i have a virus but cant get rid of it

Discussion in 'Computer Support' started by Angel thoughts, Apr 5, 2004.

  1. Hi guys,
    I wonder if anyone can help me with this one? I am told by email servers
    that I am infected with Report: ranking.doc.scr contains
    Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility finds
    it but then internet explorer crashes with the message IEXPLORE caused an
    invalid page fault in
    module <unknown> at 0000:00b16c38.
    Registers:
    EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    Bytes at CS:EIP:
    I am running Win 98 SE and have interent explorer 6. I have done a search
    for the virus and cannot locate it. My windows are doing odd things too.
    Would it be possible to delete it another way, but I have to find it first.
    All help gratefully received.
    Karen
    Angel thoughts, Apr 5, 2004
    #1
    1. Advertising

  2. Angel thoughts

    Trent SC Guest

    > Hi guys,
    > I wonder if anyone can help me with this one? I am told by email servers
    > that I am infected with Report: ranking.doc.scr contains
    > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility

    finds
    > it but then internet explorer crashes with the message IEXPLORE caused an
    > invalid page fault in
    > module <unknown> at 0000:00b16c38.
    > Registers:
    > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > Bytes at CS:EIP:
    > I am running Win 98 SE and have interent explorer 6. I have done a search
    > for the virus and cannot locate it. My windows are doing odd things too.
    > Would it be possible to delete it another way, but I have to find it

    first.
    > All help gratefully received.


    Click on http://housecall.antivirus.com and run their online scan/cleanup
    Trent SC, Apr 5, 2004
    #2
    1. Advertising

  3. "Trent SC" <> wrote in message
    news:tAecc.30187$Y%9.net...
    > > Hi guys,
    > > I wonder if anyone can help me with this one? I am told by email servers
    > > that I am infected with Report: ranking.doc.scr contains
    > > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility

    > finds
    > > it but then internet explorer crashes with the message IEXPLORE caused

    an
    > > invalid page fault in
    > > module <unknown> at 0000:00b16c38.
    > > Registers:
    > > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > > Bytes at CS:EIP:
    > > I am running Win 98 SE and have interent explorer 6. I have done a

    search
    > > for the virus and cannot locate it. My windows are doing odd things too.
    > > Would it be possible to delete it another way, but I have to find it

    > first.
    > > All help gratefully received.

    >
    > Click on http://housecall.antivirus.com and run their online scan/cleanup

    That has not worked either. It only scanned 17000 files and my pc has a
    total of 32000. i ticked it to scan the whole pc. Any other ideas that i can
    try?
    Karen
    Angel thoughts, Apr 5, 2004
    #3
  4. Angel thoughts

    Trent SC Guest

    > > > Hi guys,
    > > > I wonder if anyone can help me with this one? I am told by email

    servers
    > > > that I am infected with Report: ranking.doc.scr contains
    > > > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility

    > > finds
    > > > it but then internet explorer crashes with the message IEXPLORE caused

    > an
    > > > invalid page fault in
    > > > module <unknown> at 0000:00b16c38.
    > > > Registers:
    > > > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > > > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > > > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > > > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > > > Bytes at CS:EIP:
    > > > I am running Win 98 SE and have interent explorer 6. I have done a

    > search
    > > > for the virus and cannot locate it. My windows are doing odd things

    too.
    > > > Would it be possible to delete it another way, but I have to find it

    > > first.
    > > > All help gratefully received.

