w32/badtrans/mm
Joined: May 2001
Posts: 92
Likes: 0
From: UK
I was infected with this one yesterday.I downloaded the fix/removal tool from symantic.The virus scanner identified 3 files as being infected. The removal tool removed 2 of them,(The removal was only succesful in safe mode). I have since run the removal tool in both safe and normal mode and it says that the virus is no longer detected. I then restarted my computer in to normal mode, I re-run the virus scan and was told that my computer was still infected. the infected file is C:PQSC\CPS\000129\FILES\001\000A70.DAT, I am no computer expert and would like to know how i can get rid of this file (or even if i should ?) The Norton anti-virus program has detected this infected file but says (in a dialogue box) that it is unable to quarantine or delete it. Any advice or help will be greatly appreciated, thanks.
Joined: Jun 2001
Posts: 3,991
Likes: 8
From: UK
Have just had an email from a colleague which reads as follows:-
Last week my PC was infected by a nasty worm virus and I spent all the necessary time getting rid of it and re-installing my Windows programme (twice). I have discovered an ingenious way of making sure I never get caught unawares again and wanted to share it with you.
Here is a computer trick today that's really ingenious in its simplicity.
As you may know, when/if a worm virus gets into your computer it heads straight for your email address book and sends itself to everyone in there, thus infecting all your friends and associates. This trick won't keep the virus from getting into your computer, but it will stop it from using your address book to spread further, and it will alert you to the fact that the worm has gotten into your system.
Here's what you do: first, open your address book and click on "new contact", just as you would do if you were adding a new friend to your list of email addresses. In the window where you would type your friend's first name, type in !000 (that's an exclamation mark followed by 3 zeros). In the window below where it prompts you to enter the new email address, type in WormAlert. Then complete everything by clicking add, enter, ok, etc.
Now, here's what you've done and why it works: the "name" !000 will be placed at the top of your address book as entry #1. This will be where the worm will start in an effort to send itself to all your friends. But when it tries to send itself to !000, it will be undeliverable because of the bogus email address you entered (WormAlert). If the first attempt fails (which it will because of the phoney address), the worm goes no further and your friends will not be infected.
Here's the second great advantage of this method: if an email cannot be delivered, you will be notified of this in your Inbox almost immediately.
Hence, if you ever get an email telling you that an email addressed to WormAlert could not be delivered, you know right away that you have the worm virus in your system. You can then take steps to get rid of it!
I hope this helps to save you a lot of time and effort in the future.
Last week my PC was infected by a nasty worm virus and I spent all the necessary time getting rid of it and re-installing my Windows programme (twice). I have discovered an ingenious way of making sure I never get caught unawares again and wanted to share it with you.
Here is a computer trick today that's really ingenious in its simplicity.
As you may know, when/if a worm virus gets into your computer it heads straight for your email address book and sends itself to everyone in there, thus infecting all your friends and associates. This trick won't keep the virus from getting into your computer, but it will stop it from using your address book to spread further, and it will alert you to the fact that the worm has gotten into your system.
Here's what you do: first, open your address book and click on "new contact", just as you would do if you were adding a new friend to your list of email addresses. In the window where you would type your friend's first name, type in !000 (that's an exclamation mark followed by 3 zeros). In the window below where it prompts you to enter the new email address, type in WormAlert. Then complete everything by clicking add, enter, ok, etc.
Now, here's what you've done and why it works: the "name" !000 will be placed at the top of your address book as entry #1. This will be where the worm will start in an effort to send itself to all your friends. But when it tries to send itself to !000, it will be undeliverable because of the bogus email address you entered (WormAlert). If the first attempt fails (which it will because of the phoney address), the worm goes no further and your friends will not be infected.
Here's the second great advantage of this method: if an email cannot be delivered, you will be notified of this in your Inbox almost immediately.
Hence, if you ever get an email telling you that an email addressed to WormAlert could not be delivered, you know right away that you have the worm virus in your system. You can then take steps to get rid of it!
I hope this helps to save you a lot of time and effort in the future.
Joined: May 2001
Posts: 92
Likes: 0
From: UK
Update'
Finally managed to rid my machine of this virus. I let the virus scanner Identify the infected file. I then took a note of it, rebooted into Safe mode, found the file and manually deleted it. I then re-run the Fix/removal tool in both safe and normal mode. I then run the Norton Virus Scanner in both safe and normal mode ( no more virus detected). I,m not really sure what the file ideleted did, but it was infected, could not be repaired, and so had to go. I think my machine is working ok, still only time will tell.What a day this has been!
Finally managed to rid my machine of this virus. I let the virus scanner Identify the infected file. I then took a note of it, rebooted into Safe mode, found the file and manually deleted it. I then re-run the Fix/removal tool in both safe and normal mode. I then run the Norton Virus Scanner in both safe and normal mode ( no more virus detected). I,m not really sure what the file ideleted did, but it was infected, could not be repaired, and so had to go. I think my machine is working ok, still only time will tell.What a day this has been!
Joined: Apr 2001
Posts: 71
Likes: 0
From: England
fireflybob, I like your false E-Mail address suggestion.
I have placed it on my machine and assuming it works, its brilliant!
Never seen it suggested anywhere else.
The only doubt I have, is if a virus is written that will simply work its way through the list come what may, never the less, such a simple solution deserves a fair trial.
Thanks.
I have placed it on my machine and assuming it works, its brilliant!
Never seen it suggested anywhere else.
The only doubt I have, is if a virus is written that will simply work its way through the list come what may, never the less, such a simple solution deserves a fair trial.
Thanks.
Joined: Sep 2000
Posts: 25
Likes: 0
From: Australia
You might like to read a little more about this so called "trick" on this URL. Things are never as simple as they seem, are they?
http://antivirus.about.com/library/weekly/aa082801b.htm
Cheers.
http://antivirus.about.com/library/weekly/aa082801b.htm
Cheers.
Joined: Jun 2001
Posts: 376
Likes: 0
From: Ozmate
I got caught by another virus many months ago even though I had McAfee running and the very latest DAT file.Reformat required and lost a lot of data.
Gave McAfee the "flick" and have had "Nortons" ever since.
It has since picked up numerous attempts to infect my machine.
I agree with previous posters about McAfee being not up to scratch.
Gave McAfee the "flick" and have had "Nortons" ever since.
It has since picked up numerous attempts to infect my machine.
I agree with previous posters about McAfee being not up to scratch.
Joined: Apr 2001
Posts: 71
Likes: 0
From: England
Thanks feret,I read the link and what seemed a good idear, is perhaps not quite what it seemed.
I did note that I suspected it may have limitations, but I suppose if it catches one virus and the address is indeed not regestered to anyone, then it is worthwhile.
After all, it costs nothing!
Clearly though, up to date anti-virus software cannot be beaten at present.
