IT help - Virus on computer and keyboard not UK?
Feb 17th 2005, 9:35 pm
#1
I never gave up trying
Thread Starter
Joined: Nov 2003
Location: Belair, S.A.
Posts: 86
IT help - Virus on computer and keyboard not UK?
Little nephew using MSN messenger has been sent some msdos files that run and open when within MSN - Tried deleting files from the root directory within windows explorer and msdos, but after about 3 seconds they re-appear - Any body got any suggestions in getting rid of them? They already have a new version of McFee Antivirus software, but it does not detect anything wrong. Brother refused a system restore to be done - Any other suggestions in deleting them?
Also keyboard is howing a @ character as a " character - Where do in windows XP can I change it? Looked at they keyboard setting in Control Panel, but cannot see anything there?? I'm I looking in the wrong place?
Any help on above 2 would be appreciated.
P.s. My leaving party tommorrow night at the Coby Irish Centre - Finally its my turn..GULP! Any encouraging words would be appreciated on that too!
Also keyboard is howing a @ character as a " character - Where do in windows XP can I change it? Looked at they keyboard setting in Control Panel, but cannot see anything there?? I'm I looking in the wrong place?
Any help on above 2 would be appreciated.
P.s. My leaving party tommorrow night at the Coby Irish Centre - Finally its my turn..GULP! Any encouraging words would be appreciated on that too!
Feb 17th 2005, 9:53 pm
#2
Class 2 Guru
Joined: May 2004
Location: Where the stars look very diff-e-rent today... and tomorrow!
Posts: 1,124
Re: IT help - Virus on computer and keyboard not UK?
Originally Posted by gunnercaz
Also keyboard is howing a @ character as a " character - Where do in windows XP can I change it? Looked at they keyboard setting in Control Panel, but cannot see anything there?? I'm I looking in the wrong place?
Feb 17th 2005, 11:18 pm
#3
Living the Dream
Joined: Nov 2004
Location: Jerrabomberra 5 minutes from Canberra
Posts: 83
Re: IT help - Virus on computer and keyboard not UK?
Hi
My first thoughts are that it could be a recent virus called: W32/Bropia.worm.n. The worm propagates through MSN messenger and relies on people clicking on an attachment
The worm drops a copy of itself into the C:\ directory using any of the following filenames:
• c:\Beautiful Ass.pif
• c:\John Kerry as Super Chicken.scr
• c:\Kool.pif
• c:\Me & you pic!.pif
• c:\Me Pissed!.pif
• c:\sexy.pif
• c:\She Could Fit her Ass in a Teacup.pif
• c:\she's ****in fit.pif
• c:\titanic2.jpg.pif
Also the following processes are disabled on the victim's machine to prevent the user from manually stopping and removing the worm:
• Regedit.exe - registry editor
• Mstask.exe - task manager
I know you said they have a new version of McAfee, but the settings need to be checked to make sure all files are being scanned and that it has the very latest virus definitions downloaded. Please find out what engine and DAT files the AV is using and let me know.
Steve
My first thoughts are that it could be a recent virus called: W32/Bropia.worm.n. The worm propagates through MSN messenger and relies on people clicking on an attachment
The worm drops a copy of itself into the C:\ directory using any of the following filenames:
• c:\Beautiful Ass.pif
• c:\John Kerry as Super Chicken.scr
• c:\Kool.pif
• c:\Me & you pic!.pif
• c:\Me Pissed!.pif
• c:\sexy.pif
• c:\She Could Fit her Ass in a Teacup.pif
• c:\she's ****in fit.pif
• c:\titanic2.jpg.pif
Also the following processes are disabled on the victim's machine to prevent the user from manually stopping and removing the worm:
• Regedit.exe - registry editor
• Mstask.exe - task manager
I know you said they have a new version of McAfee, but the settings need to be checked to make sure all files are being scanned and that it has the very latest virus definitions downloaded. Please find out what engine and DAT files the AV is using and let me know.
