close

Privacy guaranteed - Your email is not shared with anyone.

I-Worm/Bagle.AN & JS/IllWill VIRUSES

Discussion in 'Tech Talk' started by Devorzhum, Sep 22, 2004.

  1. Devorzhum

    Devorzhum Terrestrial Dog

    Messages:
    51
    Likes Received:
    0
    Joined:
    Jun 13, 2003
    Location:
    Virgo Supercluster
    Hello, Folks,

    Have any of you had some experience with these? They have infected one of the PC's in my department and nothing has been able to get rid of them. We use AVG free version (the company is too cheap to spring for real anti-virus software) and it, of course, can only tell you it's there, it does nothing to kill it. AVG has all the current virus definitions, for all the good it does.

    I used several removal tools from Symantec, Stinger, Hijackthis, Norton Antivirus with current definitions, nothing seems to work.

    I would really appreciate any insight anyone might have on getting rid of these two pieces of malicious code.

    Thanks in advance. :)
     
  2. Maxthemutt

    Maxthemutt

    Messages:
    842
    Likes Received:
    34
    Joined:
    Dec 14, 2001
    Location:
    MN
    I had that and removed it with "vcleaner". I got it from either Symantec or AVG. I use AVG and love it. I think I googled bagle to find it. Good luck, Max
     

  3. Devorzhum

    Devorzhum Terrestrial Dog

    Messages:
    51
    Likes Received:
    0
    Joined:
    Jun 13, 2003
    Location:
    Virgo Supercluster
    Thanks, Matt, for your response. :)

    I tried vcleaner already - no dice. AVG still tells me there are 2 viruses present on the PC at a fictional location (folder AND file don't exist when you go looking, yes I am showing all hidden files and folders.)

    I have Googled Bagle, JS/, and all the permutations and so far all of the fixes do not solve the problem. I've gotten rid of many viruses here at work from our PC's, but I have never had one this bad before.

    As far as AVG goes, the full version might be great, but the free version is extremely inadequate for broadband protection in my opinion. I update it manually every day (the automatic update feature doesn't work) and it still lets viruses through constantly. But even Nortons Anti-Virus couldn't lick this one, which surprised me.

    Anyway, thanks again, Matt. :)
     
  4. David_G17

    David_G17 /\/\/\/\/\/\/\/

    Messages:
    2,046
    Likes Received:
    0
    Joined:
    Oct 7, 2002
    http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

    i've had a similar problem from other viruses. my problem was that the virus kept respawning itself each time i tried to kill it through windows services (couldn't stop it by ctrl-alt-del -> processes). norton would remove part of it, but it just kept going.

    i used the above program to stop it permanently, then ran norton which could then remove it entirely.
     
  5. Maxthemutt

    Maxthemutt

    Messages:
    842
    Likes Received:
    34
    Joined:
    Dec 14, 2001
    Location:
    MN
    Wow, I'm surprised that didn't work. I know a few people that have used it and it always worked. Some had to restart in safe mode and run it a few times, alternating vcleaner w/ AVG scan, but it worked. Sorry to hear about your AVG experience, I had Nortons and hated it. Free version works great for me.
     
  6. Devorzhum

    Devorzhum Terrestrial Dog

    Messages:
    51
    Likes Received:
    0
    Joined:
    Jun 13, 2003
    Location:
    Virgo Supercluster
    Thanks, David, I'll give your program a try. :)

    And thanks again, MAX (sorry about calling you Matt, my error, I was in a hurry when I posted :)
    I'm glad that free AVG works for you, I think part of our problem at work is that we are on a network and the update service can't get online. Our head tech has yet to get that worked out. I was away from work for three weeks and I have just returned to find that during my absence, no one bothered to download any updates. Such is life.

    Nortons has it's plusses and minuses. I didn't care for it during the brief period I had ME at home, but it seems to get along fine with my Windows 2000 at home now.

    Work is another story, I only tried my Nortons CD because nothing else was working. I set Nortons to delete any viruses it found, and it DID pronounce my PC clean, but AVG still picks up the two files I mentioned....

