Infected files

[Guest]

hi,

Two files on my computer have been infected with the "W.32.Spybot.Worm"
virus, and I wanted your help. I used Norton 2004, but it says it can't solve
the problem.

Basically, these are system files, and I wanted to know if I could solve the
problem by simply copying/pasting the two system files from another computer
with windows2000 (like mine) onto my computer, thus over-writing those two
infected files.

Would it work?

The two files are:
C:WINNT/System32/Winole.exe
C:WINNT/System32/Bootmng.exe

Thankyou very much for your time

 

[DL]

What makes you think its either that virus or the two specific files are
corrupted?
Symantec makes no mention of these two files being corrupted, also NAV
should be able to remove this specific virus
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html
Perhaps you should investigate the 'scannow' command - system file checker,
see help -

 

[Guest]

Hi again,

Let me explain the situation:
I re-formatted my computer a few weeks ago, and since then it's been
downloading lots of spyware and slowing the computer down. I would remove the
spyware with Spybot, Ad-Aware, etc., but everytime I switched my modem on, it
all came back.

So I installed Norton AV 2004, and downloaded all the updates. Then I ran a
scan, and it found seven viruses. It deleted five of the infected files, but
said it could NOT delete the other TWO.

NAV said these files were both infected with the "W.32.Spybot.Worm" virus.
NAV also said these files were:
C:WINNT/System32/Winole.exe
C:WINNT/System32/Bootmng.exe

The link you gave me tells me to go into windows in safe mode, and delete
the files. But as these are system files, is that a good idea? Wouldn't it
affect the way my computer runs?

Also, what do you think of my idea of deleting those files and immediately
replacing them with identical files from another windows 2000 computer?

Thankyou very much

 

[Gary Smith]

There are no files by those names on my machine. Most likely they're part
of the virus and not Windows files at all. While in Safe Mode, create a
new folder named something like Quarantine and copy those files into
it, then delete the originals. Then reboot normally and rerun NAV.

Hi again,

Let me explain the situation:
I re-formatted my computer a few weeks ago, and since then it's been
downloading lots of spyware and slowing the computer down. I would remove the
spyware with Spybot, Ad-Aware, etc., but everytime I switched my modem on, it
all came back.

So I installed Norton AV 2004, and downloaded all the updates. Then I ran a
scan, and it found seven viruses. It deleted five of the infected files, but
said it could NOT delete the other TWO.

NAV said these files were both infected with the "W.32.Spybot.Worm" virus.
NAV also said these files were:
C:WINNT/System32/Winole.exe
C:WINNT/System32/Bootmng.exe

The link you gave me tells me to go into windows in safe mode, and delete
the files. But as these are system files, is that a good idea? Wouldn't it
affect the way my computer runs?

 

[DL]

Also if you use the System File Checker it will replace any corrupt sys
files.
Likewise a simple google search for these two files will give many hits.
They are not part of the virus you mentioned, but another.
You installed NAV but you do not mention a Firewall. Its a neccessity!!
ZoneAlarm has a free version, much reccomended.
http://www.lavasoft.nu/