Steve
Originally Posted by gunnercaz
Little nephew using MSN messenger has been sent some msdos files that run and open when within MSN - Tried deleting files from the root directory within windows explorer and msdos, but after about 3 seconds they re-appear - Any body got any suggestions in getting rid of them? They already have a new version of McFee Antivirus software, but it does not detect anything wrong. Brother refused a system restore to be done - Any other suggestions in deleting them?
Also keyboard is howing a @ character as a " character - Where do in windows XP can I change it? Looked at they keyboard setting in Control Panel, but cannot see anything there?? I'm I looking in the wrong place?
Any help on above 2 would be appreciated.
P.s. My leaving party tommorrow night at the Coby Irish Centre - Finally its my turn..GULP! Any encouraging words would be appreciated on that too!
Also keyboard is howing a @ character as a " character - Where do in windows XP can I change it? Looked at they keyboard setting in Control Panel, but cannot see anything there?? I'm I looking in the wrong place?
Any help on above 2 would be appreciated.
P.s. My leaving party tommorrow night at the Coby Irish Centre - Finally its my turn..GULP! Any encouraging words would be appreciated on that too!
Feb 18th 2005, 7:18 am
#4
I never gave up trying
Thread Starter
Joined: Nov 2003
Location: Belair, S.A.
Posts: 86
Re: IT help - Virus on computer and keyboard not UK?
Hi Steve.
Yes these are the files that keep coming back when I attempt to delete them and it looks like the bropia worm virus that you told me about.
My brother has a copy of Mcfee antivirus software. He has it for a free 90 day trail - It looks like version 7.0 but can't be sure as there is nothing on the disc to show the version number.
It looks like it is updated because when I clicked the update button-it told me I already had the latest version? I know one of my brothers sons friend norton anti virus got rid of his infection, but this version of McFee does not seem to have detected it. How do I change it to remoe the infected files?
Cheers,
Carol
Yes these are the files that keep coming back when I attempt to delete them and it looks like the bropia worm virus that you told me about.
My brother has a copy of Mcfee antivirus software. He has it for a free 90 day trail - It looks like version 7.0 but can't be sure as there is nothing on the disc to show the version number.
It looks like it is updated because when I clicked the update button-it told me I already had the latest version? I know one of my brothers sons friend norton anti virus got rid of his infection, but this version of McFee does not seem to have detected it. How do I change it to remoe the infected files?
Cheers,
Carol
Originally Posted by RockHopper
Hi
My first thoughts are that it could be a recent virus called: W32/Bropia.worm.n. The worm propagates through MSN messenger and relies on people clicking on an attachment
The worm drops a copy of itself into the C:\ directory using any of the following filenames:
• c:\Beautiful Ass.pif
• c:\John Kerry as Super Chicken.scr
• c:\Kool.pif
• c:\Me & you pic!.pif
• c:\Me Pissed!.pif
• c:\sexy.pif
• c:\She Could Fit her Ass in a Teacup.pif
• c:\she's ****in fit.pif
• c:\titanic2.jpg.pif
Also the following processes are disabled on the victim's machine to prevent the user from manually stopping and removing the worm:
• Regedit.exe - registry editor
• Mstask.exe - task manager
I know you said they have a new version of McAfee, but the settings need to be checked to make sure all files are being scanned and that it has the very latest virus definitions downloaded. Please find out what engine and DAT files the AV is using and let me know.
Steve
My first thoughts are that it could be a recent virus called: W32/Bropia.worm.n. The worm propagates through MSN messenger and relies on people clicking on an attachment
The worm drops a copy of itself into the C:\ directory using any of the following filenames:
• c:\Beautiful Ass.pif
• c:\John Kerry as Super Chicken.scr
• c:\Kool.pif
• c:\Me & you pic!.pif
• c:\Me Pissed!.pif
• c:\sexy.pif
• c:\She Could Fit her Ass in a Teacup.pif
• c:\she's ****in fit.pif
• c:\titanic2.jpg.pif
Also the following processes are disabled on the victim's machine to prevent the user from manually stopping and removing the worm:
• Regedit.exe - registry editor
• Mstask.exe - task manager
I know you said they have a new version of McAfee, but the settings need to be checked to make sure all files are being scanned and that it has the very latest virus definitions downloaded. Please find out what engine and DAT files the AV is using and let me know.
