Windows Forum

Ask something
Discussion Locked

Virus keeps coming back - please help!!!

0 helpful
17 replies

by bradleyr

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Last week, one of the Win98 machines here has contracted the Snowhite and 7 Dwarves virus (this was a Spanish Version - "HAHAHA"). A round spiral circle occupies the desktop, making it impossible to work on the machine. I have found out what the virus is: W32.Hybris.plugin and W32.Hybris.gen. I have followed the instructions and deleted the line out of the win.ini file that executed this damn program. I have cleaned out the temp dir, the startup folder, the startup tab under msconfig, the registry under .../Microsoft/Windows/Current Version/Run. I have looked into the Autoexec.bat and config.sys files and everything "appears to be clean." However, within 12 hours the damn thing has been back 3 times!!! I have even replaced the W32sock.dll with a clean one - the virus keeps coming back!!! After about 12 hours or so, the same line appears under run= (in win.ini file) that executes the damn circle!!! Everytime the name of the program is different, but it always look like this "run= C:\Windows\System\IFIFIF.exe (each time IFIFIF has a different name). Can somebody please help me if you have run into the same problem? I have run out of options here...

17 replies

by dcosgrove

It sounds like you may have had it for a while. Hybris actually contacts a specific news group ang downloads additional virus components when you are connected to the internet. I had a machine with hybris and cleaned it with the help of the nortonwebsite. There wre detailed instructions on which files to remove there is also a runonce entry in the registry which nedds to be deleted. I don't recall seeing any info on additional components though, but mine had not progressed that far so I did'nt look. Good luck.

by greg.ahler

Honest truth, You're going to save yourself some time and effort by going back to basics and reloading the machine. (2 hrs plus extra software vs. 12 hrs of frustration then starting over again) One thing you may want to check is if your user is going back to the same piece of mail that caused the problem in the first place.

by plg6

What's missing from your description of trying to find a solution is running an antivirus program. The code is no doubt buried in any number of files or memory and all you would need would be some system event to run one of the infected programs andbring the virus back to life, so to speak.

Get an antivirus program on your system ASAP and scan the whole system. No matter where you get the program from, either as a download from an antivirus site or off of a CD at a local computer store, getthe latest updates from the antivirus maker before running the scan - This may be too new a virus to be in the selling version of the program, especially from a CD install.

Good luck.

by parier

I had the same one about Snow White from HAHAHA. Norton Antivirus found 17 instances of the virus all different unknow file ames like afglkkdsd.ssf for example and so on. One way (if your using Outlook) is make a Inbox Rule that says and email from(with the name HAHAHA, delete immediately. If this is implemented on all PC's, a user will never receive it nor open it and will save yoou the hassle of running Antivurus for this virus in the future. Also not I beleive in affected my WSOCK32.DLL and I needed to restore that file from the WIndows 98CD and delete the infected file because it was unrepairable.

Hope this helps!
Eric

by alan.robinson14

Yes, I solved this for one of my customers. IT WASN'T EASY. Follow as follows and it won't come back.

1. You will need to see HIDDEN Files and Folders, Yes Folders. Therse are lots of them
I am sending you a DOS utility with intrustions its called Stupendus DOS and with it you can remove all the files.

2. The registry is corrupted. Woops, unless you have a backup this SYSTEM.DAT AND ALL OTHER SYSTEM.DA? files need to be deleted.

3. Reinstall Windows AND reinstall all applications thatlegally updated the registry.

A bit of a bummer. but it worked. Never returned again.

by alan.robinson14

It's called the Spirale and most of the files to delete are 8 weired lookink characters like "arargsgs" 8 repetative characters. More details on my email. Email because I can't send files here.

Alan

by alan.robinson14

It's called the Spirale and most of the files to delete are 8 weired lookink characters like "arargsgs" 8 repetative characters. More details on my email. Email because I can't send files here.

Alan

by vagab0nd

Use the antivirus soft with latest update, this will work but note that I had to use DOS version as those running under Windows can't clean system files!
This will help you not only get rid of current virus but also provide protection for future.
Good Luck!!!

by vt399

I was surfing www.techrepublic.com, download
testlinks.zip, unzip, read the doc then went
back to same web site, suddenly a round black spiral circle displayed on the desk top, the task bar displayed "Spirale".
So far, I tried to gather the info to correct
the problem. Please, show me the best way.

I just wonder:
1. How can I find out which way Spirale infect my PC?
2. How long does it take Spirale activate?
(Immediately after infection ?)

My PC is a Dell 7500, Win98, Norton Antivus 2000 enable. After the infection, I could not run scan disk nor update the "Virus definition".
Thanks for all your help.

by bradleyr

email me - bradleyr@taxidivision.com and i will email you the link that describes how to get rid of it.. :^)

This discussion is closed to new replies.