W32.wilab

[Darren Wilkinson]

Hope someone can help me with this one.

Compaq laptop running XP home with SP2 installed and Norton Antivirus 2005
(with all updates). The initial scan for viruses removed/deleted W32.wilab.
You can now do a full virus scan using NAV2005 and nothing is found.

Lappie is connected to internet via a network connection. As soon as the
laptop boots up I get the message as displayed at this webpage
http://www.newbury.net/wilab.htm

You can now do a full virus scan and nothing is found. Try to shut down
lappie, system crashes and then reboots with message that it has recovered
from a serious problem.

Also host file is being continually loaded with ip and addresses of all anti
virus companies so there is obviously viral activity which Norton is not
detecting properly.

Disconnect from network. Laptop works normally - no messages no crashes,
full virus scan produces an adware file called Adware.SyncroAd

Symantec site is totally useless with information on this virus. Any
suggestions please?

 

[Bill]

Symantec site is totally useless with information on this virus. Any
suggestions please?

Disable system restore.

 

[Darren Wilkinson]

Disable system restore.

System restore is disabled

 

[Beauregard T. Shagnasty]

Quoth the raven Darren Wilkinson:

http://www.sophos.com/virusinfo/analyses/w32wilaba.html

Also host file is being continually loaded with ip and addresses of
all anti virus companies so there is obviously viral activity which
Norton is not detecting properly.

Rewriting the HOSTS file is frequently a symptom of spyware. I'd
suggest you also get SpybotS&D, AdAware, and A².

http://home.rochester.rr.com/bshagnasty/tips.html#spyware