Windows Forum

Ask something
Discussion Locked

w32.swen.A virus

0 helpful
12 replies

by bohicam1 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I had a client tonight who was infected with this virus. I couldn't access the registry editor, msconfig or system restore. I tried the registry fix from the symantec site using notepad in an attempt to fix the registry but I kept getting errors saying the file C:\windows\regedit could not be found. I went to the directory and double clicked the file itself and I got the same message. It seems as if all the PATH names were no longer found. I could not access the properties of My Computer....nothing. Short of wiping the system clean and reinstalling, what else can I do?
Thanks for all your help!

Mike

12 replies

by fred07

Hi

Slave the HD to a different system and do a norton virus scan and remove the viruses

Then remount and reinstall the OS or

save all data while slaved and format and reinstall OS and programs and send the saved data to the Briefcase and sync.

fred

by bohicam1

Poster rated this answer.
The client asked me to reinstall anyways...seems he wanted to start fresh. I would like a better solution for the next client though. Computer Associates has a clean utility I will try next time.
Thanks,

Mike

by bohicam1

Poster rated this answer.
Thanks Maxwell. This seems to be a similar tool. I will try this one too if given the chance.

Mike

by dmiles

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

Disable System Restore (Windows Me/XP).
Modify the association for Registration Entries ( .reg files).
Create a repair.reg file on Desktop, double-click on repair.reg file to fix association setthings for other filetypes.
Update the virus definitions.
Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: End the Trojan process.
Run a full system scan and delete all the files detected as W32.Swen.A@mm.
Remove the remaining values that refer to worm file in the registry.

For specific details on each of these steps, read the following instructions.

1. Disabling System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
"How to disable or enable Windows Me System Restore"
"How to turn off or turn on Windows XP System Restore"

"Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.

by bohicam1

Poster rated this answer.
When I first checked the Symantec site, the part about re-associating the .reg files wasn't there and that is not something that even clicked for me to try first. This might have saved me some headaches. As it stands, I will try the easy way by using one of the fix tools on floppy next time.
Thanks,

Mike

by pctech

The virus has redirected the *exe files. Rename regedit.exe to regedit.com and you will be able to run the regedit tool.

I hope this helps

by bohicam1

Poster rated this answer.
I tried this first as it did work on a previous virus. This time it didn't work.
Thanks anyways,

Mike

by joseph moore

Yeah, I read about this one, and it sure is nasty, making all of those REgistry changes.

Ok, did you read Section 2 in the Removal Instructions on Symantec's writeup?

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.html
(please remove any spaces)

It states "Windows NT/2000/XP: Choose Tools\Folder Options\File Types\REG Registration Entries\Change, click at the "Registry Editor" in "Open With" windows." There are several screenshots to see on the steps to take. Also, you need to do this in Safe Mode. Then you can run the .REG file it lists.

So yes, you need to manually reassign Regedit with editing registry files, then you should be able to repair this.

Good luck!

This discussion is closed to new replies.