T1B

Posted: **Sat Oct 29, 2005 6:39 pm**

I'm not a computer geek by any means, but I do know a little more than the basics.

The AIM Virus that is talked about in this forum comes and goes and now my activeX controllers are all screwed up! I'm thinking my active X is partly a result of the AIM virus, but I'm not 100% sure.

I can't even log onto any secured websites and my Eudora refuses to work properly. Says something about a rejected certificate. It's even affected MS Windows Update. I follow the steps there and still no difference.

I have WIN98 SE (yes I know I need XP), HP Pavillion w/ 416 Ram and a Pentium II processor

I still have my Windows 98 Install disk and ran that a few times. This isn't a quick restore CD where it wipes my drive clean, this one just replaces the files.

I'm thinking I'm going to have to completely wipe my drive clean and start over, but does anyone have any suggestions on how I can correct this without having to go back to a fresh start?

Posted: **Sat Oct 29, 2005 7:54 pm**

Until you can postively identify the exact virus (or virii), you will not know things like where in the registry they have placed keys. These keys along with .dll files, can regenerate the virus no matter how often you go through the file replacement process. Since you're not talking corrupted files but additonal files that corrupt your files, they will never go away until completely removed.

If it is a very common virus, symantec may have a removal tool. if not, you have to rely on doing searches to find blogs or message boards that might have the same problem where people can give you step by step instructions on removal.

Viruses get more and more complicated and difficult to remove all the time. Best bet is to back everything up weekly (or daily depending) so you can restore it when you have problems like this. They can take hours and hours to solve.

Give me the name of this bad boy and I'll look around. I'm the family computer problem solver (unfortunately) so I have been doing quite a bit of it lately.

Posted: **Mon Oct 31, 2005 7:25 am**

I believe you are referring to this nasty lil bitch finally covered by cnet.

AIM worm plays nasty new trick
By Joris Evers
Staff Writer, CNET News.com
Published: October 28, 2005, 2:33 PM PDT
Tell us what you think about this storyTalkBack E-mail this story to a friendE-mail View this story formatted for printingPrint See links from elsewhere to this story (TrackBacks/Pingbacks)TrackBack

A worm found spreading via America Online's Instant Messenger is carrying a nastier punch than usual, a security company has warned.

The unnamed worm delivers a cocktail of unwanted software, including a so-called rootkit, security experts at FaceTime Communications said Friday. A rootkit is a tool designed to go undetected by the security software used to lock down control of a computer after an initial hack.

"A very nasty bundle is downloaded to your machine" when you click on the worm link, said Tyler Wells, senior director of engineering at FaceTime. "This is the first time that we have seen a rootkit as part of the bundle of applications that is sent to your machine. It is a disturbing trend."

IM worm and malicious code attacks are happening more than ever before. The number of threats detected for instant-messaging and peer-to-peer networks rose 3,295 percent in the third quarter of 2005, compared with last year, according to a recent report from security provider IMlogic.

In addition to the "lockx.exe" rootkit file, the new worm delivers a version of the Sdbot Trojan horse, said FaceTime, which sells products to protect instant-messaging traffic. Sdbot opens a backdoor on the infected PC. The worm also places several spyware and adware applications, including 180Solutions, Zango, the Freepod Toolbar, MaxSearch, Media Gateway and SearchMiracle, the company added.

All that unwanted software can eat up system resources, slowing down the PC, Wells said. Also, the malicious applications will attempt to disable security programs and change the search page on the user's Web browser, FaceTime said.
Selling green buildings with people power
ID theft: Can it really be prevented?
Bloggers jump on Libby indictment
'Lost' finds deeper reality online
Previous Next

The worm was spotted in an AOL IM chatroom and infected one of the PCs that FaceTime uses for worm bait. The company said it also has seen the pest hit other computers. "It is still out there, and it is definitely something the user should be leery of," Wells said. "The rootkit is designed to not be detected, and that is the scary part."

Worms on IM networks can spread rapidly. They appear as a message from a buddy with a link that looks innocent, but in fact points to malicious code somewhere on the Internet. Once the user clicks on the link, malicious code is installed and runs on the computer. The worm then spreads itself by sending messages to all names on the victim's contact list.

The advice to users is to be careful when clicking on links in IM messages--even when they seem to come from friends--and to use up-to-date antivirus software. When receiving a link in an instant message, the best practice is to verify with the sender if the link was sent intentionally or not.

Mike, check the thread I started about trojans for a little more info, it took several AVs to find most of it and a lot of googling, and regediting to remove the rest of it-

-but you can remove it all, I finally did.

Good luck.

Posted: **Mon Oct 31, 2005 5:56 pm**

A couple of ideas:

http://free.grisoft.com/doc/1

and Keep your virus database up to date.

This isn't a bad idea either.

http://www.safer-networking.org/en/download/

VERY IMPORTANT!!!! IF you have another virus scanner installed, such as Norton, UNINSTALL IT FIRST!!! Bad things will happen if you try and run two virus scanners at once.

^^^

Found the above in a blog. Have not looked into it yet.

Here's another article link:

http://www.eweek.com/article2/0,1895,1777898,00.asp

Posted: **Mon Nov 07, 2005 9:05 pm**

if it is the lockx.exe, My daughter got it, and itt was easy to remove. Of course, because of my localMachine zone lockdown, the file could not run without approval, and my daughter was smart enough not to run it.

Here's a link to removal.

http://securityresponse.symantec.com/av ... bot.a.html

Posted: **Tue Nov 08, 2005 6:38 am**

Headhunter wrote:if it is the lockx.exe, My daughter got it, and itt was easy to remove. Of course, because of my localMachine zone lockdown, the file could not run without approval, and my daughter was smart enough not to run it.

Here's a link to removal.

http://securityresponse.symantec.com/av ... bot.a.html

That file came bundled with others, you may want to look further into it.

Posted: **Tue Nov 08, 2005 1:32 pm**

Oh, I gave the PC a thorough going over. It's locked down pretty tight to begin with. I'm not sure she would have done much damage had she launched it. The Local Machine zone is locked pretty tight for her.

That was also the straw that broke the camels back for AIM. I've been on her for some time to drop that shit.