There's this really weird virus attacking my new W2K installation oh my!?

Question

If you're not a techie - PLEASE don't bother - - - this ones' a dousy (please don't tell me to go see a screwup nosebleed at bestbuy or the likes!)

- Maxtor HD FULL LLF (maxtor disk checked for virii)
- Fresh Win2k disk (cracked it outta the cellophane)
- SP4 installed from CD (checked for virii)
- IE6 SP1 installed from CD (checked for virii)
- Internet set up (PPPoE)
- Connect directly to windowsupdate and update to latest
- Sysworks installed (factory disk) and latest virius updates done online
- GOT A VIRUS on first check (W32.Spybot.Worm) - - -checked and removed... HOW??? I don't know.
- Connect computer to domain.
- When at logon screen, admin shares (IPC$, ADMIN$, C$, D$) work fine. As soon as I logon to ANY profile (roaming profiles on NT4 server), after about 20 seconds ALL the admin shares disappear.

I have a feeling it's a residual of the spybot worm but how did it get there in the first place?

You'll have my eternal gratitude if you figure it out! Thanks!

I think I asked for non-techs to abstain ... that first answer showed ignorance if nothing else! Sysworks is SYMANTEC Systemworks as in SYMANTEC NORTON ANTIVIRUS plus extras. Puhleeze!!!!!!

I even tried stopping and starting the SERVER service in the services.msc console - it lasts less than a minute before all the shares disappear again!

Answer 1

Answer: you don't have a good firewall. Windows firewall is good, but not the best.

Solution: Get the Zone Alarm free firewall. Install Spybot Search & Destroy and Ad-Aware (pretty sure you already did that). :) Check the network for viruses. After installations, use Trendmicro Housecall online scan for a thorough check (free)

Good luck.

Answer 2

Tough one.

Have you thought about connecting to the administrative share without loggin in and scan the HD from a remote computer?

You may have to get a bootable disk and scan the HD that way. The best way to do this is :
http://www.ubcd4win.com/index.htm

This is free but since you have technical knowledge it shouldn't be a problem for you.

Answer 3

I am assuming that your software is genuine Micro$oft from a reputable vendor.
Sysworks? Who's that from? I have seen funny stuff on a DSL vendor's CD, trust no one.

Could the NT4 server be closing the shares? Could be a policy decision.

Answer 4

ok for one open up the pocket book and go buy norton anti virus and then delete cookies. those can be found in the internet option.

(norton can be found at computer stores or target. dont forget about norton ive update...it will be in the manual)