There's this really weird virus attacking my new W2K installation oh my!?
Question:
- Maxtor HD FULL LLF (maxtor disk checked for virii)
- Fresh Win2k disk (cracked it outta the cellophane)
- SP4 installed from CD (checked for virii)
- IE6 SP1 installed from CD (checked for virii)
- Internet set up (PPPoE)
- Connect directly to windowsupdate and update to latest
- Sysworks installed (factory disk) and latest virius updates done online
- GOT A VIRUS on first check (W32.Spybot.Worm) - - -checked and removed... HOW? I don't know.
- Connect computer to domain.
- When at logon screen, admin shares (IPC$, ADMIN$, C$, D$) work fine. As soon as I logon to ANY profile (roaming profiles on NT4 server), after about 20 seconds ALL the admin shares disappear.
I have a feeling it's a residual of the spybot worm but how did it get there in the first place?
You'll have my eternal gratitude if you figure it out! Thanks!
Answer:
Answer: you don't have a good firewall. Windows firewall is good, but not the best.
Solution: Get the Zone Alarm free firewall. Install Spybot Search & Destroy and Ad-Aware (pretty sure you already did that). :) Check the network for viruses. After installations, use Trendmicro Housecall online scan for a thorough check (free)
Good luck.
ok for one open up the pocket book and go buy norton anti virus and then delete cookies. those can be found in the internet option.
(norton can be found at computer stores or target. dont forget about norton ive update...it will be in the manual)
Tough one.
Have you thought about connecting to the administrative share without loggin in and scan the HD from a remote computer?
You may have to get a bootable disk and scan the HD that way. The best way to do this is :
http://www.ubcd4win.com/index.htm...
This is free but since you have technical knowledge it shouldn't be a problem for you.
I am assuming that your software is genuine Micro$oft from a reputable vendor.
Sysworks? Who's that from? I have seen funny stuff on a DSL vendor's CD, trust no one.
Could the NT4 server be closing the shares? Could be a policy decision.
More Questions & Answers...