Viruses adding litems to WIN.INI file

[Bryan Henderson]

The problem I am having is when connected to the net with my broadband
connection using my LAPTOP every so often Norton detects a virus infection
and then says it is ok to use my PC. However an item is being added to the
WIN.INI file so that when I come to restart my PC I get a succession of
windows opening up saying can't find a file referred to in WIN.INI file.
Here is a copy of the latest one this morning.


run=c:\windows\speedy.pif,c:\windows\speedy.bat,c:\windows\puta!!.com,c:\win
dows\speedy.scr,c:\windows\scrsvr.exe

This is five windows opening up. Whenever I delete these items I seem to get
more later on. This has been going on for a few days now. The strange thing
is that when using the same broadband connection with a different PC
(desktop) this doesn't happen at all.

I am getting these not from e-mail but while surfing the net or using
Usenet.

Can anyone explain what is happening here and how to stop it if at all? TIA.

 

[Thumper]

Sounds something like the Opaserv worm possibly the W32.Opaserv.AD.Worm
better run a virus scan.

Try this link and see if it looks familiar:
http://securityresponse.symantec.com/avcenter/venc/data/w32.opaserv.ad.worm.html

Thumper

 

[kurt wismer]

The problem I am having is when connected to the net with my broadband
connection using my LAPTOP every so often Norton detects a virus infection
and then says it is ok to use my PC. However an item is being added to the
WIN.INI file so that when I come to restart my PC I get a succession of
windows opening up saying can't find a file referred to in WIN.INI file.
Here is a copy of the latest one this morning.


run=c:\windows\speedy.pif,c:\windows\speedy.bat,c:\windows\puta!!.com,c:\win
dows\speedy.scr,c:\windows\scrsvr.exe

This is five windows opening up. Whenever I delete these items I seem to get
more later on. This has been going on for a few days now. The strange thing
is that when using the same broadband connection with a different PC
(desktop) this doesn't happen at all.

I am getting these not from e-mail but while surfing the net or using
Usenet.

Can anyone explain what is happening here and how to stop it if at all? TIA.

you say you've ruled out email, and you make no mention of p2p apps...
have you checked to make sure you've got no shares accessible to the
outside world?

 

[Bryan Henderson]

Sounds something like the Opaserv worm possibly the W32.Opaserv.AD.Worm
better run a virus scan.

This is one of three that Norton has caught, also W95.Dupator.1503. I have
done a virus scan and there are none on my PC apart from those in
quarantine.

 

[Bryan Henderson]

TIA.

you say you've ruled out email, and you make no mention of p2p apps...
have you checked to make sure you've got no shares accessible to the
outside world?

I wasn't running Kazaalite recently or any other p2p app and no sharing is
enabled on the drive that I can see. I have now fixed the problem with my
desktop PC - faulty NIC so will use that most of the time as before.

 

[kurt wismer]

I wasn't running Kazaalite recently or any other p2p app and no sharing is
enabled on the drive that I can see.

administrative shares may be enabled by default... if the laptop is
using win2k or xp go to control panel->administrative tools->computer
management and select shared folders->shares to see if you have any
shares... i don't know much about sharing on earlier versions of
windows, unfortunately...