Expert: Lorry - 3/13/2008

Question
QUESTION: i accepted a zip file thinking it contained a pic from my friend! GOD DAMIT just got to know that i  m sending the same file to everybody its a VIRUS!i reinstalled WLM and downloaded and updated Avast and Spybot i scanned the computer... but its not helping! does anybody have any clues?

ANSWER: Hi Abdul,

Using Internet Explorer, go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

After removing the threat, make sure that you keep Avast up to date and run a scan once a week.

Hope this helps!
Lorry

---------- FOLLOW-UP ----------

QUESTION: i did as u said, but the scan was over and symantics didnt find any virus!!! but it said tht they dont check compressed files so im suspecting that the virus might be in a compressed file.i have uninstalled my WLM should i reinstall it and run the antivirus?

Answer
Hi Abdul,

Before doing the following, disable Avast - don't remove it, just disable it otherwise there might be a conflict.

Okay, this will take a little more time, but worth it. Go to the following site, scroll down to Norton AntiVirus 2008 - 15 day Trial, click Try Now. Once installed, that can be set to scan hidden and/or compressed files. Now, run a scan with that.

http://shop.symantecstore.com/store/symnahho/en_US/ContentTheme/ThemeID.106300/p

Let me know what it finds, if t finds anything. Has anyone you sent the virus to let you now what their AV programs said it was, what kind of virus? If yes, what? Usually when an AV program stops a virus, the user is alerted that say for example the "ABC.EXE virus has been quarantined".

Later,
Lorry