Virus W32.SpyBoot

[Micorsoft]

From two days I have infected with W32.SpyBoot , and I did not now how to
remove it , I have Norton Anti Virus 2004 updated till today.

Please advise by installing Firewall I will stop this virus or not.

Ahmed

 

[Dave]

installing a firewall may have prevented it from getting on your machine in
the first place, but it won't get rid of it. try booting in safe mode and
run virus scan then. if that doesn't work visit the norton web site and see
if they have a removal tool or manual instructions.

 

[Micorsoft]

Thanks for your quick reply but I have already check Symantec web site and
I did not find removable toll for spyboot !!??

Please advise

 

[Carey Frisch [MVP]]

"W32.Spybot.Worm is a detection for a family of worms that spreads
using KaZaA file-sharing and mIRC. This worm can also spread to
computers that are infected with common backdoor Trojan horses".
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

--------------------------------------------------------------------------------

:

| From two days I have infected with W32.SpyBoot , and I did not now how to
| remove it , I have Norton Anti Virus 2004 updated till today.
|
| Please advise by installing Firewall I will stop this virus or not.
|
| Ahmed

 

[David H. Lipman]

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

1) Download the following two items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download sysclean.com and place it in that directory.
Dowload the signature files (pattern files) by obtaing the ZIP file.

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
3) Reboot your PC into Safe Mode
4) Using the Trend Sysclean utility, perform a Full Scan of your platform and
clean/delete any infectors found
5) Restart your PC and perform a "final" Full Scan of your platform
6) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
7) Reboot your PC.
8) If you are using WinME or WinXP, create a new Restore point
9) Please report back your results

Dave





| From two days I have infected with W32.SpyBoot , and I did not now how to
| remove it , I have Norton Anti Virus 2004 updated till today.
|
| Please advise by installing Firewall I will stop this virus or not.
|
| Ahmed
|
|

 

[Dave]

are you perhaps spelling it wrong? isn't it spybot instead of spyboot?? if
it is spybot how about the procedure on this page?
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.eas.html

 

[Frank Clark]

Glad to see someone else reccomending Trend, great company. Also
lavasofts software is good. Pest patrol is great also but the were
bought by CA and are being changed so have to see in the future on
that one. Also spybot search and destroy are good too.
Frank Clark
10/2/2004 7:03:07 AM