Re: trojan.vundo.b

From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 04/30/05


Date: Sat, 30 Apr 2005 08:15:44 -0400

From: "Claire" <Claire@discussions.microsoft.com>

| Dave,
|
| I have norton antivirus, will this work for me as I have downloaded
| 'CLEAN.exe' from the URL and then I got to the bit after where you have to go
| to c:\mcafee\getfiles.BAT and realised that I probably didn't have this as I
| on Norton AntiVirus
|
| HELP!!!
|
| Thanks
|
| Claire

Claire:

This is a standalone utility that can be used in conjunction with *any* anti virus.

After you execute CLEAN.EXE, a c:\mcafee folder will be created and the needed files will be
in there.

When you execute; c:\mcafee\getfiles.BAT it will FTP the nedeed scanner files and once
that is complete you acvn then go to the next phase which is to reboot into Safe Mode.

When you are in Safe Mode you will then execute; c:\mcafee\Clean.BAT which will actually
perform the scan process. When the scan is completed it will display a HTML Log file in
your browser.

Here are the general instructions again (and note that there is a PDF help file placed in
c:\mcafee)

GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
Scanner. If you are using Windows XP, you may have to disable the Windows XP FireWall to
allow the FTP utility to download the needed files.

CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
to scan again at a future date, run this batch file. It will automatically check the date
of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
signature files and install them before performing the scan.

DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
you have booted from an Emergency Boot Disk or DOS disk and have already executed;
c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
http://www.bootdisk.com/bootdisk.htm

I need you to perform the following...

Execute; CLEAN.EXE
Choose; Unzip
Choose; Close

Execute; c:\mcafee\GetFiles.BAT
{ or Double-click on 'GetFiles Link' in c:\mcafee }

Reboot the PC into Safe Mode [F8 key during boot]

Shutdown as many applications as possible !
It would also help for you to read - "How to perform a clean boot in Windows XP"
http://support.microsoft.com/kb/310353

Execute; c:\mcafee\CLEAN.BAT
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (FireFox or Internet Explorer). It is
suggested that you move the report out of c:\mcafee before performing another scan. It
would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
report for each session. I would very much like a copy of the report(s) and your findings.

I guess that should do it for now Claire...Good Luck !

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


Relevant Pages

  • Re: Tips on removing spyware
    ... > After being hacked 7 times by spyware. ... to the latest definitions and you may need to run them in safe mode as well. ... I'll mainly work around Windows XP, as that is what the bulk of this ... and some you can only download if you are registered - but it is best ...
    (microsoft.public.security)
  • Re: svchost.exe is a virus! HELP!
    ... I was being sarcastic when I said that svchost.exe is itself becoming a virus ... I have updates all the recomended Windows Update fixes, patches, windows ... AV & A-S scan in safe mode. ... Download David H. Lipman's MULTI_AV.EXE from the URL ...
    (microsoft.public.windowsxp.general)
  • Re: Winsock
    ... System Administrator ... If you are using Windows XP, you may have to disable the Windows XP FireWall to ... > allow the FTP utility to download the needed files ... > Execute; CLEAN.EXE ...
    (microsoft.public.win2000.general)
  • Re: Iexplore listed in task manager.
    ... Download CLEAN.EXE from the URL -- ... CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. ... DOS disk boot images can be obtained from; ... Execute; CLEAN.EXE ...
    (microsoft.public.windowsxp.general)
  • Re: Blaster Worm Help-URGENT
    ... Can you boot to safe mode? ... because when windows starts up, immediately a window opens up with RPC ... > How do you know that you have the Lovsan/Blaster worm? ... > This will halt the shutdown and give you a chance to Download the McAfee ...
    (microsoft.public.windowsxp.security_admin)