Re: MS Update incorrectly warns of virus

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 11/07/04


Date: Sun, 7 Nov 2004 15:30:04 -0500


I think you mean you practice Safe Hex not Safe Sex, since this is a computer virus News
Group :-)

Let's make sure....

1) Download the following three items...

         McAfee Stinger
         http://vil.nai.com/vil/stinger/

         Trend Sysclean Package
         http://www.trendmicro.com/download/dcs.asp

         Latest Trend signature files.
         http://www.trendmicro.com/download/pattern.asp

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Dowload the signature files (pattern files) by obtaining the ZIP file.
For example; lpt238.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

2) If you are using WinME or WinXP, disable System Restore
        http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
3) Reboot your PC into Safe Mode
4) Using both the Trend Sysclean utility and Stinger, perform a Full Scan of your
        platform and clean/delete any infectors found
5) Restart your PC and perform a "final" Full Scan of your platform using both.
6) If you are using WinME or WinXP, Re-enable System Restore and re-apply any
        System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
7) Reboot your PC.
8) If you are using WinME or WinXP, create a new Restore point

* * * Please report back your results * * *

Dave

"Jonski" <!spam@nospam.co.nz.invalid> wrote in message
news:hguso09stlm3n7c60pkbrp659kmlac1svn@4ax.com...
| My MS Update subscription is incorrectly telling me I probably have or
| have had a virus, offering me the Mydoom, Zindos, and Doomjuice Worm
| Removal Tool (KB836528)
|
| The only reason I can think it might flag the "virus" is that I have
| MS Taskmon.exe in the windows folder. NOT the one in the %system%
| folder that is a symptom of Mydoom.
|
| I don't have and have never had a virus. I currenlty run 98se,
| Zonealarm and Nod32, practise safe sex, wear sunglasses and manually
| check the registry, ini files, autoexec.bat, startup etc.
|
| I used the Syphos and McAfee descriptions of the infection and went
| through all the things the virus could have done, and none of them
| were on the PC. I'm not promiscuous with the PC (e-promiscuous??) so
| there's no real chance I've caught a virus recently.
|
| How can I stop MS offering me this update that I don't need?
|
| Thanks in advance
| Jon



Relevant Pages

  • Re: Homepage hijack - blank.mht
    ... One extra symptom of this virus -- it seems to have a clock wakeup - after ... The only folder under that folder should be the latest version. ... FireWall to allow it to download the needed AV vendor related files. ... This will bring up the initial menu of choices and should be executed in Normal Mode. ...
    (microsoft.public.windowsxp.general)
  • Re: back door bdd virus
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ... virus scan detects bdd virus which can not be entirely ...
    (microsoft.public.windowsxp.security_admin)
  • Re: javesiterequest.asp what is this error??
    ... Follow all instructions to letter as much as ... How to download and install HiJackThis: ... HOLD, download the programs to that folder, then burn that folder to a CD. ... > I recently removed a file that McAfee Virus Scan said might be a virus, ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Trojan Backdoor virus cannot be removed
    ... (e.g., "c:\New Folder") ... Download sysclean.com and place it in that directory. ... | Symantec corporate addition ver 8.1 says Trojan backdoor no name path ... | I have scanned the hole server with 10 on line & download ant virus programs ...
    (microsoft.public.security.virus)
  • Re: Spybot virus - HELP
    ... (e.g., "c:\New Folder") ... Download SYSCLEAN.COM and place it in that directory. ... If you are using WinME or WinXP, disable System Restore ... | quarantine the virus, but how can we find out the source of this virus. ...
    (microsoft.public.security.virus)

Quantcast