One scary virus ate up computer. - Page 2

sheriff · 05-19-2002, 03:09 PM

Thanks guys for all the replys. Here's full story. When he brought me the box it wouldnt get on internet, finally determined that the isp had shut his account off. I have a small 9 box inhouse network
using linux smoothwall on one old box to act as gateway, firewall and inhouse router, any way I knew that winders virus wouldnt bother it, so I turned all my boxes off except smoothwall box set the client box up to use lan to ac ess internet and away we go. Yes I use inhouse (or tried to) this box is so hosed up. To ans number I didnt review all the files that pccillin found. It reported 124 infected files (mainly appeared to be exe type files) there
were 4 different worms reported being found. Inhouse didnt find any of them. I had a 2001 copy of norton tried loading that on the box, took several tries, but then it wouldnt run after being loaded. Finally as said before hooked to one of my win2kpro boxes that I had just updated the virus file on, it is the one that found all the worms which was bout 3am this morn, during all this time the box has to be rebooted if you looked at it bad. It is a Compaq presario 5151 with 96meg ram and a quantum hdd win 98se as the os. I even thought heat was getting to cpu and and causing the crashes. Any way taking everything into account I called him back and told him to come and get it. I think that a low level format is the only way to cure this booger, mainly because of all the problems I think is there that I didnt see. Thanks for your suggestions.

Bopper · 05-20-2002, 05:26 PM

124 viruses????? how can anyone acrue that many viruses on ones system unless you are a complete idiot. It is either that, or
he pissed someone off, and they hacked his system. that is unreal...

<edit>

oops. I do this all the time... 124 infested FILES... now I get it... sorry...

sharder8 · 05-26-2002, 12:21 AM

A little update --

I just finished cleaning another HP, that KLEZ destroyed up-to-date Norton on and then went about it's work.

That little sucker got into the C:\_Restore Folders, *.CAB's, and *.CPY's!

The only way to clean them was by deleting them in DOS manually, one at a time! I can say I'm REALLY getting tired of this thing! The customer gets her newly cleaned computer home and the first thing she does it to check her e-mail in Outlook Express. BAM!! PC-cillin 2002 goes nuts! It caught 5 infected e-mails in a row before she could lock down the e-mail! The machine was out of the shop for a grand total of 1 hour before she brings it back to make sure KLEZ didn't re-infect. Rescanned and everything was clean! '

'

The only positive thing I can say is "another one successfully cleaned"!

Harder

sheriff · 05-26-2002, 07:18 AM

I gave that comp back. Yesterday he told me it isnt turned on, that he set up a older one and using it. If he operates it the same way he did the infected one, it wont last long either. I dont know if the ISP has let him back on yet. I use smoothwall as a in-house router, firwall and internet connection point. I turned off all my machines except smoothwall, stuck a network card in his and was able to get on the internet. Tried to used the online virus checker, it didnt report anything. Put one of my win2k machines on network with infected box, thats when pccillin found all the junk, but pccillin wopuldnt delete anything. By then I had spent 3 days working on that thing ( it crashed a lot). Taking into consideration what the virus checker found and didnt find, thats when I quit. hehehehe

Underclocked · 05-26-2002, 07:25 AM

sharder8, what would a shop charge for doing work like you did in cleaning that virus infected machine?
Thanks.

sheriff · 05-26-2002, 07:43 AM

I dont know. It was a old compaq prersario, using a k6 processor without a fan on the heatsink, only fan in it was in the psu. The machine probably not worth $100. I figure I stopped with $200 + labor (didnt charge him anything because I didnt fix it). Way they operate computers, the old one is probably infected now.

disciple · 05-26-2002, 08:59 AM

That virus is a big drag at work our oarts manager's computer had 10 emails with this virus which were genertated form a parts warehouse who had at least 20 machines infected. we had just installed a enterprise edition of etrust innoculate it it caught them right away very fortunate to have installed this antivirus or we would have had major problems.

sharder8 · 05-26-2002, 11:07 AM

Quote:

what would a shop charge for doing work like you did in cleaning that virus infected machine?

Our shop charges $69.99 for this. (I get $7 plus my hourly wage.) I usually only need 1-2 hours of actual time on the machine, so the shop makes money. For an fdisk/format and load of OS, we also charge $69.99.

Harder