Apolyton Civilization Forums > Miscellaneous > Archive > Off-Topic-Archive > Bollocks. I've been hit by the love.scr virus

Apolyton Archive | Preserved copy of the Apolyton Civilization Site and its forums as they stood in September 2005. Read-only; nothing here can be posted to or replied to. | Forum index | About this archive | The 1998–2001 UBB forums

Today on Apolyton

WARDELL INTERVIEW PROMO

A.C.S. HISTORY CHAPTER 4

GET CIV4 /w FREE PLUS!

A.C.S. PHOTO GALLERY

GET A.O.M. V1.1

main| civ2| civ3| civ4| smac| ctp2| ron| moo3| galciv| galciv2| alt| about|

Apolyton Civilization Forums : Powered by vBulletin version 2.0.3

Apolyton Civilization Forums > Miscellaneous > Archive > Off-Topic-Archive > Bollocks. I've been hit by the love.scr virus

Show a Printable Version |

Email This Page to Someone! |

Receive updates to this thread |

Report this to Apolyton news!

bottom of page

Author

Thread

< Last Thread Next Thread >

zulu9812

King

of Scotland
Jan 2002
time: 05:24

30-12-2002 18:18

Bollocks. I've been hit by the love.scr virus

Suffering from ads?

I'm in ugent need of help here. Right, I stupidly downloaded an attachment from an email and it turned out to be a virus (I really should've known). It went though 2 virus scans from seperate programs as well as an auto-protect, but it still got through. Now, I'm running Windows 2000 SP3 and the virus created 3 .exes in C:\WINNT\System32 - nav32_loader.exe, tcpsvs32.exe and WinServices.exe. The icons for each of these files is a blue love heart.

nav32_loader.exe shut down Norton Antivirus 2002 and is preventing it from loading again.

tcpsvs32.exe keeps trying to access the internet but has so far been blocked by my firewall (Zone Alarm Pro).

Both these files can be deleted, but are immediately spawned again by WinServices.exe. WinServices.exe cannot be deleted. I went into Properties and set all permissions to Deny and deselected the "Allow inheritable permissions from parent to propagate to this object". I still couldn't delete it, but I hoped that this would stop it spawning those two other files. However, once I'd done that, any file with a .exe extension wasn't allowed to run (something to do with not being able to locate the file or the correct library). So I gave the permissons back and ticked that box. And lo and behold the other two files spawned again.

As you can see, I'm in somewhat of a pickle and would really appreciate some help.

Kropotkin

Emperor

of Ålidhem
Mar 1999
time: 06:24

30-12-2002 18:36

Get a bigger avatar today!

Del C:

FrustratedPoet

Emperor

All Glory To The Hypnotoad!
Mar 2002
time: 05:24

30-12-2002 19:13

Got spare money?

quote:
Originally posted by Kropotkin
Del C:

format c: might be more useful

Mercator

King

Sorekara no Nanimo
Jan 1970
time: 06:24

30-12-2002 19:31

Support Apolyton, buy Alpha Centauri

Let's see...

1. Ctrl-Alt-Del, and close all programs from the list except explorer.

2. Locate regedit.exe (or regedt32.exe), and rename it to whatever it was + ".com" (not entirely sure if that's completely necessary, but that'll prevent the virus from running when you start up this registry editor in a moment)...

3. Run this regedit. Browse to HKEY_CLASSES_ROOT\.exe and look at what the (Default) value says. Then go to HKEY_CLASSES_ROOT\(the value you just found)\shell\open\command
That likely has weird stuff in it. Change the default value to

code:
"%1" %*

. That restores the normal working of executing .exe files.

4. Exit and restore the regedit file to its former name.

5. Run your virusscanner (it should work now). If that can locate and destroy all traces of the virus, you're done, otherwise continue... In any case, the next step is wise to verify.

6. Start up msconfig.exe and untick any suspicious items mentioned in the startup tab.

7. Restart the computer in DOS mode and remove (or rename, just in case you remove the wrong files, or the virus overwrote a good file... Files can't just execute themselves so that should be OK) the evil file(s).

8. type in "win" to start windows again.

It *should* now be removed, although probably not entirely and properly (since I'm not familiar with this virus in particular). Run your virusscanner to remove anything remaining (preferably also in DOS mode) and search their website a bit to find more info on this.

Bereta_Eder

Prince

Oct 2000
time: 07:24

30-12-2002 20:10

Browse Apolyton AD-FREE

Bollocks, indeed.

zulu9812

King

of Scotland
Jan 2002
time: 05:24

30-12-2002 20:35

Support Apolyton or Terrorists Win

quote:
Originally posted by Mercator
1. Ctrl-Alt-Del, and close all programs from the list except explorer.

The Task Manager screen appears and then vanishes. This is probably the doing of WinServices.exe.

quote:
3. Run this regedit. Browse to HKEY_CLASSES_ROOT\.exe and look at what the (Default) value says.

