Printable View
O.K Guys,
needin some help here. My friends computer is infected with KLEZ
(Win XP)
I can't use any anti virus tools cause the wee shits just deletin them when I try.
I can't boot to dos because the disk is NTFS.
What to do ?
Registry strings of this virus would be great so I can remove them .
Have you tried the Klez removal tool available from Symantec?
http://securityresponse.symantec.com...oval.tool.html
Oh-oh, I have experience with this one, I had it about a month ago. Go grab the tool from symantec with the link provided by Maverick, and follow the instructions carefully. Be sure that when you try to reinstall your anti virus, that you are NOT connected to the internet. Im pretty sure the instructions require you to download the fix, disconnect from the internet, turn off file restore (which sometimes klez infects as well), boot into safe mode, run the fix, boot into regular mode, re-install norton, turn file restrore back on. I hope this helps.
You can save yourself a lot of time and go to www.trendmicro.com and use their free online scanner. This will find the klez virus and remove it. No need to reboot or any of that other crap. Good luck....
Having removed more klez infections at the shop than I care to think about my advice is to use the Symantec tool. It's the best and easiest. Couple of things to remember, download the fix from a clean machine and run it in safe mode only. I've had one instance on a 2k box where it had to be run twice.
In regards to Trend Micro's online scanner, it's good but it doesn't remove all of the klez footprints. I like to use that for a scan but I depend on myself to remove the viruses/trojans etc.
To BAckup TechieChick, Maverick811 and KidAdmin,
Klez kept me busy for about 2 months last year, the symantec removal tool is the more reliable method of removal. (I think F-Prot, Mcafee, and TM have one also).. The instruction that any of these companies give is standard now for Me and XP regarding many of the current worms.. WHY?.. because the virus can be saved as part of a normal "Check Point" Back up the system creates.. and potentially be available to re infect your machine.. This is why the Online scanners are not so good.. well they will get the virus.. but they Can't remove any infection from the Restore folder..
The standard instructions for Worm/Virus Removal Are:
Disable system restore..
Reboot into safe mode
remove virus
reboot into normal mode
Reinstall Av - update Defs, run full scann.
Re-enable System REstore..
Just pray you don't get Lovegate.. the removal tools only operate in DOS mode.. cure ..create a Ntfs-DOS boot disk..
Cheers
Here is your answer, boot to Norton Antivirus or another vendor's boot disk. Enable the write protection on the disk so it cannot be overwritten ( it won't be since your not booting to windows.) After the virus has been removed, remove the network cable from the system ( so it can't spread to another machine) boot to windows, run your anti-virus again from within windows. After your satisfied that the virus has been removed, sit back and enjoy the praise of being the hero. : )
PuRe
PuReExcTacy WTF are you going on about?
Pure, Norton hasn't shipped with boot floppies for at least 4 years now and while the cd's are bootable, they aren't updatable so they are only as good as the AV definitions that were put on them at the time of production. So, my point here is, you can scan all you want with the boot floppies or bootable cd, but without an updated NAV you're wasting your time. :)
You were all half right.
In windows XP if you run MSCONFIG it gives you a boot to safe mode option.
In this mode the virus was not running.
I got a copy of the tool from the symantec site and run it here.
Then I put this .com object in my windows startup folder as a shortcut to a write protected floppy disk.
I booted the machine in normal mode and the AV ran and cleaned my registry + didn't get deleted.
Woo Hoo.
Glad to hear..
But did you follow the proceedure of disabling the system restore? or did you decide to play russian roulette?
Cheers
Undertaker,
If you enable the system restore KLEZ automagically infects the restore files.
The symantec tool deletes these rather than cleaning them so its pointless to switch it on.
(speaking from experience last night)
Good thing was the girl whos computer got infected was rather nice and its nice to be nice to nice people.(especially blondes)
(not my type though. bit to tidy.)
Ahhh.. so you didn't have system restore turned on.. is that right..?
It was turned on but the restore files were being infected so I turned it back off.
OO
O O Russian Rollete
OO
Ahh Ok.. Just have seen to many systems that haven't been cleaned properly.. Sry if I seem to have treated you like one of my apprentices..
Cheers
I agree with what Und3ertak3r said regarding System Restore- all of the vendors list out caveats and steps to take to disable System Restore before trying to remove the virus otherwise you will still have the virus and / or infected files in your System Restore folder.
The tool Ihave used with great success lately though is the McAfee Stinger utility instead of the other vendors tools. Instead of having to download a different removal tool for each virus or worm, Stinger can detect and remove all of the following (as of the latest release- version 1.4 from 02/26/2003):
W32/Lovgate@M
BackDoor-AQJ
W32/SQLSlammer
W32/Lirva
W32/Yaha
W32/Bugbear
W32/Elkern
W32/Klez
W32/Nimda@MM
W32/Sircam@MM
W32/Funlove@MM
So far I have found it to be an easy and effective tool.
download the free program called AVG
Hope it can help.
I got hit with KLEZ in an email some time ago, also with XP. I was running Norton, which alerted me to the infection as soon as the email was opened. I ran the fix downloaded from the Norton site twice, but it indicated that there was no KLEZ infection. Should I be worried?
If you had Norton AV installed and you keep it up to date you should have been safe.Quote:
I got hit with KLEZ in an email some time ago, also with XP. I was running Norton, which alerted me to the infection as soon as the email was opened. I ran the fix downloaded from the Norton site twice, but it indicated that there was no KLEZ infection. Should I be worried?
You say you got "hit" with Klez. Do you mean that Norton let you know that the email contained the Klez virus? If so, that is what it is supposed to do. It does not mean you were infected with Klez. It means you receievd Klez and your AV software is just alerting you and letting you know that it was successfully blocked.
If you ran the cleanup tool and found nothing you are most likely clean and the AV software did its job. If you are still worried, try the Stinger tool from McAfee that I referenced earlier in this thread. There is an updated version as of April 14. Here is the link: Stinger v1.5
If Norton did what it is suppose to do, the e-mail attachment should have been quarantined. I am not sure what version of Norton your running, but you can check what is in your quarantine by selecting "View" --> "Quarantine". In there it will list the date, filename, Virus Name and a few other things.Quote:
Originally posted here by _Wilky
I got hit with KLEZ in an email some time ago, also with XP. I was running Norton, which alerted me to the infection as soon as the email was opened. I ran the fix downloaded from the Norton site twice, but it indicated that there was no KLEZ infection. Should I be worried?
Cheers: