Win32/Apropos.B; WinNT/Zufyx.ASpyware.Apropos.C; Trojan.Win32.Cryp

[Guest]

I received a message from reporting a major shutdown to MS that I had these
viruses on my computer:
Win32/Apropos.B;
WinNT/Zufyx.A
Spyware.Apropos.C;
Trojan.Win32.Crypt.t

When I try to go on safe mode by pressing F8 when booting, and then sign on
to the internet using AOL, it says that my modem is being blocked, so I can't
get to the HTTP://safety.live.com/ website to remove the problem, because
apparently they are only detectable in safe mode. can someone help me? I
have ordered the new SP patch for XP, but I have a 56k modem connection, so i
can't download many things very fast. I am also receiving the following
message as a part of the virus problem: "UTISSEND.EXE HAS ENCOUNTERED A
PROBLEM AND NEEDS TO CLOSE. WE ARE SORRY FOR THE INCONVENIENCE". Also, a
folder entitled, "System 32" opens on startup. can anyone help me; I'm
desperate...
mark

 

[David H. Lipman]

From: "Multiple Virus Problems: I'm Deserate!!" <Multiple Virus Problems: I'm
[email protected]>

| I received a message from reporting a major shutdown to MS that I had these
| viruses on my computer:
| Win32/Apropos.B;
| WinNT/Zufyx.A
| Spyware.Apropos.C;
| Trojan.Win32.Crypt.t
|
| When I try to go on safe mode by pressing F8 when booting, and then sign on
| to the internet using AOL, it says that my modem is being blocked, so I can't
| get to the HTTP://safety.live.com/ website to remove the problem, because
| apparently they are only detectable in safe mode. can someone help me? I
| have ordered the new SP patch for XP, but I have a 56k modem connection, so i
| can't download many things very fast. I am also receiving the following
| message as a part of the virus problem: "UTISSEND.EXE HAS ENCOUNTERED A
| PROBLEM AND NEEDS TO CLOSE. WE ARE SORRY FOR THE INCONVENIENCE". Also, a
| folder entitled, "System 32" opens on startup. can anyone help me; I'm
| desperate...
| mark

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Start with the McAfee module in the following Multi AV Scanning Tool.

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[Lorraine]

I have exactly the same problem - same virus message/virus names - and,
like you, can't access the internet in safe mode. I will try the
suggestions offered by David who replied to your question. Hope you
were successful!
Lorraine

 

[David H. Lipman]

From: "Lorraine" <[email protected]>

| I have exactly the same problem - same virus message/virus names - and,
| like you, can't access the internet in safe mode. I will try the
| suggestions offered by David who replied to your question. Hope you
| were successful!
| Lorraine

Lets us know how you make out.

 

[Guest]

David:
For the most part, it worked! I wasn't able to run sophos, but i ran the
other 3 and I think that it found alot more than I knew about lurking in the
dark recesses of "DOSLand"! Thanks for your help! everything is lightening
fast like when i first bought the computer 2 years ago. I AM STILL GETTING
THE SYSTEM 32 FOLDER OPENING ON STARTUP THOUGH. I JUST CLOSE IT AND GO ON
WITH MY ACTIVITY AND EVERYTHING WORKS GREAT: IF YOU HAVE ANY SUGGESTIONS, BE
VERY DETAILED INSTRUCTION BECAUSE I AM A NOVICE AT SOLVING THESE PROBLEMS.

THANKS FOR EVERYTHING,

mARK DEVILBISS, LAS VEGAS , NV

From: "Multiple Virus Problems: I'm Deserate!!" <Multiple Virus Problems: I'm
[email protected]>

| I received a message from reporting a major shutdown to MS that I had these
| viruses on my computer:
| Win32/Apropos.B;
| WinNT/Zufyx.A
| Spyware.Apropos.C;
| Trojan.Win32.Crypt.t
|
| When I try to go on safe mode by pressing F8 when booting, and then sign on
| to the internet using AOL, it says that my modem is being blocked, so I can't
| get to the HTTP://safety.live.com/ website to remove the problem, because
| apparently they are only detectable in safe mode. can someone help me? I
| have ordered the new SP patch for XP, but I have a 56k modem connection, so i
| can't download many things very fast. I am also receiving the following
| message as a part of the virus problem: "UTISSEND.EXE HAS ENCOUNTERED A
| PROBLEM AND NEEDS TO CLOSE. WE ARE SORRY FOR THE INCONVENIENCE". Also, a
| folder entitled, "System 32" opens on startup. can anyone help me; I'm
| desperate...
| mark

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Start with the McAfee module in the following Multi AV Scanning Tool.