    Which brings me to another question: could AVG itself be damaged? Could the virus reports be in error? Should I reinstall free AVG? The reason I ask that is the folder and file specified by AVG do not exist on the PC in question.

    Like I said before, I've gotten rid of many viruses at work before, but this is one tenacious SOB. All the usuals just aren't cutting it. I truly appreciate the help you've given me, though THANK YOU very much. :)

    Anyway, I'm going to try David's fix now, I'll report the result tomorrow. Thanks Again!
     
  7. Jtemple

    Jtemple Geek

    Messages:
    788
    Likes Received:
    0
    Joined:
    Jan 13, 2002
    Location:
    NE
    Wow, Process Explorer is a very nice utility!

    The readme file says this:

    "See Sysinternals for more monitoring tools, including
    a Registry monitor."

    I'm going to check out the registry monitor as well.
     
  8. Jtemple

    Jtemple Geek

    Messages:
    788
    Likes Received:
    0
    Joined:
    Jan 13, 2002
    Location:
    NE
    There's some cool stuff on that site. I personally like the BSOD screen saver, complete with simulated hard drive activity. :)
     
  9. srhoades

    srhoades

    Messages:
    2,814
    Likes Received:
    21
    Joined:
    Jul 14, 2000
    Are you scanning and or cleaning in safe mode?
     
  10. fatlander

    fatlander Comrade

    Messages:
    63
    Likes Received:
    0
    Joined:
    Nov 24, 2003
    Location:
    somewhere in the mediterranean
    try the panda removal utilities
     
  11. fastvfr

    fastvfr Ancient Tech

    Messages:
    2,344
    Likes Received:
    0
    Joined:
    Mar 28, 2001
    Location:
    SW Oregon
    I am sure lots of you have noticed that when trying to locate a 'hidden' XP file, your $200 OS is very much on the VIRUS'S side, allowing it virtually free reign.

    Well, that particular quadrupedal feline can be coerced into full nudity by brute force, which I wholeheartedly advocate...and enjoy!!

    To end this atrocious tendency once and for all, I created a customized version of Knoppix 3.6, essentially re-mastering it back into ISO format after unpacking it getting it patched with the kernel source, NTFSTools and whatnot. I did leave out most of the games and other superfluous apps to save space. Lastly I gave the user total admin permissions...make no mistake, this is NOT for use by beginners!!

    Takes up a little more than 600MB on disk and allows total RWX access to any mountable drives on the PC.

    I can boot to this CD and find any virus or file anywhere from the boot sector on down....it has not failed me yet.

    I then delete the problem file from the HDD, then reboot into XP or W98/ME's Safe Mode and run RegCleaner's newest version. After taking out all references to it I can then use SFC if need be to rename & replace explorer.exe or whatever, if the infection involves vital system files or has possibly caused corruption in them.

    Simple as that!

    Best Regards,

    FastVFR
     
  12. saber41

    saber41 Guest

    fastvfr,

    just curious....

    what tutorial did you follow to remaster Knoppix ??,
    also what tools besides NTFSTools have you included on your remastered version ??

    thanks,
     
  13. Jtemple

    Jtemple Geek

    Messages:
    788
    Likes Received:
    0
    Joined:
    Jan 13, 2002
    Location:
    NE
    Next question, can I have a copy of your custom Knoppix build? ;f
     
  14. saber41

    saber41 Guest

    Excellent question Jtemple....
    I would'nt mind having one of those myself... :)
     
  15. Devorzhum

    Devorzhum Terrestrial Dog

    Messages:
    51
    Likes Received:
    0
    Joined:
    Jun 13, 2003
    Location:
    Virgo Supercluster
    Thanks one more time to all of the very smart folks you responded! :)

    To date, AVG still detects the virus but I think it is not working properly. The bulletin I got on this thing says it can damage AV software and that might be what has happened.I am going to uninstall it and then either run a fresh AVG version or turn a different AV program loose on it.

    There hasn't been any damage to the workstation that I've noticed, so I'm waiting a bit until work gets a little less busy so I can sit down with it again.

    Sooner or later I'll scrape it off. I'd be upset if it was my home PC, but I'm not too concerned about this PC in particular. ;)

    Anyway, I really appreciate all the ideas!