Virus Problem 1

[Zych]

It looks like I may have to wipe the system but before I do here is what happened. One of my users go infected by a virus but it was removed when his system got the latest virus info. Now he can not run any .exe files or any .com files. I am not sure what he had but the only virus I can find info on, only kill the .exe

Now I can not get into the registry to change any of the values (or at least see if they are changed.) I have tried safe mode and command line mode. He is running Win2K. The only thing that works is one IE icon. Even the other IE icons don't even work. (I am not sure why this one does but it will not let me into it's properties to find out.)

When I try to run regedit as a .com file I get a message that says it must run jurnpldz.exe first but it can not find it. I have done a search for this file to no avail.
Infact it says this with all .com files.

Any ideas would be helpful.

Thanks,

- Zych

 

[wolluf]

Repair reinstall? Boot from 2k CD, choose new install (not repair). It should find installation & offer repair. Accept this. Keeps data, apps, settings intact, loses windows updates.


Must admit jurnpldz.exe sounds suspicious! never heard of it - and neither has google.

HTH - but suspect you'll end up reformatting & clean installing.

 

[Zych]

Do you think this will clean out the registry also? According to all the virus' that seem to kill the ability to run an exe file, there is a registry value that needs to be changed. Here is link to the one that I think it is:

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html

Thx,

Zych

 

[NTesla]

The registry is replaced when you do a new install with out repairing

 

[slicsaw]

This is probably the "swen" virus.
Go to

http://vil.nai.com/vil/content/v_100662.htm

Download

http://a64.g.akamai.net/7/64/2015/2003-09-18-15-/download.nai.com/products/mcafee-avert/fixswen.inf

Try following the instructions. I had to use older instructions on site which Did NOT work, I had to reboot in safe mode as ADMIN, rename regedit.exe to regedit.cmd and merge registry with instructions on site..

Good luck!

 

[Zych]

Thanks!!!! I tried the fixswen.inf file and now I can run programs. I am keeping it off the network until I verify that it is fully cleaned. Great answer to my problem.

Thanks again,

Zych