Results 1 to 7 of 7

Thread: Virus Help

  1. November 7th, 2002, 04:24 AM #1
    Phsion
    Phsion is offline
    Junior Member
    Join Date
    Oct 2001
    Posts
    20

    Question Virus Help

    Anyone know about a virus that puts files named 00000b1b or 00000b18 in the c:\temp folder, that cause NAV to crash when it tries to scan them? It actual damage is killing my network. The only actual virus that NAv found was a generic trojan named upd.exe in c:\windows\autoupdate. I cant find any info about this thing, and any help would be great.
    Reply With Quote Reply With Quote
  2. November 7th, 2002, 04:35 AM #2
    gore
    gore is offline
    Senior Member gore's Avatar
    Join Date
    Oct 2002
    Location
    Michigan
    Posts
    7,177
    hmmmm, i duno if this is gunna work or not, but if your using windows, go to the disk cleanup program and clear everything out, it seems to have worked for a friend of mine.
    Reply With Quote Reply With Quote
  3. November 7th, 2002, 04:43 AM #3
    y2k
    y2k is offline
    Senior Member
    Join Date
    Mar 2002
    Posts
    153
    If u can't clear the virus, delete the file in dos. And I think better u search the name of the virus of watever name that have significant with the virus in registry and del the registry value. check also win.ini, system.ini for strange line. Delete it but before that plz make back up.
    Hope it help.
    Reply With Quote Reply With Quote
  4. November 7th, 2002, 04:43 AM #4
    gghornet
    gghornet is offline
    Senior Member
    Join Date
    Aug 2002
    Posts
    310
    I think I found it.Here's the link.It has a description,and removal instructions/tools.

    http://www.klezvirus.com/rk-norton.htm
    Reply With Quote Reply With Quote
  5. November 7th, 2002, 07:01 AM #5
    Tedob1
    Tedob1 is offline
    Senior Member
    Join Date
    Nov 2001
    Posts
    4,785
    sounds like a code red varient that blew up.

    is sfc disabled?

    open then up in a hex editor:

    seg000:00000B1B 00 00 68 D0 dd 0D0680000h
    seg000:00000B1F 24 40 00 68 dd 68004024h
    seg000:00000B23 D0 20 40 00 dd 4020D0h
    seg000:00000B27 68 D4 24 40 dd 4024D468h
    seg000:00000B2B 00 6A 00 55 dd 55006A00h
    seg000:00000B2F FF 35 D8 24 dd 24D835FFh
    seg000:00000B33 40 00 E8 60 dd 60E80040h
    seg000:00000B37 00 00 00 0B dd 0B000000h
    seg000:00000B3B C0 75 49 A1 dd 0A14975C0h
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”
    Reply With Quote Reply With Quote
  6. November 7th, 2002, 07:25 AM #6
    ebo
    ebo is offline
    Senior Member
    Join Date
    Oct 2002
    Posts
    221
    umm... I think that somebody or some how it was hidden. If i undertood you correctly this site should have something that can help you out. www.astalavista.com.
    Reply With Quote Reply With Quote
  7. November 7th, 2002, 08:40 AM #7
    dolemite
    dolemite is offline
    Senior Member
    Join Date
    Nov 2001
    Posts
    108
    If you can get to the web go to Trend Micro's Free Online Virus Scanner. I've used it myself many times when other virus scanners have failed.

    http://housecall.trendmicro.com
    Speak softly and carry a big stick; you will go far. - Theodore Roosevelt
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules