Can't find the virus

[MartyBoy]

Please help me on this nasty virus. Norton AV with latest dat's can't find this virus (nor from DOS). It intercepts mouse clicks on Norton command buttons and pops up the dialer. Repeated closing just keeps bringing the dialer back up. It modified the MBR which I have repaired. I have deleted the dialer.exe program, reinstalled Win98, ghosted the whole volume (partition to partition), and checked the registry HK/LM/SW/Mic../CV/Run etc a dozen times, also Win.ini and System.ini. I can't identify where it is being called from. MSInfo.exe crashes if I try to use it. Just about every click of the mouse activates it.

Any ideas please, this is causing serious grief.

 

[jrbarnett]

When you reinstalled win98, did you wipe the partition and recreate it?
Take your win98 setup boot floppy disk and start the computer from it, then drop out to the command prompt and type:

SYS C:
FDISK /MBR

This will overwrite the boot sector and master boot record with a clean copy.
If there is still a problem, get hold of the ultimate boot cd from

http://www.ultimatebootcd.com

and use it to run a DOS a-v scan with F-Prot over the machine.

It is also worth remembering that items can load up in the registry from HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key as well as the local_machine hive so that is worth checking as well, in addition to the load= and run= lines in win.ini, which are still run although they have been deprecated in 98.

John

 

[tolstoy]

WHy not run regmon or filemon to see what reg keys and files the virus is accessing when it runs.

 

[MartyBoy]

Thanks JR, I had already set up a clean MBR with FDisk before Ghosting and I still had to redo the MBR after the first boot.

Also thanks to tolstoy for suggestions (I havn't being using those products, but will in future ...if I have to).

The hopefully long term answer turned out to be a combination of deinstalling Norton Systemworks 2003, running Ad-Aware over the disk and removing 19 spyware offenders, then reinstalling Norton and reinstalling from the Internet all Systemworks updates. I couldn't be bothered, nor the client afford the time involved in "pinning the tail on the donkey" ... it might have turned out to be me.

Anyway thanks for the tips.