Security

Ask something
Discussion Locked

Got a virus not found by NAV

0 helpful
12 replies

by p.hernandez

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I really need help with this one. I seem to have almost all my users infected with a virus but no one seems to know what it is. A file named avupdchk.exe is running on all of the infected computers and it disables NAV, modifies the host file so you can't get to any anti-virus websites (nai.com, symantec.com, etc.), and does not allow you to cut and paste. I called Symantec and they have no ideas. I tried cleaning it out by killing the process, applying all of the W2K patches, deleting all traces from the registry, and changing the host file back, but no luck. It continues to re-appear. Any help or advice would be greatly appreciated. Thanks.

12 replies

by nikitac

I have been dealing with this very problem. I ran virus tools for several of the viruses, read & followed advice at symantec & microsoft. This virus turned off my Internet Security & anti-virus & at times zaps me with denial of service i.e. can't get online to anywhere. I may be rid of it but I'm not sure.

by nikitac

Here is basically what I did. I have other computers so I used a different computer to download & research the viruses.

turn off system restore
backed up registry

went to symantec & downloaded virus removal tools & burned them to a disk along with info on manually removing each virus. (later I used this info to do searches for individual files just to be sure).

I also downloaded the symantec updates to install manually. I did this because I think whatever was on my system faked me into believing the updates had downloaded when really I don't think they did because I couldn't go online. Plus, I just wanted to cover all bases & get IT off my system.

I also went to Microsoft & downloaded a couple of the win xp updates to reinstall on my infected system-- in hopes that the gaps would be closed that let this virus in.

I ran the virus tools for nimda, doom, blaster- welchia, netsky, beagle - all mention something similiar to what this ghost virus was doing.

The killer was this... I had kept up with all the updates for both symantec & microsoft prior to getting this virus. Symantec anti-virus & security did catch quite a few viruses on my system prior to this one. I don't know what it is but I definitely had it & in fact I saved capture of a lot of the windows it caused to pop up, errors etc. because it was so hard to believe it was there when nothing was catching it.

I hope this helps you & please let us know how it goes!

by michaelhawthorne

I found the same file on my Dad's system.
I didn't have the problem with getting to the Symantec.Com site with the file on the system, but I couldn't cut and paste.

I deleted the file and created an empty file with the same name in the same directory (winnt/system32). I didn't have a problem with that process running on the computer again after I re-booted.

I still have some other suspicious files on the system... Don't know if they have any relationship to this file:
WinSVCService.e
E_S1OIC2.exe

...The Beat Goes On...

by hal 9000

Then disconnect each infected computer from the network and change the BIOS settings to boot from CD.

Then turn on the computer and insert the NAV CD there is a Virus scanner on it and it will pick up most things particularly "Memory Viruses" that can not be removed while the thing is running. If that works do not reattach it to the network until you have made absolutely sure that there are no other computers connected as if there are it will be reinfected so you will have just wasted your time and effort. If it works you'll have to do the same on every computer/server depending on the network configuration as you haven't mentioned what you are working with here.

If you are working with Domains start with the main server and work back wards till everything is clean {I know it is an after hours job} but it is the only way to recover from your present position.

If the above doesn't work then you have a real problem and will need to call in a specialist to cure it. Now as to how you got it that's easy what you have to remember here is that you are fighting a battle where the enemy is always at least one step ahead of you and the AV companies who have first to find a new virus/Trojan/worm or whatever then dismantle it find a solution and a means of blocking it then write the code for their latest Virus Definitions and then it has to be downloaded and installed on the computer. This generally happened 1-2 days after the virus is let lose so there is a window of opportunity for computers to become infected and there is nothing that can be done to prevent this from happening as a Virus Definition can not ever be produced prior to the Virus being written and let lose.

Also I'm betting that you have only found the first signs of the infection as there is no point in disabling AV products unless you plan to do something as well so what is the outgoing traffic like? You will also need to monitor the Network traffic as well but the really important thing is seeing what is being sent out that you don't know about.

Col

by hal 9000

Sasser that he's got here.

While I haven't read up on it I have noticed Norton's sending almost daily Virus Definitions Updates out over the last week or so.

Perhaps it would be worth a look see on one of the AV sites to see exactly what it does.

Col

by erkware

Hi everyone... My network got nailed by this virus on the 24th of April... took 9hrs to clean it off all of the systems. Fortunately, it didn't do any damage, other then DOS our entire network for the 9hrs... I haven't found any mention of it anywhere on the net except in this forum.

Yesterday, we got the virus again. I have no clue how we are getting it. Some users have net access, but most don't. NO virus scanner picks this virus up. Based on tests, it looks like placing a read-only file called avupdchk.exe into the windows and system32 stops the virus from latching onto the system, though it can still become infected. Anyone figure out how this virus got into your networks in the first place? We're writting our own clean tool right now, but it's still a day or two away and I can't guarentee this virus won't come back.

Help!

Nicholas Coad
514-944-0193

by mountsdr

First off, go to your system settings and turn off system restore.

Then reboot into safe mode, then have whatever virus software run in safe mode (full system scan) when it comes up with the affected files, DELETE them do not quarantine them.

You have a worm and they like to hide in the system restore files. Also, by default ANY Anti-Virus Program is prevented from scanning the restore directories.

Delmar
'The Tech'

by affordblpcrepair

I have always recommended using PC-Cillin to all
of my customers. I is one of the top in anti-virus control. You can also try to identify this virus by going to www.trendmicro.com (maker's of PC-Cillin) and select the personnal tab and do a free house call (online scan). This scan is done with the same programing used in PC-Cillin. This will identify but may not remove the virus from your system. By purchasing and installing PC-Cillin you will be able to remove this program and prevent any new ones from entering.

This discussion is closed to new replies.