W32 Spybot

[Kim]

I am running XP Pro and I have Norton's System Works
installed with the 2004 antivirus. I got a pop-up about
three or four times a day saying that the W32 Spybot
virus was detected and had been deleted. (if that was
true why did the message keep pooping up??) so i disabled
system restore, started in safe mode ran a scan ...
nothing. I checked the registry and I found a file
labeled Dir 0 under KaZaALocal Contents (which was
supposed to be the infected file). As i was looking at
that I get another popup saying I have the same virus in
another file and I can't find it anywhere, even on the
registry. I thought maybe the virus disabled the
antivirus so I put in the CD and tried to scan from the
cd and the popup said "the system administrator has set
policies to prevent this installation". So I'm stuck.
HELP?!?!?!?!

 

[Lem]

I am running XP Pro and I have Norton's System Works
installed with the 2004 antivirus. I got a pop-up about
three or four times a day saying that the W32 Spybot
virus was detected and had been deleted. (if that was
true why did the message keep pooping up??) so i disabled
system restore, started in safe mode ran a scan ...
nothing. I checked the registry and I found a file
labeled Dir 0 under KaZaALocal Contents (which was
supposed to be the infected file). As i was looking at
that I get another popup saying I have the same virus in
another file and I can't find it anywhere, even on the
registry. I thought maybe the virus disabled the
antivirus so I put in the CD and tried to scan from the
cd and the popup said "the system administrator has set
policies to prevent this installation". So I'm stuck.
HELP?!?!?!?!

From Symantec: "W32.Spybot.Worm is a detection for a family of worms
that spreads using KaZaA file-sharing and mIRC. This worm can also
spread to computers infected with common Backdoor Trojan Horses."

It's not enough to detect and delete SpyBot when it activates -- you
have to remove all of it. Follow the directions here:
http://tinyurl.com/fcvw

 

[Bruce Chambers]

Greetings --

That's because Kazaa reinstalls it. Remove Kazaa, and _then_
clean up the viruses.

Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Lem]

http://tinyurl.com/fcvw three or four times...It's not
working. How can I remove it when I can't even find it???

In your original post, you said that you "found a file labeled Dir 0
under KaZaALocal Contents" while you were looking in the Registry. Did
you then delete BOTH the registry entry AND the file?

You also say that you think that your a/v may be disabled. Can you do a
scan? Did you delete all the files that were identified? Did you also
delete all the zero length files in the Startup folders?

If you can't do a scan with Norton, or if you've done all the above and
are still having problems -- try going to
http://www.net-integration.net/zeroscripts/spybot.html and follow
directions starting with No. 2 (unless you also have lost Task Manager,
in which case start with No. 1).