    > >
    > > Click on http://housecall.antivirus.com and run their online

    scan/cleanup
    > That has not worked either. It only scanned 17000 files and my pc has a
    > total of 32000. i ticked it to scan the whole pc. Any other ideas that i

    can
    > try?
    > Karen


    OK, so AVG, Panda and Trend Micro all say you have no infection. Could it
    be that you're not infected? Many viruses send propagate by sending
    themselves to everyone in an address book, at the same time spoofing the
    address in the 'from' field, so it's quite possible that someone who has
    your email details in their address book is infected.
    Trent SC, Apr 5, 2004
    #4
  5. "Trent SC" <> wrote in message
    news:A6fcc.30197$Y%9.net...
    > > > > Hi guys,
    > > > > I wonder if anyone can help me with this one? I am told by email

    > servers
    > > > > that I am infected with Report: ranking.doc.scr contains
    > > > > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan

    utility
    > > > finds
    > > > > it but then internet explorer crashes with the message IEXPLORE

    caused
    > > an
    > > > > invalid page fault in
    > > > > module <unknown> at 0000:00b16c38.
    > > > > Registers:
    > > > > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > > > > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > > > > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > > > > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > > > > Bytes at CS:EIP:
    > > > > I am running Win 98 SE and have interent explorer 6. I have done a

    > > search
    > > > > for the virus and cannot locate it. My windows are doing odd things

    > too.
    > > > > Would it be possible to delete it another way, but I have to find it
    > > > first.
    > > > > All help gratefully received.
    > > >
    > > > Click on http://housecall.antivirus.com and run their online

    > scan/cleanup
    > > That has not worked either. It only scanned 17000 files and my pc has a
    > > total of 32000. i ticked it to scan the whole pc. Any other ideas that i

    > can
    > > try?
    > > Karen

    >
    > OK, so AVG, Panda and Trend Micro all say you have no infection. Could it
    > be that you're not infected? Many viruses send propagate by sending
    > themselves to everyone in an address book, at the same time spoofing the
    > address in the 'from' field, so it's quite possible that someone who has
    > your email details in their address book is infected.

    How can i be sure it is not a virus though. And why when pandas online scan
    finds it does IE crash? It actually detects this virus in my email folder
    then it dies. Not sure what to do next?
    Thanks for all your help Trent.
    >
    >
    Angel thoughts, Apr 5, 2004
    #5
  6. Angel thoughts

    °Mike° Guest

    "SomeFool.Gen" is another (generic) name for the NetSky worm.

    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/
    http://www.symantec.com/avcenter/venc/data/


    Do you have another browser you can use to troubleshoot?


    On Mon, 5 Apr 2004 15:57:23 +0100, in
    <zsecc.8$%o4.0@newsfe1-win>
    Angel thoughts scrawled:

    >Hi guys,
    >I wonder if anyone can help me with this one? I am told by email servers
    >that I am infected with Report: ranking.doc.scr contains
    >Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility finds
    >it but then internet explorer crashes with the message IEXPLORE caused an
    >invalid page fault in
    >module <unknown> at 0000:00b16c38.
    >Registers:


    <snip>

    >Bytes at CS:EIP:
    >I am running Win 98 SE and have interent explorer 6. I have done a search
    >for the virus and cannot locate it. My windows are doing odd things too.
    >Would it be possible to delete it another way, but I have to find it first.
    >All help gratefully received.
    >Karen
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Apr 5, 2004
    #6
  7. Angel thoughts

    °Mike° Guest

    On Mon, 5 Apr 2004 16:41:27 +0100, in
    <b6fcc.31$>
    Angel thoughts scrawled:

    <snip>

    >It actually detects this virus in my email folder then it dies.
    >Not sure what to do next? Thanks for all your help Trent.
    >>

    >


    Delete ALL emails from your inbox/outbox/sent items, except
    those that you absolutely need to keep. Then go to
    Tools / Options / Maintenance ... 'Clean up now'.
    Choose 'Delete' and then 'Compact'. Close O.E. (in fact, close
    EVERYTHING) and then run the virus scanner again.

