I thought that the description might have rung a bell with someone.
> I have nothing for Norton/Symantec, therefore.
> Incidentally, they have benefitted because I have bought Norton 2005,
> for what good it might do.
> T.
>
>
>



Relevant Pages

  • Re: heretofind problem
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ...
    (microsoft.public.scripting.virus.discussion)
  • Re: Need help IE uncrontrollable website access
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ...
    (microsoft.public.security.virus)
  • Re: unable to open taskmanager and regedit
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ... | Regedit works OK in safe-mode - taskmanager dosn't. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: DSL Fast but messed up my XP settings- Adware?Spyware?
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ... Reboot your PC into Safe Mode ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Hacked and remote controlled computer
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ...
    (microsoft.public.windowsxp.security_admin)