backdoor.nibu

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.nibu.html

Follow the steps listed - or simply delete all infected files, replacing them with valid files, edit the registry and win.ini files as required. If you cannot do an automatic cleaning, your reduced to doing it the old fashioned way.

Luck,
Dr. Sys

To manually delete this virus from a WIN2K server:

1. Go to your registry editor; type regedit at your Run command.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run; hightlight run
3. in the right pane delete the value: "load32" = "%System%\load32.exe"
4. Exit the editor
5. Run a full system scan and delete all the files detected as Backdoor.Nibu or Keylogger.Trojan.
6. Using Windows Explorer, navigate to the %Windir% directory and delete the dxdload.log file

Caution! Use extreme care when editing the registry. I would backup the registry just incase. Go to Start, Programs, Accessories, System Tools Backup; start the wizard and select System State Data.The rest is self explanatory.