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Apr 5, 2004
    #7
  8. Angel thoughts

    Trent SC Guest

    > > > > > Hi guys,
    > > > > > I wonder if anyone can help me with this one? I am told by email

    > > servers
    > > > > > that I am infected with Report: ranking.doc.scr contains
    > > > > > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan

    > utility
    > > > > finds
    > > > > > it but then internet explorer crashes with the message IEXPLORE

    > caused
    > > > an
    > > > > > invalid page fault in
    > > > > > module <unknown> at 0000:00b16c38.
    > > > > > Registers:
    > > > > > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > > > > > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > > > > > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > > > > > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > > > > > Bytes at CS:EIP:
    > > > > > I am running Win 98 SE and have interent explorer 6. I have done a
    > > > search
    > > > > > for the virus and cannot locate it. My windows are doing odd

    things
    > > too.
    > > > > > Would it be possible to delete it another way, but I have to find

    it
    > > > > first.
    > > > > > All help gratefully received.
    > > > >
    > > > > Click on http://housecall.antivirus.com and run their online

    > > scan/cleanup
    > > > That has not worked either. It only scanned 17000 files and my pc has

    a
    > > > total of 32000. i ticked it to scan the whole pc. Any other ideas that

    i
    > > can
    > > > try?
    > > > Karen

    > >
    > > OK, so AVG, Panda and Trend Micro all say you have no infection. Could

    it
    > > be that you're not infected? Many viruses send propagate by sending
    > > themselves to everyone in an address book, at the same time spoofing the
    > > address in the 'from' field, so it's quite possible that someone who has
    > > your email details in their address book is infected.


    > How can i be sure it is not a virus though. And why when pandas online

    scan
    > finds it does IE crash? It actually detects this virus in my email folder
    > then it dies. Not sure what to do next?
    > Thanks for all your help Trent.


    Let's go back one step and make sure that we're getting this right. Do you
    still have the email server report telling you that you have a virus? Which
    email server was it? Normally, it will tell you to whom you had tried to
    send an email. Did you send any emails to that person? If not, I go back
    to my earlier comment about whether it's actually your computer which is
    infected. And I take on board your comment about running Panda and seeing
    it crash IE mid-report, so have you tried the browser Mozilla or Opera?

    A couple of sites on a google search suggest that your virus might be
    travelling under the Netksy.B banner, so it might be worth doing a search
    for removal tools for that virus as well.
    Trent SC, Apr 5, 2004
    #8
  9. Angel thoughts

    Tommy Guest

    Angel thoughts wrote:
    > "Trent SC" <> wrote in message
    > news:A6fcc.30197$Y%9.net...
    >>>>> Hi guys,
    >>>>> I wonder if anyone can help me with this one? I am told by email
    >>>>> servers that I am infected with Report: ranking.doc.scr contains
    >>>>> Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan
    >>>>> utility finds it but then internet explorer crashes with the
    >>>>> message IEXPLORE caused an invalid page fault in
    >>>>> module <unknown> at 0000:00b16c38.
    >>>>> Registers:
    >>>>> EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    >>>>> EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    >>>>> ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    >>>>> EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    >>>>> Bytes at CS:EIP:
    >>>>> I am running Win 98 SE and have interent explorer 6. I have done
    >>>>> a search for the virus and cannot locate it. My windows are doing
    >>>>> odd things too. Would it be possible to delete it another way,
    >>>>> but I have to find it first. All help gratefully received.
    >>>>
    >>>> Click on http://housecall.antivirus.com and run their online

    >> scan/cleanup
    >>> That has not worked either. It only scanned 17000 files and my pc
    >>> has a total of 32000. i ticked it to scan the whole pc. Any other
    >>> ideas that i can try?
    >>> Karen

    >>
    >> OK, so AVG, Panda and Trend Micro all say you have no infection.
    >> Could it be that you're not infected? Many viruses send propagate
    >> by sending themselves to everyone in an address book, at the same
    >> time spoofing the address in the 'from' field, so it's quite
    >> possible that someone who has your email details in their address
    >> book is infected.

    > How can i be sure it is not a virus though. And why when pandas
    > online scan finds it does IE crash? It actually detects this virus in
    > my email folder then it dies. Not sure what to do next?
    > Thanks for all your help Trent.

