Warning - PC Virus

[Jodee]

Carrie/Justine/Rachel/everyone, you may or may not be aware of a pc virus that is doing the rounds. I am mentioning it here as my problem seems to have started when I received what I thought was a reply to an old email I sent to the Mumsnet team, with an attachment. I tried to click on the attachment to open it and it was blank. So if you get an odd email, which may appear to come from a friendly source, starting 'Re: XXXX' with an attachment, DO NOT open it, delete straight away. The virus then sends similar emails to everyone in your addressbook.
My DH has been attempting since yesterday night to sort this problem and we are still working on it.

I have just downloaded the anti-virus package from grisoft but cannot download it, it says that it has been changed or updated since I last downloaded it and I need to download it again! I checked through my machine and had the kernel32.exe which I have deleted. If I just change my passwords will that be enough as I don't have any sensitive info on my computer and no-one in my address book seems to have been affected. Also I do have the McAfee virus checker and that didn't pick anything up.

What should I do now?

Lizzer, don't beat yourself up too much, I fell for it too!
I would strongly recommend you go out and buy the Norton AntiVirus 2002, (about 40 quid, unfortunately) then you can click on the live updates link to download the software to remove the virus and you will also be protecting your machine from any further viruses. Going to the symantec.com website may help, but it doesn't appear to have this latest virus (w32.badtrans.b) in their removal tools list.

Steven I'm not really worried about this virus since my virus checker is detecting it (another one today). But how much of a problem is it really if you don't use your computer for any financial transactions? If it stole my mumsnet/other similar passwords it wouldn't really bother me all that much! Does it send itself out each time you switch on?

Wendym, please try to 'kill' it, otherwise it will replicate and send itself to loads of other people.

I recommend Norton, its the MMR of virus checkers.

Enid I have Norton Utilities, update every week, delete every detected virus immediately and have scanned my computer to make sure its clean. However I know several people who don't have good virus protection. What I want to know is if it wipes hard discs or simply steals passwords so I know what to tell them.

Ok I have been researching away as I'll be damned if some snivelling little good for nothing with no life is going to infect my computer with such rubbish and I'm not feeling sorry for myself anymore! The instructions Jodee gave for removing kernel32.exe are great but there are also more to look out for that need removing apparently as they are part of the virus.They are called kdll.dll, and cp_25389.nls. So I'm cutting and pasting wonderfully easy to follow instructions from a bloke called Rob on an AOL virus help message board (bless him!)Okay,

n Windows 98 systems, click START > Shutdown > Restart in DOS mode.

When the C:\WINDOWS> prompt appears, type in the following command and press the ENTER key:

CD SYSTEM

The prompt should now change to C:\WINDOWS\SYSTEM>

If your startup prompt is just C:> and not C:\WINDOWS>, use this command instead:

CD C:\WINDOWS\SYSTEM

Once at the C:\WINDOWS\SYSTEM> prompt, type the following commands, pressing the ENTER key after each one:

DEL KERNEL32.EXE

DEL KDLL.DLL

Providing you see no errors, then the files should be removed. Type in EXIT and press the ENTER key to re-start the PC in Windows.

The CP_25389.NLS file can be deleted in Windows Explorer like any other file.

Thought I'd share this info I found with you as everyone has helped me so much. I have downloaded some protection software from grisoft but the blighters haven't yet sent me the code I need to run it and I'm currently checking my pc for any nasties with symantec. Good luck to everyone else...

Lizzer - aol's Rob is brilliant. He's the one who tells everyone to download grisoft, isn't he?

Hey sorry to change the seriousness of this thread but where on god's earth did that grinning face come from??? I don't know how I did it! I'm gonna try hard to work it out...

Ah-ha - Colon then a capital 'o', see something good always comes out of bad!

Tinker, 1st time I'd be there so I wouldn't know but he seems like a truly wonderful being to me! (sorry I'm gonna be using mt new toy til everyone's sooo bored of it, he he!)

Incidently just finished checking with symantec and I have two files infected with Badtrans. Looks like you have to remove kernel32.exe and kdll.dll via MS-DOS as it is still on my system after trying the windows route (Jodee, hope you can do this too). Can't quite believe my home education lesson today - I was a real pc virus thicky-pants til now!

As we speak I'm downloading Norton 2002!

