W32.downdup.B

[tektips2006]

I have one xp machine and one 2003 server that keep getting attacked by this virus. The rest of the machines I have are apparently OK. Norton virus definitions are all up to date, so Norton real-time is able to intercept it and delete it. The problem is that it keeps trying every some time interval. I noticed that it creates some bogus scheduled tasks, and I guess it is using these as a mechanism to re-trigger itself. Apparently it reaches out to a network drive. I ran the Norton removal tool, and it said it could not find the virus. So it looks like the removal patch is not effective in removing it 100%. By the way, all windows are patched for the MS security flaw.

Is there a "real" solution to this virus? I mean a removal tool that actually works? Thanks

 

[MasterRacker]

You could try the manual removal steps here

http://support.microsoft.com/kb/962007

or try the removal tools here

http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99

Jeff
[small][purple]It's never too early to begin preparing for [/purple]International Talk Like a Pirate Day
"The software I buy sucks, The software I write sucks. It's time to give up and have a beer..." - Me[/small]

 

[tektips2006]

As I stated, I used the Symantec removal tool and it said it could not find the virus. I think I found the source machine. I basically stopped the "task scheduler" service (it was set to auto). That machine also had a relativly easy to guess local account, so I changed it to a more complex password.