Re: w32.ircbot: advice appreciated

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 01/16/05

Date: Sun, 16 Jan 2005 14:03:16 -0500

1) Download the following three items...

         McAfee Stinger

         Trend Sysclean Package

         Latest Trend signature files.

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the signature files (pattern files) by obtaining the ZIP file.
For example;

Extract the contents of the ZIP file and place the contents in the same directory as

2) If you are using WinME or WinXP, disable System Restore
3) Reboot your PC into Safe Mode and shutdown as many applications as possible
4) Using both the Trend Sysclean utility and Stinger, perform a Full Scan of your
        platform and clean/delete any infectors found
5) Restart your PC and perform a "final" Full Scan of your platform using both.
6) If you are using WinME or WinXP, Re-enable System Restore and re-apply any
        System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
7) Reboot your PC.
8) If you are using WinME or WinXP, create a new Restore point

* * * Please report back your results * * *

<> wrote in message
| Hi, I`m hoping someone can advise me on the following virus issue:
| I seem to have become infected somehow, not exactly sure how, with
| w32.ircbot which NAV says it`s deleted, but it seems to have done the
| following damage to my system; removed my ebay toolbar, which I fixed
| by reinstalling it from ebay, caused the system to hang at random, and
| the screen to go black, equally at random, which didn`t respond to me
| touching the mouse or keyboard, as a screen saver would, only thing I
| could do was switch pc off and on again. I reinstalled windows, (I`m
| using 98se) which seems to have solved those issues. It also changed
| some file associations, ie zip files became associated with winzip,
| but I use winrar as default, and bizarrely, jpg files also became
| associated with winzip (which obviously wouldn`t open them). I fixed
| this by reinstalling winrar and my picture viewer. That`s all the good
| news. The bad news is (and I don`t know how bad this is) is that it`s
| done something to my system time/date. When I tried to run winamp it
| told me there was an error with my system date, so I rebooted, and
| went into CMOS, and the time was correct, and the date and month, but
| the year was 2003 instead of 2005. I changed it, and then later I
| noticed that all the folders in win explore are displaying the same
| time/ date, 14th Jan 2003 01:26 am . Then I noticed that all (yes ALL)
| of the files on my pc other than a few that were created later than
| that time, are saying the same time/date!! So I can`t sort the files
| in any folder by last modified, as they all have the same last
| modified time/date! If I right click on a file and display properties,
| it says the file (any file at all) was modified on the above time /
| date, and it was created on December 31st 1979 at 23:15!
| Am I right in thinking that, to a computer, anything before Jan 1 1980
| is prehistory, and therefore just "undated"?
| More importantly, what damage is this doing to my system, and most
| importantly of all - What can I do about it?
| Thanks for any help anyone can give me
| Mark