I have done something dumb

[Peaches]

At the end of every day, I delete all my Eudora attachments which aren't ones I want to keep. Most are garbage and/or viruses.

The other day, I was being hasty and hit the wrong button and one started opening up. I hit esc, stop, help, don't do this - every button I could but apparently it didn't work.

Now there's a file that won't let me delete it called nav.pif. It's telling me it's being used. In looking around Google, I see that it's the Sober worm. I ran a virus check on my computer and it doesn't find the Sober worm. I tried running one I found on the net for this worm in particular and it locked up. I don't THINK I opened the file completely.

My computer is running very slow now.

Any suggestions on what I can do? I feel like such a dope - I've never had a virus on my computer and now this. :angry:

[mojobill]

http://fr.trendmicro-europe.com/enterprise...me=WORM_SOBER.A

removal instructions Peaches!

[Peaches]

Originally posted by fatbaby@Nov 4 2003, 01:05 PM
http://fr.trendmicro-europe.com/enterprise...me=WORM_SOBER.A

removal instructions Peaches!

Thanks, FB - that's the one that locked up. But I'll try it again.



Oh, and for those that might ask, yet, I've already done ctr/alt/del to see if I can find anything out of the ordinary that's running and no dice.

[Sharpie]

This is the info I found:

Wednesday October 29, 01:04 PM

Few PCs get hammered by Sober worm

By Dick O'Brien

A new worm, known as Sober, has been doing the rounds and despite the threat it presents to Windows users, security firms are not overly concerned.

While the worm has only garnered public attention in the past day or two, it was reported by anti-virus vendor Symantec (NASDAQ: SYMC - news) on 24 October. According to Symantec, Sober is a mass-mailing worm that uses its own SMTP engine to spread itself. The subject of the e-mail varies, and it will be in either English or German.

The subject line of the mail varies and may either purport to be a warning of a virus or genuine correspondence, such as "Re (Milan: AISW.MI - news) : Contact." The infected attachment may have any one of a number of file names and can come with a .bat, .com, .exe, .pif, or .scr file extension.

If opened the worm may display a fake error message of "file not complete." It will then copy itself into the system folder on the infected machine. It will also alter the computer's registry, enabling to run every time the machine is started. Following that it will collect all e-mail addresses it can find on the machine and mail itself using its own SMTP engine. Aside from varying subject lines and file names, the body of infected e-mails can vary and may be written in either German or English.

Symantec is attaching a low threat level to the worm. F-Secure labelled it as a medium level threat. McAfee also attached a low risk level to the worm.

"We're monitoring this virus at the moment, but at this stage we aren't attaching a very high level of risk to it," said Dermot Williams, managing director at Irish security company Systemhouse Technologies. The fact that many messages may be in German may hinder its spread. "We would hope that people in English speaking areas would have a higher threshold of suspicion on encountering this virus," Williams explained.

Anti-virus vendors are advising that users keep their anti-virus software updated. Full instructions for manual removal have also been posted on the Web sites of most anti-virus firms.

[Sharpie]

Removal about 2/3 down the page from Norton

http://securityresponse.symantec.com/avcen...imail.c@mm.html

[voodooman]

bring up a dos prompt, type in fdisk

:-)

[sarettah]

Originally posted by voodooman@Nov 4 2003, 12:26 PM
bring up a dos prompt, type in fdisk

:-)

You use to work for my ISP's support department vdm ???

[Peaches]

Argh - ran Fay's link and after an hour, it locked up. I think I'm going to remove most of my webpages and put them on CD's (there's SO much "little crap" on my hard drive) and try again.

Voodoo - you're a PITA

[Evil Chris]

Hi Peaches... in case you didn't get this sorted out yet...
I had to clean up FB's computer of a few of those pif and scr files too.

If nothing else works, use a command prompt and go to the directory in question and then just do two commands like this:

del *.scr
del *.pif

Then maybe run a wipe program if you have one, or if not just do a defrag.

This being helpful stuff is never going to get me asshole of the month status!

[clemsontiger]

If you WANT, I've got Norton AV Pro 2004 downloaded. I can burn it to a CD and you can install on your computer, but I know how you are against that.

[Trev]

Originally posted by clemsontiger@Nov 4 2003, 08:36 PM
If you WANT, I've got Norton AV Pro 2004 downloaded. I can burn it to a CD and you can install on your computer, but I know how you are against that.

In case she catches a virus you mean

[clemsontiger]

Originally posted by Trev+Nov 4 2003, 02:45 PM-->