Virus Trouble??

[MichaelB]

Hi Guys, I have spent much of this evening trying to find out why my PC is not allowing me to run certain programs. I thought it must be a trojan virus. I can run some EXE files but not all. I have downloading anti virus scanners all night but once downloaded I couldn't open them. I was told corupt file among other things. Any suggestions??

I have run a few of the dos programs that are listed here but still no luck.

Thanks for time

[FrostyPhrog]

Hi
Go here (http://housecall.antivirus.com/) and run house call by PC cillan it is free and very good.

FostyPhrog

[ 10 November 2001: Message edited by: FrostyPhrog ]

[lynnm]

Please post the text of any error mwssages you get when trying to open your applications.

Are you getting any errors that say something to the effect that Windows cannot locate SirCam32.exe?

If so you have been infected with the SirCam virus.

In any event post back Yea or nay.

[ 10 November 2001: Message edited by: lynnm ]

[MichaelB]

Thanks for responses. Here are some of the errors I am having:

Upon booting up PC I get this message before windows starts

Program~1\common~1\Network~1\Virus~1\40~1.xx|scan. exe has failed

Once windows has loaded I get these:

Rundll
errorloading C:\windows\newdot~1.dll
system cannot find file specified

Tsystray
Has performed lleagle operation and will be shut down

__________________________


Yesterday I was also getting a shut down window for hpfsched.

I checked out my run and load lines in my WIN.INI file and my run was run=hpfsched. I fixed that and made it run= and saved it.

I hope this is enough info for you or that it isn't too detailed

upon trying to open some of my anti virus files I get these:

Winzip self-Extractor header corrupt. possible cause: bad disk or cfile transefer error

and

PC-chillin gives me:

unable to run: .win98\disk1\setup.exe
null

[ 11 November 2001: Message edited by: MichaelB ]

I was just checking out descriptions of different virus' and found that I do have the file riched20.dll in my windows system folder.

That was listed under this virus:
W32/Nimda-A is a Windows 32 virus which spreads via email, network shares and websites.

I wont add anymore until asked. I will check back later today for response
thanks again

[ 11 November 2001: Message edited by: MichaelB ]

[MichaelB]

I think I found it.

I was going to delete my last post but thought I would leave it for anyone else who might be haveing same problem to read.

I scanned with house call and had 500+ infected files from pc spaces. It says it is auto cleaning them and I will let you know if all worked well or not.

[FrostyPhrog]

Hi
Glad to here back. I hope everything works out for you. House call is very good.

FrostyPhrog

[MichaelB]

now I have a problem with a few files. It says that it can't access them. So they aren't being cleaned. What would be my next step??

[Mr1drful]

try here for more information and to download the FIX TOOL.
http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName=PE_NIMDA.A-O

[MichaelB]

Okay
I am back and frustrated. I waited all afternoon while the house call program scanned and cleaned a total of 520 virus. I rescanned after it was done and they are all back on PC. Any suggestions would be appreciatted.

[Mr1drful]

did you download and run the nimda fix tool ?
http://www.antivirus.com/vinfo/security/fix_nimda.com

or did you just use housecall again ?
if you used the fix tool you HAVE to reboot when you're done. if you just keep rescaning it will keep finding the same infected files.

[HKEd]

As Michael pointed out in an earlier post, it's PE.Spaces (http://www.ntsecurity.net/Panda/Index.cfm?FuseAction=Virus&virusID=256) that's the problem here. It's quite difficult to deal with as it infects so many files AND it's memory-resident.

Michael, you may be lucky if you run HouseCall again and then shut down the system. Completely power off and leave it off for at least 30 seconds. If I were a betting man, I'd say the odds of ridding yourself of the virus that way are long.

The only two ways I've seen this removed completely were 1) a format 2) downloading and burning a copy of InoculateIT (a free antivirus program) to a CD on another computer, making it a read-only file, then installing it from the CD to the infected system.

You can get InoculateIT here:
http://www.ntsecurity.net/Panda/Index.cfm?FuseAction=Virus&virusID=256

You will not be able to install it directly onto the infected system. It should be downloaded on a separate machine, burned to CD and the EXE file should be made read-only (if not, Spaces will infect the installation file). You will then be able to install it and have it clean your system.

[HKEd]

There may be an easier way, but I haven't seen any results of its use:

Spaces Removal Tool (http://www.sophos.com/support/faqs/spaces.html)

Once again, it should be downloaded to an uninfected system.

[Mr1drful]

you're right HKEd.
i'm gettin old and my eyes aren't what they used to be.guess i focused on his remark about W32/Nimda-A .

MichaelB , forget about the info i posted. HKEd is right you'll probably have to reformat.

[MichaelB]

thanks for your help and time guys and/or girls.

I am going to reformat. Am I able to keep files from my PC such as MP3s and Pictures as long as they aren't Zip/exe? I am planning on saving them to CD. And what is the exact way to reformat?

[Spider]

Originally posted by MichaelB:
And what is the exact way to reformat?
MichaelB.
If you have no experience with reformatting I suggest you take
your tower down to the local computer store.

True, reformatting "resets" the hard drive but other things have to be
done before, and after, reformatting. Fdisk, saving old email and pop3
account information, making a list of device manufacturers and model
#s and types so you can reinstall drivers after, and a few things more.

Formatting by inexperienced users is not a good idea no matter what
"steps" you may learn about. Best to watch it done and if your lucky
the person doing it will go slow and explain what they are doing while
working the machine.

[Dodge]

Just my opinion only. If you have that many files Infected with a virus. I would say Get rid of all of it and Start over fresh. You may lose alot of the Information you have, but May cause you the same problems in the future if you keep them.... Like I said, Just my opinion... Thats what I would do...

I would write down any Addresses that are in your address book. Then manually put them back in later.........

[MichaelB]

Hey Dodge

Thats exactly what I am getting ready to do. I have Burned all Wanted MP3s to CD and a few Jpegs and bitmaps. Anything that I can save. Obviously not an.exe files. I have all my drivers and email info needed and my windows 98 CD.

I have some limited knowledge of PC's and learing more all the time. I got the info from the page on formatting hard drives at this great sight.

Thanks for help

[ 13 November 2001: Message edited by: MichaelB ]

[Mr1drful]

you should also go back to housecall and scan the cd's you burned before you load anything back into your computer.
should only infect "exe" files but it's better to take a few mins. to be safe.

sorry about the misinformation in my other post. a mind is a terrible thing to waste---so if i ever get one i'll try to use it right.

good luck

[Dodge]

Mr1drful, with the advice you have given on this site, you must have a mind and have been using it....


MichaelB, Do as he said and do a Virus scan on all files you have saved on floppy or CD's.... There is always the chance they are infected and you could end up with the Same problems all over again....