worms/ virus

[ben88]

do i ahve to right click the file to get to this checkbox??

[dunc85]

okaaaay...

 

 

My Computer > Shared Documents

 

right click on that folder and select properties. At the top, click on the "sharing" tab.

 

Look for the checkbox that says "share this folder on the network" and make sure it's unchecked.

[ben88]

dunc this is a screenshot of the screens i get when i follow your instructions.

 

[ben88]

now what do i uncheck, or am i doing something wrong??

[dunc85]

hmm, maybe thats not how its getting on. Have a look at your anti virus logs to see what folder the virus was in.

[ben88]

yeah i will do.

 

cheers for all the help.

[ben88]

the text i got form my antivirus program was.

 

c:windowssystem32

 

and the infected file was winhlpp32.exe

 

i chose to delete the file, bit i have a feeling it will be back :mad:

 

the worm detected was agobot.kv

 

what ever that is.

 

any one gmot any ideas.

 

cheers.

[Newt]

any one gmot any ideas.

 

Certainly do. And about 99.999% certain it can be fixed. But as noted earlier, I ain't gonna try to do it here and without expert backup available if I get stuck.

 

Newt:

ben88, I'm guessing your PC is in pretty bad shape and a full cleaning is way beyond what we need to be doing on AN.  For sure do use the sasser remover Gazza_Wakey mentioned but after that, do yourself a favor and post about the problem to a forum like www.windowsbbs.com that has a section devoted to security/virus/spyware problems and has some experts who can help.

 

Before you post, download a copy of the latest version of Hijackthis (v1.98.2 as of right now), save it to a folder of it's own (maybe c:hjt), run a scan and create a scan log then post the contents of that scan log to whatever forum you decide on.  Don't try to fix anything from the HJT scan yourself but post the log so someone with good knowledge of spyware & virus problems can tell you what needs fixing and exactly how.

 

[ 17. September 2004, 03:55 AM: Message edited by: Newt ]

[ben88]

newt cheers for the advice i have downloaded hijackthis but now i am having problems running it.

 

the problem is that i open the winzip file and double click to open the applcation then the program opens for about 2 seconds then closes again, this is the same problem i get with my avg free antivirus software.

 

i have a strange feeling i will have to back up some of my files and reformat my hardrive.

 

[ 17. September 2004, 04:02 PM: Message edited by: ben88 ]

[Newt]

Not yet Ben. Maybe, but not quite yet.

 

Try unzipping Hijackthis to a folder of it's own (so not a temp folder and not to the desktop - I use c:hjt). In case you aren't familiar with the zip program, open it and Extract Hijackthis.exe to the folder.

 

Then try to run it. If it still won't run, boot to safe mode and try from there.

 

The shutdown after a minute does sound like Sasser or Blaster and while I don't know your exact OS, it's probably W2K or XP.

 

If you are getting a window that looks something like this before the PC is shutdown

 

 

You need to keep the PC running long enough to fix things so reboot and as soon as you get logged on do the following

 

click on start, click on run, type in cmd and click OK. Then from the command prompt, type in the following and press ENTER

code:

---

shutdown -a

---

That should keep your machine running until you reboot again.

 

If it does, you can download and apply MS03-026 patch (KB823980) that will at least stop the thing long enough to get yourself a clean system.

 

I strongly suspect that whatever critter you have managed to disable your AVG and you'll probably need to use an online AV scanner to clean things.

 

This isn't going to be real simple to do but it can be done. There is also an excellent chance that if you format/reinstall the OS that you will be infected when you first go on to the internet to try and download protection.