Virus recovery Help

[Jman]

Please help,
I got infected by a worm in my system32 file by a worm. I bough
Mcafee antivirus software and it erased the worm, but my setting are no
correct. When I try to go to task manager, it says that this action i
not allowed by the administrator, but that is me. (BTW I am on m
personal pc at home). I also cannot change my desktop backround or tur
on my window firewall.
Any help is appreciated. Th

 

[David H. Lipman]

From: "Jman" <[email protected]>

| Please help,
| I got infected by a worm in my system32 file by a worm. I boughtMcafee antivirus software
| and it erased the worm, but my setting are notcorrect. When I try to go to task manager,
| it says that this action isnot allowed by the administrator, but that is me. (BTW I am on
| mypersonal pc at home). I also cannot change my desktop backround or turnon my window
| firewall. Any help is appreciated.
| Thx-- Jman

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Use the following tool. It will correct the problem(s) the worm left behind and it can be
used to make sure you are indeed clean.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[Guest]

I am having the same problem with mine and I cannot figure out how to get my
desktop back so that I can put a picture on my desktop. It will not let me
click on a background or let me browse my computer for a picture for the
background. My task manager is back - but the desktop still is not working.

When you run the AV-CLS file, do you have to run all of the virus scanners
(Sophos, Trend Micro, etc) or just one of them? The task manager came back
after I started to run Sophos......do I have to let the program complete the
scan and my desktop functions will come back?>?

thanks!

From: "Jman" <[email protected]>

| Please help,
| I got infected by a worm in my system32 file by a worm. I boughtMcafee antivirus software
| and it erased the worm, but my setting are notcorrect. When I try to go to task manager,
| it says that this action isnot allowed by the administrator, but that is me. (BTW I am on
| mypersonal pc at home). I also cannot change my desktop backround or turnon my window
| firewall. Any help is appreciated.
| Thx-- Jman

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Use the following tool. It will correct the problem(s) the worm left behind and it can be
used to make sure you are indeed clean.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[David H. Lipman]

From: "Sarah" <[email protected]>

| I am having the same problem with mine and I cannot figure out how to get my
| desktop back so that I can put a picture on my desktop. It will not let me
| click on a background or let me browse my computer for a picture for the
| background. My task manager is back - but the desktop still is not working.
|
| When you run the AV-CLS file, do you have to run all of the virus scanners
| (Sophos, Trend Micro, etc) or just one of them? The task manager came back
| after I started to run Sophos......do I have to let the program complete the
| scan and my desktop functions will come back?>?
|
| thanks!

It depends. Usually two or three of the four is enough. Start with the McAfee module and
see what it finds.

Just running the menu part will correct some modifications that malware make. However, if
you don't remove the malware, the settings can revert back to the limited use again so it is
suggested to run through at leat one or two modules full scans.