spread

[Stephane P.]

Hi,

I have recently installed a trial version of NAV 2004.
Since then, NAV continuously (every 10-15 minutes) finds a virus
(W32.IRCBot.Gen) on the file "spread.exe" located in WIn 2000 system folder
and deletes it. I can't find this file which Windows is apparently
re-creating automatically after deletion from NAV. If anyone has had the
similar problem or has a solution, I would greatly appreciate.

Thanks

Stephane P.

 

[Duane Arnold]

Hi,

I have recently installed a trial version of NAV 2004.
Since then, NAV continuously (every 10-15 minutes) finds a virus
(W32.IRCBot.Gen) on the file "spread.exe" located in WIn 2000 system
folder and deletes it. I can't find this file which Windows is
apparently re-creating automatically after deletion from NAV. If
anyone has had the similar problem or has a solution, I would greatly
appreciate.

Thanks

Stephane P.

I think Win 2K is not automatically putting back spread.exe. The only
time Win 2k or a NT based O/S will put back a file that has been deleted
is when the file that was deleted is a Win 2k or NT based O/S file. If
one of those files is deleted, then Win 2k is going to go to Winnt
\system32\dllcache or (Windows\system32\dllcache *XP*) and restore the
file to where it belongs.

It sounds to me that your machine has been compromised by an additional
program that continues to make the compromising file, IMHO.

Duane

 

[Karel]

Hi,

I have recently installed a trial version of NAV 2004.
Since then, NAV continuously (every 10-15 minutes) finds a virus
(W32.IRCBot.Gen) on the file "spread.exe" located in WIn 2000 system folder
and deletes it. I can't find this file which Windows is apparently
re-creating automatically after deletion from NAV. If anyone has had the
similar problem or has a solution, I would greatly appreciate.

Follow the instructions here: http://vil.nai.com/vil/content/v_99627.htm

 

[Shawn]

I have the exact same problem on one of my machines in another office.
I can't seem to get rid of it and it keeps notifying me every 10-15
minutes same virus in the same file. The removal instructions on
symantec's website are vague at best. Anyone that could help it would
be greatly appreciated!!!!

Thanks,

Shawn

 

[Karel]

I have the exact same problem on one of my machines in another office.
I can't seem to get rid of it and it keeps notifying me every 10-15
minutes same virus in the same file. The removal instructions on
symantec's website are vague at best. Anyone that could help it would
be greatly appreciated!!!!

Thanks,

Shawn

"Stephane P." <[email protected]> wrote in message

Here are some instructions:
http://vil.nai.com/vil/content/v_99627.htm

Additional XP/ME removal considerations:
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm

 

[Stephane P.]

Hi,

Thanks for your help which has not brought any success, unfortunately.
I have followed instructions from VisruScan (installed latest DAT file...).
As NAV, Viruscan identifies the infected file but cannot delete it. The
problem remains.
NAV deletes the file which reappears every 10-15 minutes. The source
(creating the file) is still there.
Any other suggestion ?

Stéphane P.