Well, Now What?

lafroste

[lafroste]

I apologize for the vanity, but my wife inadvertantly opened an email from "Microsoft Security" that was, you guessed it, a virus. My computer escaped this plague, but hers did not. First, it incapacitated Zone Alarm, then it laughed at Norton Anti-Virus Corporate Edition by not allowing itself to be quarentined or deleted. Then, I pulled out the big guns... an emergency DOS boot disk, figuring I could go in and get midaevil on its a$$. But the keyboard does not respond so I can't direct the program.

Any ideas on how to rid us of this? The file is in the C:/WINNT directory, and is named "gvfwxjxw.exe" We have my wife's computer offline for now. Any help is appreciated.

[Ex-Dem]

http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.removal.tool.html">http://securityresponse.symantec.com/avcenter/venc/data/w32.swen.a@mm.removal.tool.html

[Ex-Dem]

Oh bother. Trying again... Hopefully this works...

[Reeses]

You can remove her disk drive and temporarily attach it as a slave to your computer. This is about 10 minutes work. You can then access her files, restore her registry to a prior version, restore damaged files or entire directories, or delete virus files.

[proxy_user]

I usually just reinstall the OS and reload all the programs when this happens on one of my machines.

[Agnes Heep]

It's going to be tough to do anything if your keyboard doesn't respond. But I can't see how the virus would do that with a DOS boot. Check to see that your keyboard is plugged into the right place, i.e., that you haven't inadvertently switched it with your mouse. If that turns out to be the case, you might be able to do a fresh installation of windows on the same, or another, partition, which will allow you to boot the system and get rid of the offending files. If you're using Windows 2K (which I suspect is the case, based on the C:\WINNT folder you mentioned) run the installation again and specify that you want a new installation, and give the system directory a different name, such as WINNT2.

[Clinging Bitterly]

If you have a USB keyboard it may not work in DOS mode. A USB only computer will usually support it, but a computer with standard PS/2 ports may not.

But you shouldn't have to fall back to DOS. If Windows starts up, just do what it says to do in the Symantec article linked above (a bit tedious but better than the alternatives), and you should be fixed.

One of our managers at work got this thing on his laptop last Friday. He would have had to have gone through a dialup connection and a personal email account, and had his Norton Anti-virus either disabled or out of date. Our corporate NAVmail system is constantly updated, and it stopped it in it's tracks.

I haven't had a hit from it at home yet - I guess most of my peeps are staying current on their vaccinations.

Dave in Eugene

[lafroste]

Thank you all for the responses. Unfortunately, None of them worked. The little prick re-wrote all my registries so that it has to be viable to allow any other executable to function. Once I used the Task Manager to find the little ba$tard and shut it down, almost none of my other executables would function, giving a "file not found" error message. On investigation I discovered that it had re-written all my executable paths by inserting a long string similar to a registry string into the path. I couldn't get to the registry because regedit does not function (along with IE Explorer, Netscape, copy, move, delete, chkdisk, format, etc. etc besides all other commercial software)

Clearly, her computer needs to be lobotomized, which I am going to do now by swapping hard drives. Oh well...

[Professional]

I'm no expert, but here's an idea.

Go to symantec.com

And find their virus/security risk check. It's free, and only takes a few minutes. It will scan your entire computer, then give you access, for free, to the software to fix the problem.

You need to probably wait a few days for symantec to complete the software.

I have zonelabs zonealarm installed, and have tested my dsl and networking connections, have three computers on a sytem for work. The tests from symantec confirm that I'm ok, check the site every week or two.

Get rid of any service provider email and just use an online service, like yahoo. Tell your wife to NOT be on any "friend" lists. Women seem to send each other dozens of stupid emails daily, where they find the time I don't know....

My wife insists on blowing up our computer at the home and never listens to my advice, blames it on everything but herself..... Good luck, your spouse probably will not listen either...