Re: Interesting problem

Please visit the Virus Removal newsgroup experts:
news://msnews.microsoft.com/microso....security.virus

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

----------------------------------------------------------------------------------------------------

"baz" <anonymous@discussions.microsoft.com> wrote in message:
news:B7B62F82-0603-4C78-AEF5-78D2F29336B6@microsoft.com...

|I have an 'interesting' v-i-r-u-s problem. I have already benefited from some advice from this list, but to
no avail. I hope for more help. When you reply, please do NOT use the following words (for reasons that will
become apparent, I have inserted hyphens):
|
| v-i-r-u-s
| s-t-i-n-g-e-r
| h-i-j-a-c-k-t-h-i-s.
|
| Symptoms (Windows XP Home Edition):
|
| - I cannot see any processes in Task Manager (switching to safe mode allows me to see them, but a limited
range)
| - My AV software (F-secure) was disabled and I cannot re-install ("F-Secure Management Agent install error.
Starting drivers or services failed")
| - I cannot install the MS security updates (mea culpa, but I am not sure if they were successfully installed
earlier or not). When trying to install, CPU usage goes to 100% so nothing happens. Something is hogging the
processor.
| - I cannot look in some of my folders, if they have a name including the word "v-i-r-u-s". Re-naming the
folder allows me to view its contents
| - I cannot visit some web-sites. Again, this seems to be where the name includes "v-i-r-u-s" in the title.
My browser simply shuts down. This is why you cannot reply using this word - I cannot read your reply if you
do!
|
| What I've tried:
|
| - I've tried out the various anti-Sasser fixes from Symantec, etc. They report no v-i-r-u-s. I don't think
this is the problem.
| - I downloaded St-inger (4/5/04) from Network Associates. Interestingly (!) it would not run... In safe
mode it runs, but reports no problems. Back in normal Windows mode, if I rename st-inger.exe to (eg) new.exe
it runs... It again finds nothing. Also, the "List v-i-r-u-s-e-s" button in st-inger is disabled.
| - I tried h-i-j-a-c-k-t-h-i-s but my bug anticipates this - the program won't run, even if I rename it. It
will run in safe mode, but the list of processes is limited. If necessary I can provide this, but I won't in
this post in case it contains one of those words.
|
| It looks like I have a v-i-r-u-s which is monitoring keywords such as 'v-i-r-u-s', 's-t-i-n-g-e-r', etc.
Does anyone know what this is? Better, does anyone have a fix? Is there a way I can get Windows to list all
its processes? That may help, I think.
|
| Grateful for any help. I would post this to the v-i-r-u-s forum, but I cannot read it!