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[David H. Lipman]

From: "Multiple Virus Problems: I''m Deserate!!"
<[email protected]>

| David:
| For the most part, it worked! I wasn't able to run sophos, but i ran the
| other 3 and I think that it found alot more than I knew about lurking in the
| dark recesses of "DOSLand"! Thanks for your help! everything is lightening
| fast like when i first bought the computer 2 years ago. I AM STILL GETTING
| THE SYSTEM 32 FOLDER OPENING ON STARTUP THOUGH. I JUST CLOSE IT AND GO ON
| WITH MY ACTIVITY AND EVERYTHING WORKS GREAT: IF YOU HAVE ANY SUGGESTIONS, BE
| VERY DETAILED INSTRUCTION BECAUSE I AM A NOVICE AT SOLVING THESE PROBLEMS.
|
| THANKS FOR EVERYTHING,
|
| mARK DEVILBISS, LAS VEGAS , NV
|

YW Mark !

Execute MSCONFIG.EXE and look in the StartUp Tab for what starts up "SYSTEM 32 FOLDER
OPENING ON STARTUP" and disable it.

BTW: That wasn't DOS or "DOSLand", the scanners run as Command Console command line
scanners, not Windows GUI utilities.

 

[Guest]

David:
I got the System 32 to stop opening on startup. i did what u said w/ the
msconfig.exe file. i couldn't find anything in the 24 items that had a
command line that specified the system 32 folder to open, so i started w/ the
process of elimination.
I first stopped the startup folder from loading to isolate it to that
folder; it stopped. i then restarted the startup folder and eliminated 12 of
the items from loading. Lo and behold, after reloading w/o those 12 items,
not only the system 32 folder didn't load, but the command line for one of
the items "disappeared". I then re-enabled the other 11 and was able to
eliminate the problem. sounds like a remnant from one of the viruses that
were eliminated by the batch files that you recommended. thanks for
everything; my system is lightening fast w/o any of the former glitches. God
Bless, and have a blessed Christmas/Hannakuh/Kwansa or whatever you do/don't
celebrate (need to be politically correct, you know; "I'm not dead, I'm just
metaphysically challenged..." lol .

Mark DeVilbiss
Las Vegas, NV

 

[David H. Lipman]

From: "Multiple Virus Problems: I''m Deserate!!"
<[email protected]>

| David:
| I got the System 32 to stop opening on startup. i did what u said w/ the
| msconfig.exe file. i couldn't find anything in the 24 items that had a
| command line that specified the system 32 folder to open, so i started w/ the
| process of elimination.
| I first stopped the startup folder from loading to isolate it to that
| folder; it stopped. i then restarted the startup folder and eliminated 12 of
| the items from loading. Lo and behold, after reloading w/o those 12 items,
| not only the system 32 folder didn't load, but the command line for one of
| the items "disappeared". I then re-enabled the other 11 and was able to
| eliminate the problem. sounds like a remnant from one of the viruses that
| were eliminated by the batch files that you recommended. thanks for
| everything; my system is lightening fast w/o any of the former glitches. God
| Bless, and have a blessed Christmas/Hannakuh/Kwansa or whatever you do/don't
| celebrate (need to be politically correct, you know; "I'm not dead, I'm just
| metaphysically challenged..." lol .
|
| Mark DeVilbiss
| Las Vegas, NV
|

Happy Holidays to you as well !

 

[Guest]

Lorraine:

Do what David says. He is trustworthy and everything he told me worked
perfectly, OK?

Happy Holidays,

Mark DeVilbiss, Las Vegas, NV