Possible Virus - msmscfg.exe hosts

[Mitch Evans]

We got hit with some type of virus on 4/13/04. It is on
all our XP machines. We have the latest patches and
virus updates. A file named msmscfg.exe is dropped in
the c:\windows\system32 directory as well as in the
registry. All the major virus scanners will not detect
this either. Once dropped the hosts file is modified,
and redirects all requests to the major virus software
vendors back to the local machine. It also will not
allow regedit to be run. It will also disable the real
time virus scanners for Norton, Mcaffee, Computer
Associates etc. If you delete it from the registry and
hard drive, it will come right back, usually after you
see three dos screens flas accros the screen. We have
reported this and have no luck in a solution at this
time. It has infected over 100 of our Windows XP and
2000 machines, and all are patched with the latest
patches.

 

[Guest]

I too was infected by a similar virus. But it wasn't in the folder of C:\Windows\System32, and called something else. It was called msiesh.dll and act like it was a program. I unstall it, even though I never install it into my computer. I also have Win XP, but Home Edition

 

[Steve Nielsen]

Some worms copy themelves as a random filename and they also disable or
hinder a/v programs so they go undetected. Start in Safe Mode and then
run your a/v scans.

Steve

 

[Ram]

We have the same issue. Is there a solution yet?

Thanks,

Ram

"

 

[Steve Nielsen]

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.adn.html

Steve

 

[Steve Nielsen]

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.adn.html

Steve