REQ: SPYBOT Virus help?

[young]

NAV's web site showed me to use NAV for the spybot virus and it found
57 viruses!

What's worse, my NAV definitions were supposed to be up to date AND
all 57 viruses showed under a directory kazaabackupfiles. I DON'T USE
AND NEVER USED KAZAA! So, where did they come from? Why under
kazaabackupfiles?

What with all the flak on file sharing (which I have no part of) I
stay away from Kazaa. So, what does all this mean? Should I be
concerned? Should i do anything?

Thanks

 

[Dave - Freedonia]

If this is the same virus, here is what Symantec states about it:
W32.Spybot.Worm is a detection for a family of worms that spreads using
KaZaA file-sharing and mIRC. This worm can also spread to computers
infected with common Backdoor Trojan Horses.

W32.Spybot.Worm can perform different backdoor-type functions by
connecting to a configurable IRC server and joining a specific channel
to listen for instructions

Here is the removal link:
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

 

[young]

If this is the same virus, here is what Symantec states about it:
W32.Spybot.Worm is a detection for a family of worms that spreads using
KaZaA file-sharing and mIRC. This worm can also spread to computers
infected with common Backdoor Trojan Horses.

W32.Spybot.Worm can perform different backdoor-type functions by
connecting to a configurable IRC server and joining a specific channel
to listen for instructions

Here is the removal link:
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Yeh but..............

Remember I said I have not ever used the kazaa file-sharing or mIRC,
so how in the heckie did I get 57 infected files all identified as
kazaa something?

Thanks

 

[Gray@FA]

If there is no Kazaabackupfiles directory then I would use another virus
scanner.

 

[young]

On Thu, 11 Sep 2003 17:02:45 GMT, "Gray@FA" <The

If there is no Kazaabackupfiles directory then I would use another virus
scanner.

Oh but there was (before I killed it). It contained all 57 file
names! I want to understand how this happened.

Thanks

 

[Gray@FA]

It sounds like its something that one of the virus files created to hide
itself. I do use Kazaa, and do not have that directory.

 

[young]

On Thu, 11 Sep 2003 19:20:22 GMT, "Gray@FA" <The

It sounds like its something that one of the virus files created to hide
itself. I do use Kazaa, and do not have that directory.

Well that IS interesting! I don't use kazaa and I get it, you DO and
you don't get it. I wish I had not been so quick to erase the
kazaabackupfiles directory and everything thereunder. I would have
liked to study the file naming etc further. Too late now I guess.

I just looked and the directory has not re-appeared, so I guess I can
hope the SPYBOT virus is gone.

 

[Gray@FA]

Well that IS interesting! I don't use kazaa and I get it, you don't
and you don't get it. I wish I had not been so quick to erase the
kazaabackupfiles directory and everything thereunder. I would have
liked to study the file naming etc further. Too late now I guess.

I just looked and the directory has not re-appeared, so I guess I can
hope the SPYBOT virus is gone.

Indeed this is an odd one. I do hope you have no further virii...

 

[Kelly]

Hi,

Run this small utility. The log file will let you know if any other
worms/virii are still running/installed.

Startup Programs Tracker - Processes (Line 261)
http://www.kellys-korner-xp.com/xp_tweaks.htm