From: "Gerry Cornell" <
[email protected]>
| Charlie
|
| Another useful tool in these situations is Stinger. Regains control
of
| the machine. With LSP Fix you then have access to support from the
| internet to clean the machine. It still leaves you reliant on a 56
kb
| modem in some situations, which can be limiting for larger downloads
but
| there you are.
|
| Download Stinger from here and run it to make sure that
A-V-disabling
| viruses are not present on your PC
|
http://download.nai.com/products/mcafee-avert/stinger.exe
|
| Fits on a floppy which you can write protect before running. This is
| useful if the computer does not have a CD drive as some older
computers
| do not. It would be better to download to another machine and put on
the
| floppy before introducing the disk to the infected machine. Make
sure
| you run the anti-virus scan in safe mode.
|
McAfee/AVERT Stinger only targets ~54 infectors and their variants,
mostly internet worms.
It is updated infrequently and should only be downloaded and used *IF*
you know you are
infected with one of the targeted infectors. The fact is Stinger has
fallen behind. There
are *many* new Bagle and SDBot variants that have come out since its
last update of 10/5/05.
On the other hand, the following Multi AV Scanning Tool is a
broad-spectrum removal tool.
The McAfee command line scanner alone covers ~155,000 infectors
including all the infectors
Stinger targets and way more and gets updated regularly.
Additionally, it adds the scanners
from Trend Micro, Sophos and Kaspersky. Thus its coverage is very
comprehensive. Stinger
comes only as a Win32 GUI. While it can be executed in Safe Mode and
Normal Mode, it can't
be used from DOS. On the other hand, the Multi AV Scanning Tool
provides DOS scanners as
well as Win32 compliant scanners such that one can boot off a DOS DISK
for FAT32 or a DOS
DISK with NTFS4DOS for NTFS and clean a computer without the Win32 OS
in operation.
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
It is a self-extracting ZIP file that contains the Kixtart Script
Interpreter {
http://kixtart.org Kixtart is CareWare } 4 batch files, 6 Kixtart
scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and
WGET.EXE. It will
simplify the process of using; Sophos, Trend, Kaspersky and McAfee
Anti Virus Command
Line Scanners to remove viruses, Trojans and various other malware.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in
C:\AV-CLS}
This will bring up the initial menu of choices and should be executed
in Normal Mode.
This way all the components can be downloaded from each AV vendor's
web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
Reboot the PC.
You can choose to go to each menu item and just download the needed
files or you can
download the files and perform a scan in Normal Mode. Once you have
downloaded the files
needed for each scanner you want to use, you should reboot the PC into
Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you
want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and
Normal Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
file.
http://www.ik-cs.com/multi-av.htm
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder
C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE
to go through your
FireWall to allow it to download the needed AV vendor related files.
* * * Please report back your results * * *
Personally I