From what I remember...

...this one confuses the OS and AV systems as to which file is infected. In reality there is a system process which is cloned and spawns an instance of a file in the temp directory which is the real process. If deleted (almost impossible without some tools because it's always in use) then the process just creates another file with a different name.

When I had this there was no info at all on Symantec about the nastier strain.

Posted By: Steve in Holland on January 10th 2006 at 08:42:44

Message Thread

Oh dear, early morning virus advise needed please... (General Chat) - Fierce Panda, Jan 10, 08:21:54
- I don't know what STOPZilla is, but presumably it's just another executable (General Chat) - BerlinCanary, Jan 10, 08:39:47
  - From what I remember... (General Chat) - Steve in Holland, Jan 10, 08:42:44
    - I think this is it... (General Chat) - Fierce Panda, Jan 10, 08:59:47
      - Do you not have an IT Manager or are you a bit worried about approaching him/her? (n/m) (General Chat) - lovely old job, Jan 10, 09:07:46
        
        Nope, we don't... (General Chat) - Fierce Panda, Jan 10, 09:09:45
        
        I will have a word with our IT guy for you & see if he can help. (n/m) (General Chat) - lovely old job, Jan 10, 09:11:47
        
        Oh, nice one, thank you (n/m) (General Chat) - Fierce Panda, Jan 10, 09:12:52
      - I have no idea what they are either. XP is shite. (n/m) (General Chat) - Steve in Holland, Jan 10, 09:01:15
      - I thought Norton would automatically remove these things for you (n/m) (General Chat) - Brom, Jan 10, 09:00:50
        
        It tried and failed... (General Chat) - Fierce Panda, Jan 10, 09:04:53
        
        one of the many reasons why this weekend i ditched Norton.. (General Chat) - NCFC4life, Jan 10, 09:14:55
        
        In favour of what? That's not awfully helpful Mr Life... (n/m) (General Chat) - Fierce Panda, Jan 10, 09:18:04
        
        i apologise Mr Panda... (General Chat) - NCFC4life, Jan 10, 09:42:00
        
        Only bad thing about that is that (General Chat) - Steve in Holland, Jan 10, 09:48:08
        
        What are you now running? (n/m) (General Chat) - Brom, Jan 10, 09:18:02
- That one is an absolute bitch, or (General Chat) - Steve in Holland, Jan 10, 08:27:30
- Whoosh (General Chat) - DDiM, Jan 10, 08:23:40

Reply to Message

In order to add a post to the WotB Message Board you must be a registered WotB user.

If you are not yet registered then please visit the registration page. You should ensure that their browser is setup to accept cookies.