i have formated three system last night and this ******* virus come again from network. i cant format all the 16 system at oe time (cyber) so please give me one virus removal tool. virus name is Win32:VB-CD [Wrm].
2006-10-03 01:11:52 · 8 answers · asked by nadeem_sayed 2 in Computers & Internet ➔ Software
Go to the symantec website, they should have a free download or instructions on how to remove it.
2006-10-03 01:19:53 · answer #1 · answered by Anonymous · 0⤊ 0⤋
Win32:VB-CD alias Kamasutra
The worm Win32:VB-CD [Wrm] or Win32:VB-CD2 [Wrm] is a mail worm known also as Nyxem-E, Blackmal-F, MyWife-D or Grew or (perhaps locally and usually in news) as Kamasutra.
This worm spreads by e-mail and by network shares. It kills processes of miscelaneous antivirus and security programs and deletes files of them. The worm is destructive, tries to delete files of certain types every 3-rd day in month.
When executed, the worm creates one of the listed files:
* %windows%\Rundll16.exe
* %system%\New winzip file.exe
* %system%\sample.zip
* %system%\winzip_tmp.exe
and files:
* %system%\scanregw.exe
* %system%\update.exe
* %system%\sample.zip
* %system%\winzip.exe
The worm is autostarted with Windows using the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Its item „ScanRegistry” has the value “%System%\scanregw.exe /scan”
The worm collects mail addresses from documents on the infected computer. The infected mail has one of the Subjects:
*Hot Movie*
A Great Video
Arab sex DSC-00465.jpg
eBook.pdf
****** Kama Sutra pics
Fw:
Fw: DSC-00465.jpg
Fw: Funny :)
Fw: Picturs
Fw: Sexy
Fwd: image.jpg
Fwd: Photo
give me a kiss
Miss Lebanon 2006
My photos
Part 1 of 6 Video clipe
Re:
Re: Sex Video
School girl fantasies gone bad
The Best Videoclip Ever
the file
Word file
You Must View This Videoclip!
The infected attachment is in the file named
007.pif
04.pif
677.pif
document.pif
DSC-00465.Pif
eBook.PIF
image04.pif
New_Document_file.pif
photo.pif
School.pif
Sometimes, the attachment is MIME encoded and uses one of the names
3.92315089702606E02.UUE
Attachments00.HQX
Attachments001.BHX
Attachments[001].B64
eBook.Uu
Original Message.B64
SeX.mim
Sex.mim
Video_part.mim
WinZip.BHX
Word_Document.hqx
Word_Document.uu
In such case, special tool is needed to unpack and execute the worm.
On every 3-rd day of month, the worm tries to delete data files with the extensions *.dmp, *.doc, *.mdb, *.mde, *.pdf, *.pps, *.ppt, *.psd, *.rar, *.xls, *.zip
Avast! with VPS file dated on or after 17th January 2006 is able to detect this worm.
Download the Avast Anti-Virus from http://www.avast.com
All the best.
Cheers
2006-10-03 01:21:34 · answer #2 · answered by Anonymous · 0⤊ 0⤋
Bit Defender or AVG Anti Virus. They are Free software to get from the internet.
2006-10-03 01:20:24 · answer #3 · answered by William Wilson 3 · 0⤊ 0⤋
Type the virus name in the Yahoo search bar and it should find removal tools for you.
2006-10-03 01:15:02 · answer #4 · answered by pappy 6 · 0⤊ 0⤋
If you can get on the internet go to http://www.trendmicro.com click where it says free virus scan and this will also remove it for free. It really will do it for free.
Admin
http://www.entertheconference.com
2006-10-05 15:27:10 · answer #5 · answered by Anonymous · 0⤊ 0⤋
download Avast, it searches in boot mode, and for some reason detects and removes everything.I tried every free virus removal program and none could remove it exept avast.Theres a free version and a pay for.get it from here--
http://www.avast.com/eng/programs.html
2006-10-03 01:25:09 · answer #6 · answered by Ron~N 5 · 0⤊ 0⤋
Search on symantec.com
2006-10-03 01:19:29 · answer #7 · answered by hackaback 2 · 0⤊ 0⤋
try filehippo.com or download.com
2006-10-03 01:19:33 · answer #8 · answered by jigvesh b 2 · 0⤊ 0⤋