Are you able to at least detect which files are infected? You'll need to reboot into safemode. If you're running XP or Windows ME, you'll also need to disable 'System Restore'. If you have System Restore on and delete the files - your sytem will restore them and you'll be back to square one
.
Click Start, and then click Run. (The Run dialog box appears.)
Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to the each of the following keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
In the right pane, delete the value that refers to the worm file. Looks something like this: "hostend"="%System%\Winreg.exe"
Exit the Registry Editor.
This will stop the worm from running when you boot back into Windows.
If you are unable to detect the files - check your System folder (C:\Windows or C:\WINNT usually) and look for the following (NOTE: these files names are pretty close to the real file names, so be careful)
antiv.exe
driver.exe
driverini.exe
drv.exe
expoler.exe
filexe.exe
hlp16.exe
lssas.exe
qname.exe
spoole.exe
swchost.exe
syshost.exe
systemchk.exe
systemini.exe
winchk.exe
winlog32.exe
winreg.exe
Also look in System for \Macromed\Help\Media.dll and delete that.
Reboot into Windows - if you've disabled 'System Restore' make sure you reenable after assuring you're no longer infected.
Symantec offers a free online scan -
http://securityresponse.symantec.com/
Checks for both known virii, trojans and security holes.
Posted: Mon Dec 22, 2003 9:32 pm