Win32.Sober virus

[ColaBoy]

I seem to contracted the Sober virus but can't seem to rid my pc of it.I've tried HouseCall and Bit Defender online virus killers but none seem to work.Does anyone know of any free way to get rid of it?

[NaTaS]

Are you able to at least detect which files are infected? You'll need to reboot into safemode. If you're running XP or Windows ME, you'll also need to disable 'System Restore'. If you have System Restore on and delete the files - your sytem will restore them and you'll be back to square one .


Click Start, and then click Run. (The Run dialog box appears.)

Type regedit

Then click OK. (The Registry Editor opens.)


Navigate to the each of the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value that refers to the worm file. Looks something like this: "hostend"="%System%\Winreg.exe"

Exit the Registry Editor.

This will stop the worm from running when you boot back into Windows.

If you are unable to detect the files - check your System folder (C:\Windows or C:\WINNT usually) and look for the following (NOTE: these files names are pretty close to the real file names, so be careful)

antiv.exe
driver.exe
driverini.exe
drv.exe
expoler.exe
filexe.exe
hlp16.exe
lssas.exe
qname.exe
spoole.exe
swchost.exe
syshost.exe
systemchk.exe
systemini.exe
winchk.exe
winlog32.exe
winreg.exe

Also look in System for \Macromed\Help\Media.dll and delete that.

Reboot into Windows - if you've disabled 'System Restore' make sure you reenable after assuring you're no longer infected.


Symantec offers a free online scan - http://securityresponse.symantec.com/

Checks for both known virii, trojans and security holes.

[ColaBoy]

Ok,cheers mate I'll give it a try.