new virus: BackDoor.IRC.Ratsou.B

  • Thread starter Thread starter louis
  • Start date Start date
L

louis

This virus has attached itself to file C:\winnt\system32
\explorer.dll. My Norton AntiVirus could not remove the
virus nor could it delete the infected file. How can I
fix this!
 
louis said:
This virus has attached itself to file C:\winnt\system32
\explorer.dll. My Norton AntiVirus could not remove the
virus nor could it delete the infected file. How can I
fix this!
Click to expand...

Search the Symantec site for information on it. They will have directions
for you to follow.
 
Hi,

First, delete the two values from the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


a.. In the right pane, delete the values:

HID.EXE
lsass

Restart Windows and re-do a virus scan and delete the affected files.

More information from Symantec:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.ratsou.
b.html

Regards,
Ramesh
(e-mail address removed)


This virus has attached itself to file C:\winnt\system32
\explorer.dll. My Norton AntiVirus could not remove the
virus nor could it delete the infected file. How can I
fix this!
 
Back
Top