A Virus question for everyone!

[noresull]

Hey guys, just got done fixing my parents computer. It had an optical illusion, (The best way I can think to describe it), that took up about 3/4 of the screen and was always on top. I checked startup in System Configuration and found a file named Ejlkejlk.exe set to run on start-up. I disabled it, everything was normal and found the file, Hidden in C:/WINDOWS/system.

I was curious if anyones heard of this and if so, who is it from why and if there is anything else I need to fix.

Thanks in advance!
John

[Dave_H]

I'm sorry John, that was rather stupid of me. That Symantec article gives some good info about the virus but doesn't give any info on manually removing the virus.
I'll dig around a little, I could have sworn I have seen an article with step by step instructions.
Dave

Edit-
Here you go. http://www.claymania.com/hybris-removal.html http://securityportal.com/articles/hybrisremoval20010129.html
-edit

[This message has been edited by Dave_H (edited 02-09-2001).]

[randy48]

Here's a link to the Symantec virus removal tool page...plenty of much needed items here: http://www.symantec.com/avcenter/

It's a good idea to book mark this one, not only for yourself, but being a geek, everyone and they're brother will be asking how to clean up their machines!

And if it's the W95 Hybris, this is what you need:
http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html

[Dave_H]

Did it look like a big spiral?
There is a picture of this at the bottom of this page. http://www.sophos.com/virusinfo/analyses/w32hybrisc.html
If thats it then there are some good instructions here. http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.Plugin.html
Dave

[noresull]

That's the one! I will read through all of those and get it totally cleaned up!

But how would I go about fixing this with out Norton? My parents don't have any anti-virus software, and thus this is why they got the virus!

I will tell them to get some protection, but what do I do for now?

Thanks Dave!

[This message has been edited by noresull (edited 02-09-2001).]

[randy48]

Get InoculateIT Personal version ** FREE ** it works pretty good and is update-able.
http://download.cnet.com/downloads/0-10093-100-4278606.html?tag=st.dl.10001-103-1.lst-7-7.4278606

[noresull]

Hey Dave, that's not stupid! http://sysopt.earthweb.com/forum/smile.gif I appreciate all the help, it is exactly the problem and I found out my Sister got the E-Mail they talk about! I have also received the same e-mail just today!

Again, Thanks everyone!