Viruses adding litems to WIN.INI file

  • Thread starter Thread starter Bryan Henderson
  • Start date Start date
B

Bryan Henderson

The problem I am having is when connected to the net with my broadband
connection using my LAPTOP every so often Norton detects a virus infection
and then says it is ok to use my PC. However an item is being added to the
WIN.INI file so that when I come to restart my PC I get a succession of
windows opening up saying can't find a file referred to in WIN.INI file.
Here is a copy of the latest one this morning.


run=c:\windows\speedy.pif,c:\windows\speedy.bat,c:\windows\puta!!.com,c:\win
dows\speedy.scr,c:\windows\scrsvr.exe

This is five windows opening up. Whenever I delete these items I seem to get
more later on. This has been going on for a few days now. The strange thing
is that when using the same broadband connection with a different PC
(desktop) this doesn't happen at all.

I am getting these not from e-mail but while surfing the net or using
Usenet.

Can anyone explain what is happening here and how to stop it if at all? TIA.
 
Bryan said:
The problem I am having is when connected to the net with my broadband
connection using my LAPTOP every so often Norton detects a virus infection
and then says it is ok to use my PC. However an item is being added to the
WIN.INI file so that when I come to restart my PC I get a succession of
windows opening up saying can't find a file referred to in WIN.INI file.
Here is a copy of the latest one this morning.


run=c:\windows\speedy.pif,c:\windows\speedy.bat,c:\windows\puta!!.com,c:\win
dows\speedy.scr,c:\windows\scrsvr.exe

This is five windows opening up. Whenever I delete these items I seem to get
more later on. This has been going on for a few days now. The strange thing
is that when using the same broadband connection with a different PC
(desktop) this doesn't happen at all.

I am getting these not from e-mail but while surfing the net or using
Usenet.

Can anyone explain what is happening here and how to stop it if at all? TIA.
Click to expand...

you say you've ruled out email, and you make no mention of p2p apps...
have you checked to make sure you've got no shares accessible to the
outside world?
 
Thumper said:
Sounds something like the Opaserv worm possibly the W32.Opaserv.AD.Worm
better run a virus scan.
Click to expand...

This is one of three that Norton has caught, also W95.Dupator.1503. I have
done a virus scan and there are none on my PC apart from those in
quarantine.
 
kurt wismer said:
TIA.

you say you've ruled out email, and you make no mention of p2p apps...
have you checked to make sure you've got no shares accessible to the
outside world?
Click to expand...

I wasn't running Kazaalite recently or any other p2p app and no sharing is
enabled on the drive that I can see. I have now fixed the problem with my
desktop PC - faulty NIC so will use that most of the time as before.
 
Bryan said:
I wasn't running Kazaalite recently or any other p2p app and no sharing is
enabled on the drive that I can see.
Click to expand...

administrative shares may be enabled by default... if the laptop is
using win2k or xp go to control panel->administrative tools->computer
management and select shared folders->shares to see if you have any
shares... i don't know much about sharing on earlier versions of
windows, unfortunately...
 
Back
Top