How to replace virus infected winlogon.exe and Internet.dll ??

[Mark Spitzer]

Ok. I catched a virus and my virus scanner indicated that 2 files are infected:

C:WINNT\winlogon.exe with Netsky
and

C:\Program Files\Common Files\Webroot Shared\Internet.dll with Ferat 1.0 Backdoor

can I simply delete these files to get rid of the virus?

Or are these files (the original ones) are necessary for a proper run of Win2000 ?

How do I replace them with the original files?

Mark

 

[Guest]

http://www.microsoft.com/security/antivirus/mydoom.asp

 

[Steve Parry [MVP]]

In

Ok. I catched a virus and my virus scanner indicated that 2 files are
infected:

C:WINNT\winlogon.exe with Netsky
and

C:\Program Files\Common Files\Webroot Shared\Internet.dll with Ferat
1.0 Backdoor

can I simply delete these files to get rid of the virus?

Or are these files (the original ones) are necessary for a proper run
of Win2000 ?

How do I replace them with the original files?

Mark

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

ftp://ftp.f-secure.com/anti-virus/tools/f-netsky.exe

ftp://ftp.f-secure.com/anti-virus/tools/f-netsky.txt

 

[Mattias Honrendgard]

Ok. I catched a virus and my virus scanner indicated that 2 files are infected:

C:WINNT\winlogon.exe with Netsky
and

C:\Program Files\Common Files\Webroot Shared\Internet.dll with Ferat 1.0 Backdoor

can I simply delete these files to get rid of the virus?

Or are these files (the original ones) are necessary for a proper run of Win2000 ?

How do I replace them with the original files?

Mark

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

 

[Ricardo M. Urbano - W2K/NT4 MVP]

Ok. I catched a virus and my virus scanner indicated that 2 files are infected:

C:WINNT\winlogon.exe with Netsky
and

C:\Program Files\Common Files\Webroot Shared\Internet.dll with Ferat 1.0 Backdoor

can I simply delete these files to get rid of the virus?

Or are these files (the original ones) are necessary for a proper run of Win2000 ?

How do I replace them with the original files?

Mark

netlogon is not even supposed to be in %SystemRoot%. The netsky version
is an additional copy and it works because it is an "earlier" part of
the search path, so just delete that copy...plus follow all the other
links already posted.

hth

 

[Colin Wilson]

Ok. I catched a virus and my virus scanner indicated that 2 files are infected:

As a stopgap if nothing else, try this:

ftp://ftp.kaspersky.com/utils/

Grab clrav.com and run it - it has 3 possible reports - clean, found
something but sorted it, and found something and sorted it, but needs a
reboot and a re-run to finish the job