Thanks Lizzer - did a check using the route you posted and a doublecheck with the Norton, and looks like I'm clear now, hurrah!

Phew, me too Jodee! I'm feeling a little smug now. Its really nice when you've solved a problem even with lots of help, I feel I've learned something this week! Thanks again everyone...

As my Brother said when I told him that I'd sorted it (actually I think he was in shock!) 'prevention is better than cure', and I'm sure I've learnt that lesson from all this, indeedy

Thanks to everyone here I have now cleared the virus on my pc and have just checked with Symantec and am clear. Have just signed up for their free anti-virus trial.

Lizzer - did you have any luck with www.grisoft.com? I wasted 2 hours trying to download their anti-virus software only to be told each time that I couldn't run it. Anyway, alls well that ends well!

Just a little tip - (not from me but dh!) - a way to help prevent a virus infecting your addressbook is to do the following:

Click on new contact; in the 'First' box enter
"!0000" [i.e type in the speechmarks, exclamation mark, four zeros, type in speechmarks]

This will automatically position itself at the top of your addressbook. Most viruses work their way through an addressbook from the top and this will stop the virus recognising a valid email address to infest. There are some viruses that pick up email addresses at random, but most start from the top.

thanks Jodee's dh, v useful tip!

message withdrawn

Lisav, yes I've finally been sent the code I need to install gri-soft (it said a few minutes, actually took 3 days!) so I'll let you know how it goes...

Thanks for tip Jodee...

Another new virus around - Goner. Haven't had this one yet but I've just run live update for Norton and been told there aren't any updates. Yet their site says there is - I'm confused but will run the Live update daily for a while. Don't open any e-mails just saying hi as that's what this one says.

Wendym, maybe you've got Automatic Live Update selected - I just noticed mine quietly updating itself so hopefully that was the 'goner' basher.

Hi Lisav, just a quickie to let you know that grisoft is running fine on my computer, it seems really comprehensive and you can update whenever you want - they recommend once a month. I wonder what went wrong with yours, have you fixed it yet?

Hi Lizzer - thanks for that, I never did get round to installing Grisoft, I don't know what went wrong there, but I am downloading the Norton Anti-Virus one for a free trial period, that's really good as you can pause and save the download so you can come back to it at a later time.

There's a new virus reported in the papers, a really nasty one that deletes files on your hard drive. It's from somone you know headed 'hi' and the message is friendly, telling you to download a great screen saver they have found for you, as soon as you double click on the attachment you are infected and it sends it on to everyone in your address book. So watch out for that. The papers reckon everyone will have seen the email sooner or later - I haven't, has anyone else?

Oh Lizzer - I forgot this but I quite like myself, I wonder if you can get a big mad unhappy face?

We had the "hi" one at my office on Wednesday - I came in to find the bloke who sits next to me running round like a headless chicken; he'd received the e-mail the previous evening and opened it. I could tell who else had been too curious for their own good by the e-mails I'd received - 45 in all before it was stopped. The poor bloke who'd originated it was mortified - he even had to phone a couple of clients (one a high street bank) and confess all, as they appear on the "clients" part of the firm's address book. Still, it's made me really careful about what attachments I open now.

Apolgies to non-footie fans, but I am a follower of those that kick a semi-inflated ball around a muddy field, and this made me laugh:

In case you are not already aware, be on the lookout for a new breed of 'Evil Manure' computer viruses that could seriously affect/infect your PC.
Virus name and what it does:

1. The Manchester United Virus - This where the computer develops a memory disorder and forgets about every thing before 1993.
2. The Manchester United shirt virus - This one is especially hard to detect as it changes its format every three months.
3. The David Beckham virus - This affects newer computers mainly. The computer looks great, all the lights are on, but nothing inside works.
4. The Roy Keane virus - Throws you out of Windows.
5. The Alex Ferguson virus - The computer develops a continuous whining noise. The on screen clock runs a lot slower than all the other computers in the building.
6. The Andy Cole virus - The computer is unable to get anything into the Inbox.
7. The Ryan Giggs virus - The computer develops a processor problem whereby it thinks it's better than it actually is. It also experiences dramatic fluctuations in performance.
8. The Fabien Barthez virus - You just can't save anything.

whoops! I meant 'apologies'