    Internet Explorer crashing probably has nothing to do with the virus, and
    everything to do with a huge Temporary Internet File folder. In IE, go to
    tools/options/general/temporary internet files. Hit "delete files" and
    "delete cookies". This may take a few minutes if you haven't done it before,
    give it at least 10 min to finish if its a lot of stuff.

    Close IE, and restart the pc, then go back and run the housecall, or panda
    scans.

    I would set OE to not allow opening of dangerous attachments! In
    tools/options/security/virus protection. You should always do this. Upgrade
    to IE6 if you can't!

    Not much info available on Somefool, described in posts as bagle.j, and
    tricky.

    People that had it claimed that "housecall" got rid of it.
    --
    Tommy McClure
    tommyATlee9_2000(removethis)ATyahooATcom
    www.hal-pc.org/~toner27
    Tommy, Apr 5, 2004
    #9
  10. snip
    Ok, deleted ALL emails in all folders and I still have the same problem. I
    tried to scan only my email folders on Pandas activescan and it still
    crashes IE6. Same report. Tried repairing IE but with the same results.
    Tried Trend PC cillin and still no virus showing. Ok, I may have got rid of
    the virus but why is IE crashing on anti virus scan pages?
    Karen
    >
    Angel thoughts, Apr 5, 2004
    #10
  11. Angel thoughts

    Trent SC Guest

    > snip
    > Ok, deleted ALL emails in all folders and I still have the same problem. I
    > tried to scan only my email folders on Pandas activescan and it still
    > crashes IE6. Same report. Tried repairing IE but with the same results.
    > Tried Trend PC cillin and still no virus showing. Ok, I may have got rid

    of
    > the virus but why is IE crashing on anti virus scan pages?
    > Karen


    You may have deleted the original virus from your inbox, but the infection
    may well have spread to other parts of your hard drive. If you can,
    download and run Opera (www.opera.com or another cut-down, non-Microsoft
    browser like Mozilla and see if you can run Panda from there rather than
    from IE.
    Trent SC, Apr 5, 2004
    #11
  12. Angel thoughts

    Tommy Guest

    Angel thoughts wrote:
    > snip
    > Ok, deleted ALL emails in all folders and I still have the same
    > problem. I tried to scan only my email folders on Pandas activescan
    > and it still crashes IE6. Same report. Tried repairing IE but with
    > the same results. Tried Trend PC cillin and still no virus showing.
    > Ok, I may have got rid of the virus but why is IE crashing on anti
    > virus scan pages?
    > Karen


    You cleaned out OE, but not IE.'
    Read my post more carefully.
    Also, afterwards, see my website for more info on pc cleaning, antivirus and
    antispam stuff. If you do what I recommend, you could almost do without a
    virus checker. So much disinformation these days that keeps people from
    getting the right protection.

    Viruses are everywhere, they are much worse on universities and large
    networks where they do more damage, and net admins spend time and money on
    them. Its amazing, look at this link when you have
    time:http://project.mail.msu.edu/~rrdtool/malmail.html#virus

    --
    Tommy McClure
    tommyATlee9_2000(removethis)ATyahooATcom
    www.hal-pc.org/~toner27
    Tommy, Apr 5, 2004
    #12
  13. Angel thoughts

    reid decker Guest

    I hate to be repetitious, but go to help,click on System Restore, set a
    restore date back to when you didn't have the virus. It even helped me when
    I was getting kicked off my ISP.
    "Angel thoughts" <> wrote in message
    news:zsecc.8$%o4.0@newsfe1-win...
    > Hi guys,
    > I wonder if anyone can help me with this one? I am told by email servers
    > that I am infected with Report: ranking.doc.scr contains
    > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility

    finds
    > it but then internet explorer crashes with the message IEXPLORE caused an
    > invalid page fault in
    > module <unknown> at 0000:00b16c38.
    > Registers:
    > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > Bytes at CS:EIP:
    > I am running Win 98 SE and have interent explorer 6. I have done a search
    > for the virus and cannot locate it. My windows are doing odd things too.
    > Would it be possible to delete it another way, but I have to find it

    first.
    > All help gratefully received.
    > Karen
    >
    >
    reid decker, Apr 6, 2004
    #13
  14. Angel thoughts

