General discussion

Locked

Possible Virus? Has anyone seen this?

By BobbyJGR ·
I have 6 Windows 2000 Pro pc's with service pack 2 and some with Service pack 3. When the pc's boot up you are able to login but that is it, I never get to the desktop just an hour glass. If you are lucky enough to get to the desktop things happen such as, when you open task list it opens then closes instantly. We are running Symantec Corp. Edition 8.1 and that also is not working either, and I noticed the service for Symantec is not turned on, whenyou try to manually turn it on I recieve an error that it can not start. Do I have a virus of some sort? Just a note the pc's do come up in safe mode but Symantec still will not run.

Thanks,

Bobby

This conversation is currently closed to new comments.

8 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by w2ktechman In reply to Possible Virus? Has anyo ...

are these roaming profiles?

If not try logging in as another user or administrator and see if the problem persists. If it does, I would look into the software running for all users, if not, I would look into either the NTUSER.DAT being corrupt, or a startup program which is user specific.

Collapse -

by rindi1 In reply to Possible Virus? Has anyo ...

It does sound like some sort of Virus or worm, like sasser. To check if your disks are clean or not you may want to put the disk into a PC of which you are sure it is virus-clean and has an up-to-date antivirus software and an OS which can read ntfs (i'm assuming your partitions are formated "ntfs"). That way you can scan your disks for Virus and should be "cleanable". Otherwise, i have a Bootable linux CD which has a antivirus software on it and with which you can download the newest definitions and check your drive. I've made an iso image of that cd and could upload it to some place on the internet for. The problem is the size is over 700MB and that size I can't mail to you, if you now an ftp site with enough space you can send me the necessary info, so i can send to that ftp site for you...

Collapse -

by djrampant In reply to Possible Virus? Has anyo ...

We had excatly this last week.

It turned out to be a virus using an file called securitychk.exe.

Boot into safe mode and search for this file, if it exists search the registry for it's name and delete any references to it. This stops it running at startup.

Then do a full system scan and hopefully norton will pick it up.

Any problem please let me know.

Thanks

Collapse -

by BobbyJGR In reply to Possible Virus? Has anyo ...

securitychk.exe is not on any machines. I did find ieupdate.exe in winnt\system32 and I deleted it and deleted any reference to ieupdate from the registry at that point the pc did boot up I ran Symantec with the latest virus def. file of 9-28 but it found nothing. Problem is when I shutdown and then turn the pc back on IEUPDATE.EXE is back and the pc again just hangs and never gets to the desktop. It does however allow you to logon, but thats as far as it goes again I delete ieupdate and any reference to it in the registry and it will then boot up. HELP we now have 9 pc's doing this.

Collapse -

by rindi1 In reply to Possible Virus? Has anyo ...

You should try to scan the system for viruses with the help of a program that isn't already installed on your pc. Viruses often attach themselves to known antivirus Programs preventing those from finding the virus. That's why you should try to scan and clean the disk from a known clean installation. You can of course also try what you did before (remove ieupdate in safe mode, also take all you can out of autostart etc). Then install a new antivirus software, There's a good free one you can download from http://www.avast.com, get the newest defs and then do a thorough scan. that program should then also be able to clean your nav.

Collapse -

by BobbyJGR In reply to Possible Virus? Has anyo ...

Thank you all just to let you know we had to submit ieupdate.exe to Symantec and they found a new variant of w32.sybot.worm which they are now in the process of repairing. Leave it to us to get a new variant but as of tonight all should be well

Collapse -

by BobbyJGR In reply to Possible Virus? Has anyo ...

This question was closed by the author

Back to Windows Forum
8 total posts (Page 1 of 1)  

Related Discussions

Related Forums