W32/Ovide.A

[John Blair]

Hi,

Does anyone know how to get rid of the above virus permanently. Each time my
virus scanner deletes the file taskdir.dll i think - the virus keeps coming
back! If a create a new user and scan using Ntl Netguard - it always finds
it.

Any help appreciated!

Thanks.

 

[Guest]

Greetings John,

The virus which you have described to me is a particularly malicious strain
in which it uses Rootkit technology to cloak itself from Windows itself and
also many anti-virus clients. To this effect, i refer to a post given to
another user suffering from this malicious code:

Since this virus uses rootkit technology, I would recommend a that you
format your HDD and reinstall Windows. If the system has been infected by a
Rootkit, it can not be trusted because you cannot verify that it has been
alleveated of the threat.

If you would like any more information on this or would like to ask
additional questions, please post in the community.

I hope this helps you.
can never be sure that it is completely clean"

 

[annette.stroud]

Hi,

Does anyone know how to get rid of the above virus permanently. Each time my
virus scanner deletes the file taskdir.dll i think - the virus keeps coming
back! If a create a new user and scan using Ntl Netguard - it always finds
it.

End the taskdir.dll process if running. Delete taskdir.dll. Look for
two other files: phqgume.exe and parad.raw.exe. Delete those. Delete
all of your temporary internet files. Make sure taskdir.dll is not
called for on startup. See if that removes the problem. Even if it
does, be aware that once you've had a trojan, you really can't be sure
about the vulnerablities that have been installed by the trojan. To
have confidence in the computer, I'm afraid a clean install is
necessary.

Annette Stroud

 

[David H. Lipman]

From: "John Blair" <[email protected]>

| Hi,
|
| Does anyone know how to get rid of the above virus permanently. Each time my
| virus scanner deletes the file taskdir.dll i think - the virus keeps coming
| back! If a create a new user and scan using Ntl Netguard - it always finds
| it.
|
| Any help appreciated!
|
| Thanks.
|


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *