Re: sysconf.exe

Tech-Archive recommends: Fix windows errors by optimizing your registry

anonymous_at_discussions.microsoft.com
Date: 02/03/04


Date: Mon, 2 Feb 2004 16:53:09 -0800

Hi, thanks for the advice. Sorry, even I know I should
have mentioned that I'm running XP Home. (On a Sony Vaio
Laptop!) It's a kw(?)bot worm from Kazaa apparently
(which I've stopped using as of yesterday.) I'm using
McAfee Virus Scan Home Edition. Wonders if viruses on
Kazaa are the revenge of The Industry...

>-----Original Message-----
>It would REALLY help if you told us the NAME of the
virus, the anti virus application and
>the OS. I have to "assume" you have WinXP.
>
>1) Disable System Restore
>
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.ht
m
>2) Reboot your PC into Safe Mode
>3) Using your AV software, perform a Full Scan of
your platform and clean/delete any
> infectors found
>4) Restart your PC and perform a "final" Full Scan
of your platform
>5) Re-enable System Restore and re-apply any System
Restore preferences,
> (e.g. HD space to use suggested 200 ~ 400MB),
reboot PC.
>6) Create a new Restore point
>7) Please report back your results
>
>In addition:
>If you post to UseNet with your TRUE, not a munged,
email address then you have invited the
>Swen Internet worm [aka; W32/Gibe-F] to visit you.
>
>The Swen is news spelled backwards. The reason it is
called this is because the Swen worm
>harvests email addresses from UseNet News Groups. It
has an engine that allows it to post
>itself to UseNet News Groups as well as it has its own
email engine. From the list of
>email addresses that it has harvested, it will then
email itself to those addresses.
>
>Dave
>
>
>
><the_wanderer@manx.net> wrote in message
news:8bff01c3e9dd$47daed40$a001280a@phx.gbl...
>| My virus protection says the sysconf.exe file in my
>| Windows/system32/ file is infected with a Trojan, and
>| that I must remove the file and replace it with a clean
>| copy. What is this file? How serious is this? And how
do
>| I get a clean copy of sysconf.exe in the first place?
>| I use computers for the net and word processing, I'm
not
>| an IT student so please can someone help me...
>
>
>.
>



Relevant Pages

  • Re: I ran the exe file !!!!
    ... point before the virus infection. ... For the moment you should simply stick with MS windows Updates. ... What You Should Know About the Swen Worm ... you have Windows ME or Windows XP, you could run the System Restore ...
    (microsoft.public.security.virus)
  • Disable and Enable Restore in Windows Xp after virus/worm infection
    ... When someone is infected with a worm or virus. ... Afterwards it is recommended that you disable restore ... will become useless even before the infection since ...
    (microsoft.public.windowsxp.general)
  • Re: 1 week of searching FAQ for the answer to these two questions
    ... | question in their section on Outlook and virus risk. ... | worm, trojan) ... itself to UseNet News Groups as well as it has its own email engine. ...
    (microsoft.public.scripting.virus.discussion)
  • Re: 1 week of searching FAQ for the answer to these two questions
    ... attachement if not patched so I can learn HOW THis happens. ... >| question in their section on Outlook and virus risk. ... >| worm, trojan) ... >harvests email addresses from UseNet News Groups. ...
    (microsoft.public.scripting.virus.discussion)
  • Re: readme.eml
    ... the worm attempts to write base64-encoded copies of itself to all folders on ... itself to UseNet News Groups and well as it has its own email engine. ... | acording to MS is the result of a virus called ...
    (microsoft.public.security.virus)