pslewis

Strange things happen when I log on to my PC and onto ScoobyNet.

I don't just mean my affect on SN either!

On PC log-on - I get a warning come up that says:-

'Publisher cannot be verified - do you want to run this software'?

Software:- System.EXE

Application:- C:\WINDOWS\System32

RUN or CANCEL

Of course, I consider it to be a virus or an attack on my PC so I do not run ...

Any thoughts? And how do I get it to stop asking? The PC runs fine without clicking RUN!

Another weirdo is that when I open ScoobyNet, ADOBE ACROBAT 4.0 READER appears to start up in the background ...... this started when the above happened so I consider them related.

Any Ideas??

I have run my Anti-Virus Software and it has put 3 virus/worms into the vault

Pete

Hanslow

Oh dear...I thought you Labour voters were intelligent? I would help, but I'm just a thick Tory voter

ru'

This is purely one of the advantages of giving Labia a third term. Probably that facist Blunkett's fault...

pslewis

Well, it was worth a try ........................ any Labour voters out there??

BTW I actually said that the Tories were thick ... their voters are merely mis-led!

Pete

Hanslow

Oooh back track back track....now where have we seen that before

Now, is this the slightest it annoying that it's been taken completely off topic and directed towards politics? Hmmm?

pslewis

I'll talk about any topic you wish ....... I love conversations that drift, I cannot get enough of them!

Drift away

Pete

Hanslow

Snails....why do they climb up houses? What's the point? Do they just like looking through your windows?

ru'

It's probably your MAF, or the way you changed your oil...

pslewis

I can see that I'm not going to get much help here ...... I feel like Al Johnson who has just walked into a KluKlux Clan party!!

Pete

Hanslow

Cheer up Pete, we're only pulling your leg

I've got to pop out now, but will have a look tonight to see if I can find anything out for you

Do you know what virus'/worms were put into the vault?

pslewis

Hanslow

WORM/KELVIR AI and AG

There are 4 of these worms now 3off AI and 1off AG ... the 4th has appeared since I tried to do a Restore!

Could I get this virus from a PDF File? Its funny how the ADOBE ACROBAT opens when I start ScoobyNet?

Pete

Nicks VR4

W32.Kelvir.AI
http://securityresponse.symantec.com...kelvir.ai.html

W32.Kelvir.AI is a worm that spreads a variant of W32.Spybot.Worm through MSN Messenger and exploits remote vulnerabilities.

AG will be similar

Upgrade Acrobat might help there's a version 7

Puff The Magic Wagon!

iTrader: (2)

Call me thick but the only way of spreading files through MSN messenger is accepting file transfers and/or clicking on links supplied by people?

Now I only accept files/click links if I'm actually having a chat with the person concerned & know what it is that I'm accepting/clicking. Very simple security system that should mean you never get a virus unless the person you are talking with deliberately infects you.

Or have I missed something?

Nicks VR4

Nope you aint missed anything it does need that person to download and execute the file
(Sends the following message to all the MSN Messenger contacts on the compromised computer)
So you could be talking too your mate and get the file sent beliving he/she has sent you it
And some people will download / click on anything thats way a lot of Corporate companies have disable MSN etc

pslewis

My daughter uses the PC as well ..... and she is always on MSN Messenger!

She's cautious - but not like me!

Thanks NicksVR4 - I'll upgrade to version 7

Pete

pslewis

Upgraded to version7 .... still the same quirky behaviour!

Pete

Hanslow

Back again

When you say on logon, when exactly during the logon does it come up with this?

Do you have visibility of the windows desktop at this point?

Can you press CTRL-SHIFT-ESC to bring up the windows task manager and list here what processes are running at the time under the process tab? In case it's something simple, have you got anything in your Startup folder (Start button -> Programs -> Startup).

Can you also do Start->Run and then type in msconfig and hit enter. In the popped up window, select the Startup tab and list here what's in there.

Cheers

Steve

pslewis

Steve, thanks for getting back ......

The PC starts up as per usual, goes cleanly into the first screen of XP where the names of the accounts/users are ....

When a user clicks on their account - the desktop opens and can be seen ... its now that the offer to run a program appears .....

Any help??

Pete

Redkop

To put it crudely Pete - you're fcuked then. I had this last week, via MSN from Fulham71. It has taken me all week to clear my laptop as new things happened every time I tried to clear it, as it manifested itself into something else.

I got help from THIS FORUM in Cyber Safety

Good luck.

Nicks VR4

What Antivirus are you using ?

You could try going to Trend or Panda and doing a online scan

Or use your existing AV software and make sure it deletes them and not puts them in a vault , What ever a fault is as it sounds like they are still running on your PC

Hanslow

I agree with Nick and Red in that it sounds like they may still be lurking

Good luck with sorting it (give the online scanners a crack as suggested by Nick). As Red pointed out, they can be a bugger to get rid of. Give your daughter a good slap as well and tell her not to accept things from strangers, or even from people she knows

Just to show I care and help a bit ()....

Here is the Trendmicro online virus checker, and Here is the Pandasoft one.

Redkop

Don't use Panda, that caused even more problems....

Get help from the experts on that link I posted.

pslewis

Thanks to all ....

I am using AVG AV Software ... it has found them and isolated them in the vault

First time I have been infected in over 7 years of Internet activity

Pete

Puff The Magic Wagon!

iTrader: (2)

Go to the well too often and...

Redkop

Hate to tell you Pete, but AVG did that to mine too. But they replicate and manifest as BHOs and all sorts. You should really turn off System Restore when you remove any viruses too and preferably run the scan whilst in Safe Mode.

pslewis

Cheers ... I need to get rid of them somehow!

Pete

PALATINE

joy!

fast bloke

Its probably new laybout spyware infecting your PC so they can expand the nanny state