Backdoor.Nibu Virus

Try these removal instructions here, from Symantec. You'll need to disable System Restore, Boot into safe mode, then run Nortons. Remember, when you disable System Restore, you'll loose all your previous restore points. Be sure to manually set a new one when your done, in case the system doesn't automatically do it for you.

See: "removal instructions".

Mike.

 

We'll need just a little more information. Do you know the name of the infection or file being 'caught' by Nortons? And what specific error message is being returned?

Mike.

Scan your computer on http://security.symantec.com http://www.pandasoftware.com/activescan/com/activescan_principal.htm

http://housecall.trendmicro.com/

Hi Midnight Star

I did follow the Symantec removal instructions. Problem is that when I get to the part about deleting infected files, "quarantine" is the only option I'm given. So I hit "quarantine" and then the delete option becomes available. I hit delete, the screen blinks and then tells me something about my still having one virus on my system.  Norton only found one virus to begin with and the infected file is prntsvr.dll.  No matter what I do, I can't seem to get rid of that file. I also ran Panda to no avail.  This is a tough nut.  I do appreciate the responses.  Other suggestions??

Incidentally, the name of the virus is identified by NAV as "backdoor.nibu".  Based on what I've read from Symantec I believe I have backdoor.nibu.E.

Message Edited by Badko on 09-17-2004 01:46 PM

Ok, it appears to be a backdoor, remote access trojan. The GOOGLE reference is here at Symantec. It's the next variant in the chain; type 'g'. And at a glance, it appears to have dumped a 'truckload' on stuff on your system.

If your using DSL/Cable internet service, completely disconnect from the internet, since it's a known remote accesser, before beginning any fix. Next, see if the program name that you've listed, as well as other listed on the above link, is currently running as a background process, if it is, 'end' it. If not, since it's a .dll, you might have to unregister it before Nortons will allow you to delete it. I would also attempt to locate the file on your harddrive, then check the file's properties to see if their set to "Read only", but don't delete it. After doing that, try Nortons again and see if you have any better luck.

Based on the symantec security response for backdoor.nibu.g, there should be some svchost.exe look-alikes running too. So, be careful and not delete them.

Here's another link that might prove useful.

Mike.