Computing.Net > Forums > Security and Virus > virus ?? how

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

virus ?? how

Reply to Message Icon

Name: novice
Date: October 30, 2002 at 05:34:47 Pacific
OS: win me
CPU/Ram: 1.1ghz
Comment:

i got loads of virus in my computer.
How do i get rid of them. I cant dload anything coz it wont let me install any programs.

the virus i no so far that is on my pc r..

Alevir...Marco!...Brasil...Regenv32...Gone

Help me some1...

Also if i fomat my pc will the virus go away



Sponsored Link
Ads by Google

Response Number 1
Name: bradmatt
Date: October 30, 2002 at 05:41:56 Pacific
Reply:

try an online virus scan at

http://housecall.antivirus.com/



0

Response Number 2
Name: novice
Date: October 30, 2002 at 05:50:22 Pacific
Reply:

i have try and they come up with my computer has got 6 viruses.
But when i check the auto clean, they crash my pc.

So the online scan do not work..they tell me i got virus but cant fix it.

So any1 else with any solution


0

Response Number 3
Name: WhoDunnit
Date: October 30, 2002 at 06:07:23 Pacific
Reply:

Read these.

http://miataru.computing.net/security/wwwboard/forum/2954.html

http://miataru.computing.net/security/wwwboard/forum/2921.html

http://miataru.computing.net/security/wwwboard/forum/2897.html


0

Response Number 4
Name: Tony
Date: October 30, 2002 at 06:17:35 Pacific
Reply:

He brought up a good topic which I too have been wondering. If I have a virus and then format my computer and do clean install, what becomes of the virus, will it be on my system still?


0

Response Number 5
Name: Kev
Date: October 30, 2002 at 06:52:46 Pacific
Reply:

Formatting the hdd will remove the virus.Unless its one that infects the mbr or bios.Just format it.


0

Related Posts

See More



Response Number 6
Name: Brad Peterson
Date: October 31, 2002 at 10:04:11 Pacific
Reply:

I've posted this article numerous times on all of the Opaserv topics in this forum. Here it is again, with a few additions:

I was one of the lucky ones who got the full blown effect of the Opaserv worm. I had scrsvr.exe, brasil.pif, and then alevir.exe. Norton Anti-Virus would always detect it trying to run, but it could never keep my system clean from it. I followed all of their directions, downloaded all of their tools, downloaded the patch from Microsoft, cleaned out my registry, kept my win.ini file clean, made dummy scrsvr.exe and brasil.pif files with the +r read attribute flag, etc. And the stupid things kept coming back!!! I wrote Norton email after email, telling them that their anti-virus software isn't stopping the virus from getting on my computer. I sent them brasil.pif on October 21, and then finally, on October 25, they listed it as a threat, claiming it was discovered on October 25. Stupid liars. And all the while, the virus kept coming back. Because of all of this, I feel that I have to resort to caps to make the following point =)

IF YOU SIMPLY USE NORTON ANTIVIRUS AND DELETE CERTAIN FILES AND REGISTRY ENTRIES THE VIRUS CREATES, THE WORM WILL COME BACK! THE VIRUS USES TO USE PORTS 137-139 ON YOUR COMPUTER TO WORK. YOU MUST CLOSE THOSE PORTS!

So, I resorted to closing my ports 137-139 (Turning off NetBIOS), and my computer has not reported a virus for 6 days now. (It used to report it every 15 minutes.) Before, from what I could tell, I could clean the viruses off my system using simple techniques such as removing the lines out of win.ini and my registry. I'd stay virus free until I'd connect to the internet, and then *bang* the viruses were back, sometimes in a new morphed form (brasil.pif or alevir.exe). It appears the virus uses a security flaw in Windows (I'm running win 98), by communicating to your computer through these ports, and by turning off ports 137-139, you fix it.

I found a nice site that describes how to turn off these ports in detail, and it has simple to follow steps with handy screenshots. The site is here.

https://grc.com/x/ne.dll?bh0bkyd2

Run the "Probe my Ports" test first for kicks, it should show you that your computer is vulnerable in the ports that this virus uses. Next, go to section 5 "Network bondage". That will describe how to turn off these ports. By the way, this shouldn't affect your computer's network connections at all. It just redistributes network commucation in the proper way, and you simply just close off ports 137-139 to those that shouldn't have access to it. Once you do this, the virus should be blocked from coming back every time you connect to the internet.

By the way, make sure you also follow all of the tips listed on Symantec about the Opaserv worm. You must clean out your registry, win.ini file, and download the patch from Microsoft.

If all of this was too technical for you, then another great solution is to download the free version of ZoneAlarm. This is as a personal firewall. ZoneAlarm acts like a guard keeps a close eye over every network communication on your computer, and only allows certain traffic in or out. And opaserv is not allowed. Here is the link to ZoneAlarm:

http://download.com.com/3000-2092-10153456.html?tag=lst-0-8

And as for one last side note, it appears that you can't fully remove the virus, you can only suppress it. For example, my ports 137-139 were closed, and I hadn't had a virus report in 7 days as a result. I scanned for the opaserv virus using both of Norton's tools (NAV and FixOpsv.com), and it reported I was virus free. Then I decided to open the ports and connect to the internet to see what happened. *BAM* The virus was back in 5 minutes! And I was on a dialup dynamic IP address! That means the virus waits on the computer, just waiting for open ports and an internet connection. So I closed the ports, and immediately all virus activity stopped again. To sum up, by closing the ports off, you'll just suppress the virus for the rest of your computer's life.

Good luck!

(email me if you have problems, I'd be happy to help)


0

Response Number 7
Name: Brad Peterson
Date: October 31, 2002 at 10:04:47 Pacific
Reply:

And now for the technical followup. You should only read this if you are running on a network:

The site I mentioned the above postadvocates using NetBEUI for your internal network. Unfortunately, that can be a pain if you're running a TCP/IP internal network, and you can't switch over to NetBEUI protocol. So I looked for a way to allow me to run a TCP/IP network on a Windows 98 machine while blocking ports 137-139. But, according to grc.com, "the only way to close port 139 is for every single service to be unbounded from every single instance of TCP/IP."

What this means is, there is no way to use TCP/IP for an internal network while having port 139 closed!

So if you're in this sticky situation, you must put up a firewall. Either ZoneAlarm for your personal computer, or configure your network's firewall. We configured our linux firewall to not allow any outbound communication over ports 137-139, and that did the trick for our office. (As for me, since I take my computer home from our office network to connect to the internet via Dial-Up adapter, I'll have to get Zone Alarm).


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: virus ?? how

how do i know i have a virus www.computing.net/answers/security/how-do-i-know-i-have-a-virus/4386.html

How to delete virus from my compute www.computing.net/answers/security/how-to-delete-virus-from-my-compute/25016.html

how to remove svchost virus? www.computing.net/answers/security/how-to-remove-svchost-virus/26048.html