Steve
Feb 18th 2005, 7:26 am
#5
What's happening dudes?
Joined: Mar 2004
Location: Bayside Brisbane
Posts: 20,647
Re: IT help - Virus on computer and keyboard not UK?
Originally Posted by gunnercaz
It looks like it is updated because when I clicked the update button-it told me I already had the latest version?
Feb 18th 2005, 7:54 am
#6
I never gave up trying
Thread Starter
Joined: Nov 2003
Location: Belair, S.A.
Posts: 86
Re: IT help - Virus on computer and keyboard not UK?
Hello anti-virus helpers.
I've tried downloading and then running that exe file, but got error message "Unable to find any Qualifying products" when trying to run it?
According to McFee - the program that copies the pif files or is associated with the virus is a file called isass.exe that sits in C:\windows\system32 folder. I renamed the file and then deleted the pif files in the root directory, rebooted the PC and the files have NOT come back. Have I done the right thing and removed the virus okay?
Regards,
Carol.
p.s. many thanks MarkMyWord as this keyboard is working with the correct uk settings now as your advice about where the problem was, was spot on!
Where would we be without britishexpats to help remove viruses!
I've tried downloading and then running that exe file, but got error message "Unable to find any Qualifying products" when trying to run it?
According to McFee - the program that copies the pif files or is associated with the virus is a file called isass.exe that sits in C:\windows\system32 folder. I renamed the file and then deleted the pif files in the root directory, rebooted the PC and the files have NOT come back. Have I done the right thing and removed the virus okay?
Regards,
Carol.
p.s. many thanks MarkMyWord as this keyboard is working with the correct uk settings now as your advice about where the problem was, was spot on!
Where would we be without britishexpats to help remove viruses!
Originally Posted by wmoore
Just top be sure, go to http://www.networkassociates.com/us/...s/superdat.asp and download and run SDAT4429.EXE. It will detect your virus and hopefully kill it.
Feb 18th 2005, 8:33 am
#7
What's happening dudes?
Joined: Mar 2004
Location: Bayside Brisbane
Posts: 20,647
Re: IT help - Virus on computer and keyboard not UK?
Originally Posted by gunnercaz
I've tried downloading and then running that exe file, but got error message "Unable to find any Qualifying products" when trying to run it?
Originally Posted by gunnercaz
According to McFee - the program that copies the pif files or is associated with the virus is a file called isass.exe that sits in C:\windows\system32 folder. I renamed the file and then deleted the pif files in the root directory, rebooted the PC and the files have NOT come back. Have I done the right thing and removed the virus okay?
Feb 18th 2005, 9:45 am
#8
I never gave up trying
Thread Starter
Joined: Nov 2003
Location: Belair, S.A.
Posts: 86
Re: IT help - Virus on computer and keyboard not UK?
Did a complete scan of the PC with Mcfee and it did not detect the virus.
I have only renamed the file isass.exe not deleted it - So far windows is behaving fine.
What is service-pack 2 setup? Do you mean reload windows?
I have only renamed the file isass.exe not deleted it - So far windows is behaving fine.
What is service-pack 2 setup? Do you mean reload windows?
Originally Posted by wmoore
Ah OK. This means your version of McAfee is not what I thought it was.If it was a MyDoom variant (sounds like it was) then this will stop it spreading itself further. I would still do a complete scan of your hard drives with McAfee if I were you. I would also re-run Service Pack 2 setup to replace lsass.exe because that is a Windows system file and you might have some funny things happen after you deleted it!
