virus help

  • Thread starter Thread starter CTG
  • Start date Start date
C

CTG

My Friends laptop (almost brand new) has ran into a problem that
it can connect to the internet server but none of teh pages come up.
I tried another dialup account and the same problem occured and thus I
reckon
there is a virus that does this.

I need to download a visrus scanning program (free) on my laptop and
copy it to a CD and run it on his laptop..

What is the best program that woudl do this please ?
Thanks
 
From: "CTG" <[email protected]>

|
| My Friends laptop (almost brand new) has ran into a problem that
| it can connect to the internet server but none of teh pages come up.
| I tried another dialup account and the same problem occured and thus I
| reckon
| there is a virus that does this.
|
| I need to download a visrus scanning program (free) on my laptop and
| copy it to a CD and run it on his laptop..
|
| What is the best program that woudl do this please ?
| Thanks

You need to diagnose the TCP/IP stack on the affected laptop first !

That means using PING, TRACERT and other utilities to determine if the TCP/IP sdtack is
indeed working and if it gets Dmain Name resolution.

Then you can try using IE and FireFox and see if they open http URLs.

This needs to be done BEFORE you assume it is a virus.
 
From: "CTG" <[email protected]>

| pinging address of 127.0.0.1 was OK

That's the diagnostic responder so it shows that the stack is OK.

You really need to PING multiple IP addreses. ome IP addresses will NOT respond to a PING
for security reasons. That's why you also use the TRACERT utility.

However, if you can't ping at all then it could be that malware was removed via software but
not completely.

Download LSPfix
http://www.cexx.org/LSPFix.exe
Please download and read lspfix.txt, here: http://www.cexx.org/lspfix.txt

This will remove any Layered Service Providers that are in the way of TCP/IP working
properly.
 
From: "CTG" <[email protected]>

| Thanks.
| Did it and the result was nothing was removed or repaired.

Again, you need to examine TCP/IP.

How are you connected ? DUN, DSL, Cable, etc.

You need to PING and TRACERT to the DNS Server IP address and alias. If you can ping to the
DNS IP address and not the alias then you have a Domain Name resolution problem.

Look at your infrastructure, trace back from the PC to the Router to the first hop after the
Router, etc..
 
David H. Lipman said:
From: "CTG" <[email protected]>

| It was the bloody Norton security thingy.
| Thanks .

Ah... Norton was the culprit !!!

I could do a rant about Norton but....


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm


Yes we all could David lol.btw David have you tried the new beta
Kaspersky?I am and it's working great with no bugs,seems like added featues
but it's still less than 11mb download..You made me a believer with
Kaspersky.and your Mult_av also.Thanks again RH710
Click to expand...
 
|

No. I haven't tried their full blown AV client.
I certainly have gained respect for Kaspersky detection and their signature model.

While the DOS scanner is slow, it is highly effective in scanning all sorts of compressed
and packed files. All combined it adds to the suite in the Multi AV Scanning Tool and I am
extremely happy that so many are finding the Multi AV tool effective for them.


Of course I have ask how can I make it even more effective ?
 
|

No. I haven't tried their full blown AV client.
I certainly have gained respect for Kaspersky detection and their signature model.

While the DOS scanner is slow, it is highly effective in scanning all sorts of compressed
and packed files. All combined it adds to the suite in the Multi AV Scanning Tool and I am
extremely happy that so many are finding the Multi AV tool effective for them.
Click to expand...

I've been doing some more work with that Rootkit related thing I
mentioned in a different thread here recently. You might remember
that Backdoor in a MBR issue. I've now got a second IDE hard drive
with the Trojanized MBR which I can check in DOS now as well. It turns
out that KAVDOS32 does alert in plain DOS but not in Windows (I'm
using Wind 2K). I once saw a error message produced by Windows that
complained that "something" was trying to access the drive directly.
This happened when I tried to force KAVDOS32 to check the MBR via
the command line switch /P- ... it doesn't seem to try otherwise ...
or it doesn't complain that it can't do it ... not sure exactly which.
So I inadvertenly have stumbled on a problem with KAVDOS32, it seems,
when used in Windows on the NT based OS. It doesn't look so far like
it checks boot sectors.

