XP Home Virus

[Horst]

A Norten virus scan of the C drive revealed 4 infected
files, three of which were quarantined and one (a system
file) could not with the following message:

Scan type: Manual Scan
Event: Virus Found!
Virus name: Trojan.Simcss.B
File: C:\WINDOWS\mslagent\4b_1,0,0,8_mslagent.dll
Location: C:\WINDOWS\mslagent
Computer: HORST
User: Horst
Action taken: Clean failed : Quarantine failed :
Date found: Thu Apr 15 17:55:21 2004

I am away with my laptop from home and thus don't have
the original CDs with me to attempt to overwrite this
file. What can I do, and do I need to be worried?

 

[CHRIS CRIBBS]

Try running the scan after restarting in safe mode. At that point you should
be able to Repair, Quarantine, or Delete the file. Another option is to goto
www.symantec.com and download there removal tool for that virus. In either
event be sure to disable system restore before doing either

Good Luck

Chris

 

[Trafton]

Hi Horst,

Here is some more information about this Trojan Horse:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.simcss.b.html

Try restarting your system in safe mode. For more information on starting in
safe mode, see this document:

http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam

After that, retry the scan and see what comes up. I think what is happening
is that the Trojan Horse is in memory, and thus cannot be deleted. Going
into safe mode will prevent it from loading itself.

Sincerely,
Benjamin Johnstone-Anderson
Microsoft "MVP" - Windows Security
Remove "SPAM" from email address to reply!
Security Manifest: www.msmvps.com/trafton/