Virus

[lgvelez]

Older daughter has had us over at her house most of the afternoon trying to eradicate a virus / trojan horse / word macro that is raising havoc. A very large bullseye image is maintains primary focus over everything else, making it very difficult to get to explorer, etc. Nothing shows up in Task Manager. The closest description that I have been able to find is a Word97 macro virus called Spiral that McAfee lists. Any ideas, please? We need some help.

Laura Velez, MCP
lauravelez@home.com Laura Velez, MCP
lauravelez@home.com

 

[Garridon]

Your best bet is to do the following:

Run an updated virus check on the system.

Visit your virus protection's web site (such as Norton's). I know that Norton's gives detailed information on what files you will need to remove if your computer is in infected. You'd be surprised where these things can hide. Chances are, it's probably in your registry.



Linda Adams
Garridon@aol.com
Linda Adams online

http://www.geocities.com/hallona_2000

David Hedison Online

http://www.david-hedison.com

 

[lgvelez]

Thank you very much for the advice. Tonight I am going to see if we can bring the computer to our home and that will make this job easier. Laura Velez, MCP
lauravelez@home.com

 

[Dreamboat]

laura: What makes you think it's Word?

If, for whatever reason, you are certain that it is Word, then, with Word CLOSED, find the file called normal.dot and rename it to abnormal.dot and restart Word.
techsupportgirl@home.com
Brainbench MVP for Microsoft Word

http://www.brainbench.com

 

[Equalizer]

Try to reboot the computer to MS-DOS mode, then change directory to C:\Windows(or where you installed your window. Back up the file WIN.INI and then use notepad to open the file WIN.INI. Look under RUN=, you might see a foreign file listed there. Note down the file and then remove the text after the word RUN=.

Reboot the pc, open windows explorer and then search for the file name that you have noted down, delete that file(You might have to set the attribute of that file cause normally it's hidden, system and read only. Set the attribute to Archieve only!

Best of luck!!

 

[Guest_imported]

Did you find a fix for this machine? If so, do you know the name of it? One of my users downloaded a file and now has the same problem.

 

[dsi]

You may want to check the listing for this worm. It downloads its own plugins. "One of the plug-ins for W95.Hybris.gen generates a spiral image."

http://www.symantec.com/avcenter/venc/data/w95.hybris.gen.html

 

[Guest_imported]

Probably a little late, but here goes...

You need to remove the "run = aiciaic.exe" from the win.ini file. It might actually be called spirale.exe, but probably not.... Then delete the file from the windows system directory as well.

I can't recall for sure, but booting in to safemode should let you work without the spiral.

-Matt