Security

Ask something
Discussion Locked

worm virus?

0 helpful
5 replies

by afijalki

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

i have made the mistake of downloading a worm virus to my friends computer and now i need help to get it off.

so far i have used symantec.com's virus scan. it came up with 6 virus'. one that i was responsible for.

here's all 6:c:\Recycled\alphapro.zip.pif is infected with W32.Sircam.Worm@mm
c:\_RESTORE\TEMP\A0021228.CPY is infected with Backdoor.Mosuc
c:\_RESTORE\TEMP\A0022228.CPY is infected with Backdoor.Mosuc
c:\_RESTORE\TEMP\A0026581.CPY is infected with Backdoor.Mosuc
c:\_RESTORE\TEMP\A0031674.CPY is infected with Backdoor.Mosuc
c:\_RESTORE\TEMP\A0039131.CPY is infected with AOL.Trojan

if anybody could help me out it would be greatly appreciated.

5 replies

by jluster

This trojan is generated by a kit which allows for several configurable characteristics. Such characteristics include the name of the executable that is created, and the method which the trojan installs itself.

1.
Check your SYSTEM.INI for a uncommon "SHELL" value and remove it.

2.
Then remove the file the SHELL variable pointed at. Additionally check for a file with an extension of .LOG and remove that one too if it's not a logfile (DON'T execute the file with a doubleclick, load it into notepad, etc.)

3. SIRCAM is different. This one is a backdoor virus with a copule of nasty features. First copy regedit.exe back onto regedit.com - the latter is a infected backdoored version. Then remove all virus information with your clean regedit by checking

HKEY_CLASSES_ROOT\exefile\shell\open\command\

and

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
RunServices\Driver32

also remove

HKEY_LOCAL_MACHINE\Software\Sircam

now delete all infected files AND remove /recycled/sircam.exe and sirc32.exe

AOL.Trojan should be easily removed using symantec's scanner.

by kirk harris

you should be able to download the Sircam fix tool from symantec.com, just download it & put it on a floppy & run it in windows....it's just an .EXE file to click on & run

by bryan guffey

The other guys are right on target for removing them. But since you're appearently running WindowsME, Windows is actually "backing up" the viruses.

Go into the system properties under the performance tab, click the File System button, then go tothe Troubleshooting tab. Turn off System Restore, then run the fix tool.

You probably ought to turn off "System Restore" anyway. IMHO that was an idea so crap, it could've come from nowhere but Microsoft. I got 20% better performance without it.

Bryan

by kaycen

If the virus files have been trapped in System Restore, they are quarantined unless you do a RESTORE which includes that file.
If you delete a file in the _Restore folder(s) you'll have more problems than the original virus.

To get that worm outof _RESTORE, simply turn off restore. However, this will get rid of ALL prior restore points too.

Don't forget to turn restore back on.

This discussion is closed to new replies.