Unable to eliminate Virus

[smile11]

I did a full scan on my system and it showed one file as being infected.
Here are the details:

Item: ntservice.exe
Virus Name: Hacktool

The repair wizard came up and it was unable to repair this file. So, I tried to quarantine it and that failed. then, I tried to delete it and I got a message stating that "You have not eliminated all viruses"

I ran the scan again and the same thing happened all over again.
I'm not sure what to do next? How do I get this virus off of my system??

Please help.

Thanks in advance.

 

[SESaskDFC]

Howdy:

Go to the following url and follow their directions exactly !!

http://securityresponse.symantec.com/avcenter/venc/data/bat.mumu.a.worm.html

Murray

 

[smile11]

Hi there. Thanks that was very helpful. I ran the tool and it said there are no worms in my system. I then ran a full system scan and it came up clean.

I then signed into the Internet and boom:

Then, I got 2 more warning messages:
here's the first:
Object name: c\windows\system32\inetsrv\ssvs32.bat
Virus name: Backdoor.IRC.Flood

Here's the second:
Object name: c\windows\system32\inetsrv\ntnwsys.ocx
Virus name: IRC Trojan

For both is said unable to repair the file and access to file denied.

Why was this not detected when i ran a full system scan 2 minutes prior???

How do I get rid of these of has Norton already done that for me??

thanks again

 

[SESaskDFC]

Howdy:

What is your OS??

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.flood.e.html

Murray

 

[SESaskDFC]

What has me wondering.. if you were running Norton and kept it up to date, how in hell did you get infected in the first place??

Murray

 

[mattjurado]

Norton is far from full proof. A hacker can easily plant viruses, without the software detecting it... Not only that, but I've seen users infect systems with norton running in the background. Check out this article...

http://www.brienposey.com/KB/articleofweek.asp.asp

I use Hauri's ViRobot antivirus, it detects stuff norton can't, especially boot sector and memory resident viruses. The only downside is you have to wait a couple days after you buy it, to get the email to download it.

I need to register a new domain. MCSEsGoBackToDrivingForklifts.com

Matt

 

[smile11]

My operating system is Windows XP pro.

I don't know how I got it and when I ran the worm check it said there was no worm??

This is what I want to know, when you get a message that pops up from Norton telling you that you have a virus and that you do not have access to the file and it was unable to repair it.......does that mean it has detected and gotten rid of this Virus for you??

 

[mattjurado]

No it does not, it means Norton tried to fix it and failed. If the file is still there, it means Norton could not quarantine it either. If you really want to just fix this problem, I'm telling you, try the Hauri Antivirus, it really is a superior virus cleaner.

Matt J.

 

[smile11]

I went in and checked out the website for the HAuri Anti virus and it looks pretty impressive. I could not find the cost anywhere?? Can you have this as well as Norton or can you only have one on your pc?

In the meantime, how can I get rid of these viruses? Anything I can do or do I have to wait for the Hauri?

Thanks so much!

 

[mattjurado]

Sounds like you've been fighting with this for awhile, just buy the product, wait for the e-mail to come, as I said, this is the only big bummer. Its a 3 day wait. It should elimnate all of your viruses.

http://www.globalhauri.com/html/sales/estore.html

Matt J.

 

[1Bullet]

Delete your temporary internet files. This eliminated the virus if it is conneted to a url . Usually if Norton detects a virus that it can not repair or quarentine it is usually not on your computer, but there is a link to the virus through your temporary internet files. This should resolve your problem. If your are ever in doubt of your anti virus protection you can allways scan from Symantecs

http://www.symantec.com/avcenter/

Click on check for scurity risks at bottom of page.And do virus scan.
If your anti virus is ever compromised the virus usually will not allow for a full scan from Symantec if the virus is attacking your firewall and or anti virus software.
Good Luck

 

[TheOmegaMan]

Sounds Like mattjurado (MIS) Works for Hauri Antivirus. NAV does scan memory and boot sector infectors. There can be many infection vectors to your machine. Especialy if you are not running a firewall. The original infector may have targeted you and is still spaming your machine.

Try

http://service1.symantec.com/sarc/sarc.nsf/info/html/cannot.repair.trojan.or.worm.html

for starters.

 

[TheOmegaMan]

Damn I should have rememberd this one. NAV may have items in Quarintine. It sees them and reports them but cant remove them. Go into Quarintine and delete any files there.

 

[smile11]

Thank you bullet and omegaman!

I deleted the temperary internet files as well as history. I also went into quarantine and deleted the files that were there.

I went into Symantec and went into security risks and did a virus scan and it came out clean.

I hope that's the end of that! if anything else progresses, I will let you know.

You were all a great help. I love this website!