Nebiwo virus help???

[Pete K.]

Help! My pc has been infected with the nebiwo virus, and neither McAfee
Virus Scan Online nor Norton AntiVirus seem to be able to clean it from my
system. I have also downloaded the FixNebiwo.exe from Norton, and have also
downloaded and run the McAfee dailyscan (DOS program), with no success.
Both will indicate that the computer has been cleaned, but it keeps
reappearing on rebooting. Does anyone have any ideas on where it might be
hiding? I am running XP pro, and I have disabled System restore as advised.

TIA, Pete

 

[nicky]

Help! My pc has been infected with the nebiwo virus, and neither McAfee
Virus Scan Online nor Norton AntiVirus seem to be able to clean it from my
system. I have also downloaded the FixNebiwo.exe from Norton, and have also
downloaded and run the McAfee dailyscan (DOS program), with no success.
Both will indicate that the computer has been cleaned, but it keeps
reappearing on rebooting. Does anyone have any ideas on where it might be
hiding? I am running XP pro, and I have disabled System restore as advised.

TIA, Pete

did you delete the registry value that nebiwo drops in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

the value you need to get rid of is in the right pane:

NAV Live Update <path to worm>

Make sure you back up the registry first just in case


Nicky

 

[Banana Republic]

In case you did forget how to go to Windows registry or any other program,
click on Run and then type regedit, then press enter and voilà, you are
there.

Remember, don't mess up with the registry

Banana Republic

 

[David W. Hodgins]

Help! My pc has been infected with the nebiwo virus, and neither McAfee
Virus Scan Online nor Norton AntiVirus seem to be able to clean it from my
system. I have also downloaded the FixNebiwo.exe from Norton, and have also
downloaded and run the McAfee dailyscan (DOS program), with no success.
Both will indicate that the computer has been cleaned, but it keeps
reappearing on rebooting. Does anyone have any ideas on where it might be
hiding? I am running XP pro, and I have disabled System restore as advised.

You may be getting reinfected by having weak/no passwords on administrator
accounts, or open file sharing. See http://www.claymania.com/safe-hex.html
for general info on protecting your system. It's oriented towards win 9x
systems, but most of it still applies.

http://biss.beckman.uiuc.edu/securi...ecuring Windows XP Professional-checklist.htm
has a very detailed list of steps to take, to secure an XP PRO system, or
you can google on "setting administrator password xp pro", for other
sites.

Regards, Dave Hodgins