What have I got, or what has me?

[edfair]

Customer's machine, got worm message and customer cleared. Had printer problem and secretary loaded new printer drivers to stop trash printing.
Would not connect to LAN. Removed spurious NICs from mangler, now won't recognize PCI NIC for new network install. Will load software but won't find it on reboot.
Got 3com509b ISA to load and got network neighborhood but can't change parameters to get the card to work in 98SE.
BootMenu choice in msdos.sys is ignored.
DOS7 or 6.22 and 3com diagnostics give divide by zero error.
Machine is aopen 1gb celeron with 100+memory, 10+ HD space.

Just a series of seemingly unrelated problems that might set off an alarm in somebody's mind.

Ed Fair
Any advice I give is my best judgement based on my interpretation of the facts you supply. Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[AVChap]

Bugbear? See if it matches these:

http://vil.nai.com/vil/content/v_99728.htm

HTH,



AVChap
... my $1 worth of advise, 2cents isn't enough due to inflation

 

[wbg34]

bugbear. here is a link to download symantec's removal tool (Run the tool in safe mode).

http://securityresponse.symantec.com/avcenter/FixBugb.exe

 

[edfair]

Thank you. I also suspect bugbearb and have the removal tool from symantec to try Thurs AM.
Although documentation says bugbear attempts to block AV sites, I haven't seen anything that would indicate that it also blocks total network access. Therefore I was suspicious of symptoms 3-6 which may or may not be related.

Ed Fair
Any advice I give is my best judgement based on my interpretation of the facts you supply. Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[greyted]

edfair,
You are I assume fully aware of the new variant W32BugBear.B@mm.
Was looking this up for a friend earlier today who I think has got this virus.
Symantec have upgraded it to Category 4 due to the amount of customer submissions.
The following link has the updated information, HTH. For those who have not yet done so it is worth reading the threat link.

http://www.symantec.com/

Nasty beast and they do mention (list) what networking or other programmes that this virus attempts to hijack. As you say it most probably isn't relavent.

Good luck






Ted

A great many people think they are thinking when they are merely rearranging their prejudices.
(William James)

 

[edfair]

Yeah, I tested for B this afternoon. Nada. Finally got a NIC to take after umpteen installs and have network back up.
Absolutely nothing on it, just your average 98SE PITA for 3 half days cleaning junk out.
Has indications of 3 windows installs, plus remnants of 3.1 and 95upgrade plus garbage config and autoexec stuff called from some previous install. And the boot menu still doesn't work. So I may do an overlay install tomorrow and see if there is any improvement. I think there is something fundamentally flawed with the install, but am clueless right now. Or maybe give SFC a chance to perform.

Ed Fair
Any advice I give is my best judgement based on my interpretation of the facts you supply. Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[greyted]

edfair,
Wow, best of luck. Had they any problems before the Worm?


Ted

A great many people think they are thinking when they are merely rearranging their prejudices.
(William James)

 

[edfair]

No indication of any problems. Then after the worm or concurrently junk from the printer and loss of network. I'll test for previous bugbear Friday and trace down the virus signatures to see how current they are.

Ed Fair
Any advice I give is my best judgement based on my interpretation of the facts you supply. Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.