PPRuNe Forums - View Single Post - A virus that kills Norton? .... and XP service pack 2?
Old 18th February 2006 | 01:44
  #6 (permalink)  
Keygrip


Moderator
 
Joined: Mar 2003
Posts: 2,586
Likes: 0
From: Orlando, Florida
Well, bugger me, what a viscious little that was!!

Turned out it was called W32.Chod.D and is wandering around the ether on the back of MSNMessenger.

I received an "instant message" from a colleague, which read (words to the effet of) "Hey, <insert name>, have a look at this messenger update." and, of course, there is a link added.

Stoopid me trusted the address (as I use it a lot) and clicked the link. Game over.

Virus writes itself into the computer - no way out. Then duplicates itself into various random folders and sets up a loop that ensures it installs on every boot up of the PC. It goes on to close down, and prevent access to, all known security programs and software (including security website address such as www.symantec.com) and deletes many administrator priviledges from the computer operator. It then opens a back door to let Mr. Hacker come in for a wander round at his/her own desire. As I already said, also shut down and cleared the memories of system restore.

Took three hours of professional help to track down the invading files and clean them out - the duplicates were incredible.

In answer to your various questions: SDSL BB modem on 24/7. Norton Internet Security 2005 - fully up to date. All firewalls and securities enabled.

MSNMessenger and Trillian also running 24/7. MSNMessenger now total history. Wipe in its entirity.

God luck, team players. Hope you never encounter it.
Keygrip is offline