    HB Guest

    "Angel thoughts" <> wrote in message
    > news:zsecc.8$%o4.0@newsfe1-win...
    > > Hi guys,
    > > I wonder if anyone can help me with this one? I am told by email servers
    > > that I am infected with Report: ranking.doc.scr contains
    > > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility

    > finds
    > > it but then internet explorer crashes with the message IEXPLORE caused

    an
    > > invalid page fault in
    > > module <unknown> at 0000:00b16c38.
    > > Registers:
    > > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > > Bytes at CS:EIP:
    > > I am running Win 98 SE and have interent explorer 6. I have done a

    search
    > > for the virus and cannot locate it. My windows are doing odd things too.
    > > Would it be possible to delete it another way, but I have to find it

    > first.
    > > All help gratefully received.
    > > Karen
    > >
    > >

    >

    http://housecall.trendmicro.com/housecall/start_corp.asp

    That may shift it
    HB, Apr 6, 2004
    #14
  15. Angel thoughts

    Trent SC Guest

    System Restore isn't a feature of Windows 98.

    > I hate to be repetitious, but go to help,click on System Restore, set

    a
    > restore date back to when you didn't have the virus. It even helped me

    when
    > I was getting kicked off my ISP.


    > > Hi guys,
    > > I wonder if anyone can help me with this one? I am told by email servers
    > > that I am infected with Report: ranking.doc.scr contains
    > > Worm.SomeFool.Gen-2. AVG cannot find it and Pandas online scan utility

    > finds
    > > it but then internet explorer crashes with the message IEXPLORE caused

    an
    > > invalid page fault in
    > > module <unknown> at 0000:00b16c38.
    > > Registers:
    > > EAX=04ece7d4 CS=0167 EIP=00b16c38 EFLGS=00010246
    > > EBX=04ece7d4 SS=016f ESP=04dd0038 EBP=04dd0058
    > > ECX=04dd00dc DS=016f ESI=81851b68 FS=5fdf
    > > EDX=bff76855 ES=016f EDI=04dd0104 GS=0000
    > > Bytes at CS:EIP:
    > > I am running Win 98 SE and have interent explorer 6. I have done a

    search
    > > for the virus and cannot locate it. My windows are doing odd things too.
    > > Would it be possible to delete it another way, but I have to find it

    > first.
    > > All help gratefully received.
    > > Karen
    Trent SC, Apr 6, 2004
    #15
  16. Angel thoughts

    VooDoo Guest

    reid decker wrote:

    > I hate to be repetitious, but go to help,click on System Restore, set a
    > restore date back to when you didn't have the virus. It even helped me when
    > I was getting kicked off my ISP.


    duhhhhhhhhhhhhhhhhh. My helmet's too tight mommy!
    VooDoo, Apr 6, 2004
    #16
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Alex©

    Cant get rid of RAID array/settings on 2 HDDS

    Alex©, Jul 27, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    2,262
    Thund3rstruck
    Jul 28, 2003
  2. frankg

    cant get rid of trojan.vundo

    frankg, Oct 9, 2005, in forum: Computer Support
    Replies:
    8
    Views:
    721
    ellis_jay
    Oct 14, 2005
  3. unclejesse01

    man i cant belive i cant get help please

    unclejesse01, Apr 9, 2005, in forum: DVD Video
    Replies:
    2
    Views:
    350
    Bill Vermillion
    Apr 14, 2005
  4. Adam Chapman
    Replies:
    7
    Views:
    994
  5. Andrei Sharko

    Cant get rid of fonts

    Andrei Sharko, Oct 9, 2004, in forum: NZ Computing
    Replies:
    0
    Views:
    273
    Andrei Sharko
    Oct 9, 2004
Loading...

Share This Page