Also, in this case of the Trojanized boot sector, none of the av used
in Multi-AV alert. So far, just a GUI (Wndows) version of KAV does. I
have a hunch that some other Windows versions of av might alert since
they alert on the image file ... AVG, Bit Defender, NOD32, Norman,
NAV, UNA and VBA32 ... all alert, at least heuristically on the image
file. Oddly, eScan which uses the Kaspersky engine does not alert on
the Trojanized MBR sector. I'm tempted to try Windows versions of
NOD32 and Bit Defender to see if at least one or two more av might
detect the Trojanized MBR ... and not just KAV. But I'm not about
to install a Windows version of NAV or McAfee. Ugh! :)

Art
http://home.epix.net/~artnpeg
 
From: "Art" <[email protected]>


|
| I've been doing some more work with that Rootkit related thing I
| mentioned in a different thread here recently. You might remember
| that Backdoor in a MBR issue. I've now got a second IDE hard drive
| with the Trojanized MBR which I can check in DOS now as well. It turns
| out that KAVDOS32 does alert in plain DOS but not in Windows (I'm
| using Wind 2K). I once saw a error message produced by Windows that
| complained that "something" was trying to access the drive directly.
| This happened when I tried to force KAVDOS32 to check the MBR via
| the command line switch /P- ... it doesn't seem to try otherwise ...
| or it doesn't complain that it can't do it ... not sure exactly which.
| So I inadvertenly have stumbled on a problem with KAVDOS32, it seems,
| when used in Windows on the NT based OS. It doesn't look so far like
| it checks boot sectors.
|
| Also, in this case of the Trojanized boot sector, none of the av used
| in Multi-AV alert. So far, just a GUI (Wndows) version of KAV does. I
| have a hunch that some other Windows versions of av might alert since
| they alert on the image file ... AVG, Bit Defender, NOD32, Norman,
| NAV, UNA and VBA32 ... all alert, at least heuristically on the image
| file. Oddly, eScan which uses the Kaspersky engine does not alert on
| the Trojanized MBR sector. I'm tempted to try Windows versions of
| NOD32 and Bit Defender to see if at least one or two more av might
| detect the Trojanized MBR ... and not just KAV. But I'm not about
| to install a Windows version of NAV or McAfee. Ugh! :)
|
| Art
| http://home.epix.net/~artnpeg

Thanx for that infpo Art. Based upon it, I have added the /P- switch parameter to the
KAVClean.bat file used when scanning after booting with a DOS Boot Disk or a DOS Boot Disk
using NTFS4DOS.
 
I'm tempted to try Windows versions of
NOD32 and Bit Defender to see if at least one or two more av might
detect the Trojanized MBR ... and not just KAV.
Click to expand...

Just a follow-up to say that both BF and NOD32 alert on
the Trojanized MBR. NOD32 calls it Trojan.Dins.A and
BF calls it Backdoor.Boot.Dins.A

I might add that this freeware command line util:

http://www.geocities.com/mbrwizard/index2.html

has proved to be very useful for copying the MBR sectors
to image file and vice versa. There are two basic types ...
a Win NT based OS type and a DOS type that works with
both DOS and Win 9X/ME. I'm working with the v 1.53
versions and not the Beta 2.0 versions.

For an example of how these come in handy, right after
installing a trial of NOD32 I let it go ahead and reboot,
forgetting that I had the bad MBR on my main drive.
Fortunately, I had the DOS version (mbrwizd) and a
good image file on a DOS boot disk which saved me from
having to use my cloned backup drive.

It's a good idea, I think, to use some of these "minor"
backup/restore utils ... this one for the MBR and another
like CMOSSAVE for the CMOS. I've found ERUNT for
registry backup is also invaluable for a tinkerer like me
who far too often causes problems. One of these days
I might even get hit with malware. But so far, I'm
my PC's worst enemy :)

Art
http://home.epix.net/~artnpeg
 
Back
Top