Yep! It sounds like a Worm!!
See
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html
and
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.pesin.html!
Get NAV definitions up to date to detect it.
Look in 'Startup' for an unrecognised Application (NOTE ITS NAME).
OR
Go to
http://www.sysinternals.com/ntw2k/utilities.shtml, where you
will find a number of FREE, and very useful, System Utilities. Download
'Process Explorer'. You can use this to monitor and kill process instead
of Task Manager (the Worm is killing Task Manager when it detects it
running).
Its difficult to know what the process name is, but you can safely kill
any process ending in .SCR! Another name is SysTask.exe.
Or you COULD Try this:
Run Process Explorer
Click the 'CPU' column header TWICE - to see descending order
of CPU Usage.
Run Task Manager several times while watching this list.
If you detect a process that 'flares up' as it kills Task Manager,
you could RISK killing it (MAKE A NOTE OF ITS NAME).
If you can NOW run Task Manager, you have got the sob!
Search for ALL occurences of this file on your system - you will
probably find two - DELETE THEM.
Keep trying with NAV until your PC is 'clean'.
--
Hope this Helps,
Pat Garard.
apgarardATbigpondDOTnetDOTau
_______________________________________________
"One look is worth a thousand rumours."
Wen Hou, Warring States Period.
"Look twice!"
Pat Garard, 2003.
