safe mode scan misses zafi.b

[rello]

i installed CET [etrust] antivirus on a W98 machine and ran a scan in
safe mode......nothing was picked up.............on reboot into normal
mode viruses [Zafi.b & winshow.g] were picked up as windows
booted....they were active and couldnt be deleted.....had to go back
into safe mode and individually delete each infected file.....

should scans be done in safe mode or do i just waste time doing it???
relloman

 

[David H. Lipman]

Obtain McAfee's virus and worm removal tool, Stinger: http://vil.nai.com/vil/stinger/

1) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Reboot your PC into Safe Mode
3) Using McAfee Stinger, perform a Full Scan of your platform and clean/delete any
infectors found
4) Restart your PC and perform a "final" Full Scan of your platform
5) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 200 ~ 400MB),
reboot your PC.
6) If you are using WinME or WinXP, create a new Restore point
7) Please report back your results

Dave




| i installed CET [etrust] antivirus on a W98 machine and ran a scan in
| safe mode......nothing was picked up.............on reboot into normal
| mode viruses [Zafi.b & winshow.g] were picked up as windows
| booted....they were active and couldnt be deleted.....had to go back
| into safe mode and individually delete each infected file.....
|
| should scans be done in safe mode or do i just waste time doing it???
| relloman

 

[rello]

Obtain McAfee's virus and worm removal tool, Stinger: http://vil.nai.com/vil/stinger/

1) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Reboot your PC into Safe Mode
3) Using McAfee Stinger, perform a Full Scan of your platform and clean/delete any
infectors found
4) Restart your PC and perform a "final" Full Scan of your platform
5) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 200 ~ 400MB),
reboot your PC.
6) If you are using WinME or WinXP, create a new Restore point
7) Please report back your results

Dave




| i installed CET [etrust] antivirus on a W98 machine and ran a scan in
| safe mode......nothing was picked up.............on reboot into normal
| mode viruses [Zafi.b & winshow.g] were picked up as windows
| booted....they were active and couldnt be deleted.....had to go back
| into safe mode and individually delete each infected file.....
|
| should scans be done in safe mode or do i just waste time doing it???
| relloman

a very nasty little bug this one...it had infected norton system
works, norton av and kerio personal firewall....the more infected
files deleted the more it infected other files.....as work progressed
the system became more unstablei ..........we formatted the hd and now
all is clear...we were able to retrieve the clients data files......
thanks for the tip
relloman