I got an email from Andy with a virus...

I, too, tried to follow all of the instructions and wasted about three hours getting nowhere. So I immediately installed the Norton System Works 2001 which was a whole thing. It's very, very complete and identified the virus which was the kernal32 file. I just deleted it so if it's important then I guess that I'm out of luck. I tried to delete it before my install and my system wouldn't let me. I highly recommend this package or something similar as I should've had it anyway. So the end result was probably pretty positive.
I keep getting the virus as email attachments so if you're listening there are a few important life rules to follow:
1. Don't **** with the great AnklePocket
2. Whenever in doubt, please refer to rule #1
3. If I find you there will be a problem
 
I got emails for about 5 different people (one from Andy) today on my work computer. All of them with the same virus. I also have a person sending me a tanted email at about 40 e-mails a day. I hope you all get this taken care of post hast.

Phil
 
I downloaded Norton Anti Virus 2002. I scanned my pc just like it said in the instructions posted in the other thread. Norton found all of the infected files but when I try to delete them it says Norton can't delete the file. It also won't let me Quarantine the file! I searched for the files on my pc and tried to delete them myself and it won't let me! WTF!!! This is really starting to piss me off! Why won't my norton take care of it? How do I delete these ****ing infected files? Any help would be greately appreciated.
 
I got the Norton System Works and it worked. Actually kinda blew me away at how great it is. Highly recommended and that should do it. My system came with the Norton Anti-Virus, but the System Works goes way beyond that. Keep in mind that I'm one notch above a computer illiterate.
 
Louis and all...

We seemed to have most of the damage under control here at ATC.

McAfee didn't do it for us....it was an application called InnoculateIT by Symantec.

Fundamentally, all it did was delete two of the virus' primary operating files:

kernel32.exe, which is a Windows/System file and a .dll file which was the trojan component....the trojan is a file which records keystrokes on one's computer and uploads the info to the author of the virus...a complete violation of privacy and a felony nonetheless.

Things are still buggy here, but improving....

Most of the virus protection websites have updates about this virus on their front pages, as it is running rampant through the internet right now...it is suspected that it originated in New Zealand.

On behalf of ATC, I extend our most sincere apologies for the inconvenience this has put our infected customers through...the past 24 hours here have been filled with nothing except this issue, and will continue throughout the night.

Louis...if you downloaded a free piece of software, it won't delete the files...if you paid for it online, you are entitled to support from the software developer. Hope this helps...
 
andy- i think Computer Associates makes InnoculateIT (they have an entire ________IT naming convention :) unless that product has been purchased by another computer. i'm pretty sure its not symantec though- they make Norton Antivirus.)

I've been really into computers for over 10 years now, been performing service and IT stuff part time for over 5, including the university. here are some general virus/computer security tips that i tell people:

- the old "don't open attachments from people you don't know" doesn't very well work anymore, since now a virus can come from a best friend. nor does "never open ANY attachments." a better piece of advice would be "Don't open attachments that you're not expecting." Arrange beforehand to recieve an attachment, otherwise, treat it as hazardous. IM or call on the phone and say "yeah, i'm sending you this file now/later. it's called _____.zip, the subject will be __________"

- it's unrealistic for me to say "don't run Outlook". Heck, i use it for some email accounts. in a perfect world, this security cheesecloth would have been fixed and have a lot of its automation features disabled. Its not a perfect world, so you might have to go about setting stuff up yourself: if you're running Outlook XP, go to tools->options and click the "security" tab. Set the security zone to "Restricted", click the "Zone settings" button, and make sure everything is disabled. this'll just affect email. i've never seen anyone send a legitimate email that uses features that you're disabling. so far, other non-MS email clients have not been nearly as succeptable to things like this.

- if you're using Outlook Express 6 (comes with IE 6, XP. the following *may* be applicable to earlier versions, but i doubt it): tools->options "security tab" click the "Restricted sites zone" radio button, check the "Warn me when other apps try to send mail as me". if you're not really confident with computer files and what not, then you might want to check the other box too: "Do not save attachments that could be a potential virus." IMHO, its a stupid option and i usually keep it off, but if you have kids or less tech-savy people using the machine, you might want to check it to CYA.

- if you're running an earlier version of IE, upgrade to 6 if you can. caution: if you're running McAfee Antivirus 4.x or 5.x, this could bring about some annoying side effects. McAfee might have a fix out by now, but i'm honestly not sure.

- make sure Windows is completely updated through Windows Update. Also, go here: http://support.microsoft.com/suppor...hk.exe&rnk=1&src=DHCS_MSPSS_gn_SRCH&SPR=WINXP
and grab hfnetchk.exe, which grabs a list 7of current fixes that MS put out, and decides which are applicable for you, and tells you about them. its then your job to go grab these security fixes. run this every month or so, and every time a new virus makes its way onto the evening news. :)

- run an antivirus program and keep it updated. a free one for personal use is avg (www.grisoft.com ), though i prefer Norton Antivirus or McAfee. (NAV can check incoming mail for viruses, but they require a subscription fee after the first year of free AV updates). i have no experience with InnoculateIT, but i respect CA as a company that knows their stuff.

- run a Personal Firewall. a Personal Firewall is sort of like airport security: it stops casual breaches cold, can severely inconvenience stronger attempts (enough to make someone else look like a better target), can be an inconvenience some of the time, but when things work perfectly, you never know its there, and are safer for it. They keep unwanted, possibly dangerous stuff out, and lets through only stuff that is safe. some also filter OUTGOING things, so only applications that you authorize can contact the outside world in certain ways.

