stuff in startup

[Aenslaed]

Weird stuff is happening to my winME. This was also a bug that showed up with win98se before I changed to winME a few months ago.

In my startup menu, I get several files put into it by some unknown source. They are entitled network.vbs, network.exe, mscfg.vbs, mscfg.exe, and one other one which is a combination of both .vbs and .exe.

All the exes are hidden. I delete them and they reappear after a reboot typically. This started showing up as soon as I started running Sygate 4.0. I never got ths problem runing sygate 3.0 and win98se till as I had stated earlier, a few weeks before i changed to winME.

If I control alt del, when I know these things are loaded, I get one instance of wscript per .vbs file. My system also seems to lag after a couple seconds. Other than the frequent checking of the startup menu, I get no other problems.

I think it may be sygate but i'm not sure.

 

[Aenslaed]

Bump.

This is really important.

 

[Ark]

Move them in any temp directory and reboot. See what's missing.

 

[Kanly]

sounds like a virus to me.

 

[AndyHui]

That's a virus you have there.

 

[GT1999]

We used to have Network.vbs on the machines at work. As I remember, it was a worm, but it was a month or two ago. Run NAV 2001 if you have it, with the latest virus definitions. I caught it [viruses] for me.

 

[Psychoholic]

Are you sure about the network.vbs being a worm GT. I remembered it as a Trojan.

At any rate it's a virus, make sure your definitions are up to date.

 

[GT1999]

It is a Worm, not a Trojan. Trojans hide themselves within a program, not competely display themselves in your startup folder.


VBS.Network

 

[Ark]

<< This VBS worm does little but replicate. It attempts to copy itself across a network by first locating shared network drives, then mapping them to a local drive letter. Once a drive is infected, the worm tries to copy itself to the \Startup folder of the drive (assuming the infected drive is a Win95/98/NT system drive) to ensure execution at startup. The worm remains in memory until the system is restarted. >>

 

[Psychoholic]

Ark refreshed my memory, I was remembering the fact it mapped drives and tried to make them available. I can across this one time on a somone's computer and it was running across the cable connection. That's why I was thinking Trojan.

 

[Aenslaed]

I finally got off my lazy ass and installed AVP and it found it on its initial startup scan. It was worm.qaz or something like that. I found the definition off www.virusdatabase.com and disinfected it myself. It was basically a worm/trojan that renamed notepad.exe into note.com and placed itself as notepad.exe. It then put itself into the local_machine\SOFTWARE\microsoft\windows\run\startIE &quot;filename&quot; and some weird variables at the end. Just delete notepad.exe and the registry entry above and rename note.com into notepad.exe and you'll be fixed.

I know when I got this virus now. It was during the first and now problably LAST LAN party I held at my place during the middle of summer vacation. People and their poor computer maintenance and dirty computer practices...