Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Please Help -- Worm Virus


  • Please log in to reply
4 replies to this topic

#1 Cmotley

Cmotley

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:11 PM

Posted 08 February 2008 - 09:52 AM

Hello,

I maintain a small network. Every day Symantec Antivirus is reporting that three of the 10 clients have viruses. One computer reports the W32.feebs virus and the other two report the downloader virus.

On all three pc, Symantec reports finding a file that starts with "qef" and then has four random characters and then ends with ".tmp" So the files look like qefe34r.tmp it is always found in the directory C:\windows\temp

When I search that directory, I usually found no files until today. Today I left the directory window open the files appeared just briefly and then were gone. I waited a while longer and sure enough the files appeared again and when I doubled clicked one, Symantec warned me that this was a virus.

I have run Spyhunter and Spydoctor on both computers but still get the virus warning from Symantec daily. I read the manual removal instructions from Symantecs website but I can not find any of the registry files the instructions refer to. Does anyone have any suggestions how to proceed?

Thanks

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,917 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:11 PM

Posted 08 February 2008 - 01:53 PM

Hello can you scan this with these:
Online
ESET Online Scanner
Next
SUPERAntiSpyware , Free Home Version. Save to desktop .. DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to start Windows in Safe Mode

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.

If asked if you want to reboot, click "Yes" and reboot normally.
To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 Cmotley

Cmotley
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:10:11 PM

Posted 08 February 2008 - 06:20 PM

Thanks for the advice, unfortualty ESET scanner is not working (I confirmed this with a phone call) and SuperAntispyware just found a few cookies.
I've run four or five scanners, is the only option to reinstall all the OS?

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,917 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:11 PM

Posted 08 February 2008 - 06:36 PM

How about trying to run this Panda ActiveScan?, ONline scan.
Here's some info on the virus while I look for something else.

Worm.Win32.Feebs.gen is the detection for a number of variants in this family of Internet worms. Worms from the Feebs family spread as an attachment to infected messages and also via file-sharing networks.

Worms from the Feebs family are capable of terminating firewall and antivirus programs.

This "gen" detection will detect a JavaScript component which spreads as an attachment to infected messages. This component downloads an executable copy of the worm from designated servers, saves it to the victim machine, and launches it for execution.

The JavaScript component will also cause a fake Internet page to be displayed, which informs the user that there is no connection available.

If it detects them on the victim machine, the JavaScript component will also delete the following records from the system registry:

[HKLM\System\CurrentControlSet\Services]
"FirePM"
"KmxFile"
"pcipim"
"pcIPPsC"
"RapDrv"

VirusList
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,917 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:11:11 PM

Posted 08 February 2008 - 06:40 PM

Hah found it...
F-Secure Corporation provides the special disinfection utility to clean Feebs infection from a computer. This disinfection utility is called F-Force and it can be downloaded from our web and ftp sites:
http://www.f-secure.com/v-descs/feebs.shtml

Good luck ,,tell us how you make out. Thanks
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users