how do I remove this?

  • Thread starter Thread starter bullseye
  • Start date Start date
Do
bullseye wrote:




I googled for a few seconds. <g>

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=99969
Click to expand...


:-) Thank you for the link. What does it mean? Even McAfee says
"possibly" infected. The file is from 2003. (I installed a new copy of
McAfee 10 two days ago, updated all the dat files manually, and scanned.
My computer was free of infections then.) However, I was scanning
using BitDefender when this warning came up. What do I do next? Rescan
using McAfee? Look for the file manually and delete manually?
 
bullseye said:
:-) Thank you for the link. What does it mean? Even McAfee says
"possibly" infected. The file is from 2003. (I installed a new copy
of McAfee 10 two days ago, updated all the dat files manually, and
scanned. My computer was free of infections then.) However, I was
scanning using BitDefender when this warning came up. What do I do
next? Rescan using McAfee? Look for the file manually and delete
manually?
Click to expand...

Well, you didn't mention a filename, or a location it was found, or any
other details as to how you found it, some of which may have been
helpful. The link above does say:

"This is a heuristic detection which indicates that a file is possibly
infected with a Polymorphic Win32 virus. Win32 stands for 32-bit Windows
and includes Windows 95, 98, NT, 2000, XP, ME, etc. Ensure that you are
using the latest engine and DATs and send a copy of the file to AVERT
if it is still detected as "New Poly Win32""

So, try sending the file to AVERT and see what they say.
 
Sorry for failing to share (and thank you for keeping up).
Here is the info:

I am using a Windows 2000 pro system with version 10 of McAfee's
anti-virus. I was scanning my system using BitDefender when McAfee
popped up and the screen said:

Virus Found
File: tmp000cf6a8
Virus name: New Poly Win32
File path: C\WINNT\Temp\tmp00000bcf
Status: Cannot be deleted
Verify that the file is not write-protected and try again.


I have Clean, Quarantine, Delete, Cancel buttons at the bottom and the
first three result in a pop up screen that says "The [file] cannot be
deleted. Verify that the file is not file protected and try again."

I also have information from my BitDefender scan but I will leave that
alone for now and deal with this one at a time.

Thank you again.
 
Do



:-) Thank you for the link. What does it mean? Even
:McAfee says
"possibly" infected. The file is from 2003. (I installed a
new copy of McAfee 10 two days ago, updated all the dat
files manually, and scanned.
My computer was free of infections then.) However, I was
scanning
using BitDefender when this warning came up. What do I do
next? Rescan using McAfee? Look for the file manually and
delete manually?
Click to expand...

It means a la "our heuristics might be reporting false
positive."
Do, as 'bts' suggests, send a copy to AVERT.

J
 
Currently scanning my system (after updating VirusScan 10). I have
registered and I will notify you when if I hear from them (AVERT is an
awkward website but I intend to figure it out).
 
bullseye said:
Sorry for failing to share (and thank you for keeping up).
Here is the info:

I am using a Windows 2000 pro system with version 10 of McAfee's
anti-virus. I was scanning my system using BitDefender when McAfee
popped up and the screen said:
Click to expand...

You are scanning with one a-v while another is actively running?
Generally not a good idea. Conflicts, you know.
Virus Found
File: tmp000cf6a8
Virus name: New Poly Win32
File path: C\WINNT\Temp\tmp00000bcf
Status: Cannot be deleted
Verify that the file is not write-protected and try again.
Click to expand...

Shut down McAfee, run the Bitdefender again, while watching the Temp
directory with windows explorer. Does the file appear only while
scanning? Does it disappear after the scan?
 
I am learning. I have McAfee 10 loading on startup. However, I assumed
unless I launched it to scan it was only dormant. I take it I need to
shut it off completely before I use BitDefender (and vice-versa). I
will let McAfee finish the scan, I will turn it off, and I will do as
you instruct. Then I will post back in here.

Thanking you again.
 
Currently scanning my system (after updating VirusScan 10).
I have registered and I will notify you when if I hear
from them (AVERT is an awkward website but I intend to
figure it out).
Click to expand...

Good. Please do.

J
 
From: "bullseye" <[email protected]>

| New Poly Win32. I googled in vain.
|
| --
|
| If you wish to reply using e-mail, please add a 35 (the number) after
| bullseye.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } 4 batch files, 6 Kixtart scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend, Kasperski and McAfee Anti Virus Command Line
Scanners to
remove viruses, Trojans and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site. The choices are;
Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

* * * Please report back your results * * *
 
Scanned with McAfee after updating the DAT files and it came clean. I
shall run BitDefender (with McAfee turned off :-) ) a little later and
will update.
 
Back
Top