Windows XP comes with a barebones personal firewall. Alternatives (or if you don't have XP), are Tiny Personal Firewall (www.tinysoftware.com) and Zone Alarm (don't know the URL off the top of my head). I personally prefer Tiny. Its a bit more powerful than ZA and needs less memory, and i'm told by several people that its just as easy to set up. I've always thought that ZA was easier to set up and run for beginners, so if you are not familiar with any networking whatsoever, i'd suggest going with ZA. While none of these are antivirus programs, when properly set up, Tiny and (probably) ZA can catch things like Win32.Badtrans when the virus tries to send information it has gathered. the one built into XP does not have this feature. i can give quite a few tips and point you in the right direction for info setting up Tiny, and i'm sure there is an abundance of info for zoneAlarm (which i haven't used in years).

i know its a lot, those are just some suggestions for people to consider.
 
Originally posted by AnklePocket
I got the Norton System Works and it worked. Actually kinda blew me away at how great it is. Highly recommended and that should do it. My system came with the Norton Anti-Virus, but the System Works goes way beyond that. Keep in mind that I'm one notch above a computer illiterate.

a lot of SystemWorks is pretty decent. one thing i have found doesn't help is CrashGuard- in my experience, it makes programs *less* stable. Also, a lot of the constant monitoring utilities will be a big hit on performance.

things i recommend from Norton Systemworks/Norton Utilities (not sure which product comes with which package:)
Norton WinDoctor- pretty decent for correcting common problems, guesses a reasonable solution most of the time.

Norton Disk Doctor- a decent consumer disk maintenence program.
Speed Disk- Will reorganize your hard drive for faster performance.

Registry Tracker (or something like that)- not much experience, but might have potential if you turn it on before installing or changing your system. should help you roll back if things break.

thats all i can think of at the moment, but those are my (unsolicited) opinions. just keep in mind that none of these will prevent a disaster- merely stave it off: always have a backup of your important data offsite (either on a disk somewhere, or on another trusted computer offsite)

whoah, i followed a link to this thread- i just realized it was in the ATC forum. sorry if its off topic Andy :) i meant to post it all in a thread that references this one in the community center- any way to move my posts?
 
I recieved it too but deleted it before opening. None of those files show up on my computer.

I heard on the news this morning that there is a "reply" virus going around that reads your keystrokes. They can get your passwords and credit card numbers from this program. Be carefull.
 
Originally posted by BoyNhisDog
I heard on the news this morning that there is a "reply" virus going around that reads your keystrokes. They can get your passwords and credit card numbers from this program. Be carefull.

thats exactly what this one is :)
 
I am fighting it right now... Boy was I excited to open that
"reply to Order Confirmation" mail:mad: :mad: :barf:
 
I've used Norton utilities/antivirus/systemworks for years and I like it alot. Not everyone does. It interferes with some programs. But I find the antivirus program picks up stuff McAfee misses, but Norton isn't as strong at cleaning or disinfecting. First, you have to keep your virus defintions current, otherwise the program is useless. I check every day. You can set up your program to check and download automatically in the background. I prefer to do it manually. Next, you have to set it up to automatically screen your email and to examine all your files when you do a scan, not just programs. You have to set that up manually for each email. AOL can be a problem. It's much easier to catch the viruses before they get into your system versus trying to clean them out later. Last, the level of analysis and screening is adjustable [look at the "Bloodhound" settings. There are two of them each with three levels]. The middle setting is usually best and the top level slows things down, but if in doubt, be careful and cautious, at least while the attacks are rampant.
Sometimes Norton will not let you delete infected files, and Windows won't either. That's usually because the system reads the file as a part of a program that is running, like Windows. That's why it's best to go into DOS to clean things up from there: because Windows won't be running and can't stop you from deleting whatever you want. But obviously you have to know what you are doing. To delete from DOS automatically or with the help of the program, you usually have to use the Norton Basic Rescue program [from the boot disc you should have prepared], but this is a truly lousy program that Symantec needs to improve. The Zip Rescue is a Windows Program that also sucks and won't do the trick most of the time. And sometimes the virus will "get stuck" in Norton itself. That just happened to me two days ago. I dumped Norton and reloaded it clean and then I was able to delete the viruses. The hackers are smarter than the antihackers.
If that doesn't work: you can't clean it from windows, DOS or by reloading the program [and updating], you may have to call their tech help or use a different program.
Personally, I think it's Bin Laden. ****ing Nazi Bastards!
 
OK,

I followed another set of online instructions that Said to run my pc in safe mode and then it will let me delete the infected files. It worked! All the infected files are out of my pc. The only problem is I had to delete the infected Kernel32.exe file that someone said is an important file. What will happen to my pc without this file, and how can I replace the file?
 
Louis...

We had to delete that file as well...Innoculate deleted it, as well as some others...everything was fine following their deletion.

Kernel32 is fundamental to Windows, but in the case of this virus, I think deleting Kernel32.exe does not ACTUALLY terminate the Kernel from the stack when your PC boots...rather, the Kernal32.dll is the one that can't be deleted without a major problem.

So, Kernel32.exe as far as I know is safe to delete...we did and everything is squared away.
 
yup. kernel32.exe is purposefully named similar to the *real* windows file kernel32.dll so a casual browsing will overlook it. an example of "social engineering"
 
Back
Top