Dunno how to find the Default value, but the window on the right hand side says (when I click on HKEY_CLASSES_ROOT on Local Machine\.exe):

code:< No Name >: REG_SZ : exe file
Content Type: REG_SZ : application/x-msdownload
ZAMailSafeExt: REG_SZ : z19

quote:
Then go to HKEY_CLASSES_ROOT\(the value you just found)\shell\open\command

Don't know how to find shell\open\command

King

MACEDONIA - It's the name of the sovereign country to the north of Greece
Apr 2000
time: 07:24

30-12-2002 20:45

Support Apolyton, buy Civilization 2

download an unknown anti virus software.

AVG 6.0 is a great anti-virus, annd you can get it on the company's webpage for free.

www.grisoft.com

Amadan

Chieftain

Jun 2002
time: 23:24

30-12-2002 20:48

Increase Your PM Length

Try this Symantec link.

It should give you details for removal.

kittenOFchaos

Warlord

Halifax, Calderdale, England
May 2001
time: 05:24

30-12-2002 21:17

Support Apolyton or Terrorists Win

Remind me not to download from Zulu

zulu9812

King

of Scotland
Jan 2002
time: 05:24

30-12-2002 21:25

#10

Get a bigger avatar today!

quote:
Originally posted by Amadan
Try this Symantec link.

It should give you details for removal.

I actually found that, there's just one problem. When navigating in regedit to HKEY_LOCAL_MACHINE\Software\Classes\exefile there is no DefaultIcon, no Shell, no Command. All I get by expanding .exe is PersistantHandler.

Kropotkin

Emperor

of Ålidhem
Mar 1999
time: 06:24

30-12-2002 21:26

#11

Full PM-box? Change here!

quote:
Originally posted by FrustratedPoet
format c: might be more useful

No mr besserwisser, I was thinking more in the line of burning the disk in the backyard at midnight...

Mercator

King

Sorekara no Nanimo
Jan 1970
time: 06:24

30-12-2002 22:00

#12

Support Apolyton buy from Amazon

quote:
Originally posted by zulu9812

I actually found that, there's just one problem. When navigating in regedit to HKEY_LOCAL_MACHINE\Software\Classes\exefile there is no DefaultIcon, no Shell, no Command. All I get by expanding .exe is PersistantHandler.

You said this earlier:

code:
< No Name >: REG_SZ : exe file

This was that default value I was talking about... Was the space between exe and file a typo? If not, look under "exe file" instead.

quote:
Don't know how to find shell\open\command

Go to HKEY_CLASSES_ROOT\exefile\shell\open\command (with or without the space between exe and file, whichever value it is in that unnamed key)

(HKEY_CLASSES_ROOT, by the way is just a "shortcut" to HKEY_LOCAL_MACHINE\Software\Classes\)

If those shell\... etc. values aren't there as you described, create them (right-click on the folder you want the new folder to become a child of).

For DefaultIcon the unnamed key should have value %1.
shell should have a subfolder open and that should have the subfolder command. The unnamed key of command should be "%1" %*.

What do the contents of this "PersistantHandler" say? If the contents refer to the virus file, delete the key.

Dis

Emperor

Las Vegas, Nevada
Feb 2000
time: 21:24

30-12-2002 23:05

#13

Remove this text

That's almost as dumb as me accidently downloading Xupiter from Apolyton advertisement.

zulu9812

King

of Scotland
Jan 2002
time: 05:24

31-12-2002 00:07

#14

Increase the size of your Attachments

Just to let everyone know, I fixed the problem.

Azazel, I installed AVG6. Then when I rebooted I couldn't open any .exe file, probably because the virus was using the to piggyback it's way into operation and the antivirus software was preventing that. Unfortunately, that meant AVG6 couldn't run either! I only managed to get Windows Explorer to run by using the command line. However, I was able to use AVG to scan for viruses by Start > Search > Viruses (a new feature put in by AVG6) which then 'healed' the viruses. I then applied a registry fix I found on the net and now everything is back to normal

So, thanks for your help everybody

King

MACEDONIA - It's the name of the sovereign country to the north of Greece
Apr 2000
time: 07:24

31-12-2002 01:50

#15

Got spare money?

cool

(I've just noticed this addition in the 'Find' tree myself. good instincts, Zulu )

< Last Thread Next Thread >

All times are GMT. The time now is 05:24.
Apolyton Time is 00:24.

top of page

Rate This Thread:

archivepost

Forum Jump:

Forum Rules:

You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

HTML code is ON
vB code is ON
Smilies are ON
[IMG] code is ON

Contact Us - Apolyton Civilization Site - Support Us!

Building a better Apolyton through better information. Click here and take our poll!
Non-US visitors, click here!

Powered by: vBulletin Version 2.0.3
Copyright ©2000, 2001, Jelsoft Enterprises Limited.