worm infection

Question

AVG detected the worm/delf.eyr. It quarantined it and removed it but not to my satisfaction. So what I really need to know is will reformatting from the dell recovery partion 100% clean the machine? My wife lost her xp disc, hence the question. Really appreciate any /all responses. AB

ky331 · Answer

you wrote that AVG ' quarantined it and removed it but not to my satisfaction'.   Can you elaborate on your 'dissatisfaction'??  are you still experiencing any noticeable effects of the worm?   if not, what's the problem??

aeonblue · Answer

Registered: 02-11-2001 ky331 Can you elaborate on your 'dissatisfaction'?? are you still experiencing any noticeable effects of the worm? Given the nature of this worm I am not inclined to think it has been completely rooted out. Not willing to take the chance considering the risk to personal information. Do you know if the recovery partition is safe?

ky331 · Answer

You wrote:  ' Given the nature of this worm I am not inclined to think it has been completely rooted out. Not willing to take the chance considering the risk to personal information'.   I am not familiar with the specifics of this particular worm... I tried to look up some information, but found very little information that I consider definitive.   In particular, I cannot make any assertion as to whether or not ' the recovery partition is safe'.   As such, I will step-aside to see what anyone else might be able to advise you.     one last thought:  perhaps one of the HiJackThis experts could tell you more, if you generated and posted an HJT log in that forum??? Message Edited by ky331 on 09-28-2007 05:36 PM

aeonblue · Answer

You wrote: 'I tried to look up some information, but found very little information that I consider definitive. In particular, I cannot make any assertion as to whether or not ' the recovery partition is safe'. As such, I will step-aside to see what anyone else might be able to advise you.' This is the same assessment I came to. To little information to make a call re the worm as of yet. Thanks for taking the time to address issue. 'one last thought: perhaps one of the HiJackThis experts could tell you more, if you generated and posted an HJT log in that forum???' Good idea. Only I currently have the pc off line and am not feeling good about reconnecting it to the router. Anyway I can hijack it from my laptop safely ?

ky331 · Answer

Preliminary note: When attempting the following directions, if you can't [or prefer not to] access the internet to perform the indicated download of HiJackThis (HJT) on your "infected" machine, you should download it onto another "good" machine (a friend's, or one at work?), then transfer it via floppy (it's a tiny file) [or memory stick, or CD-R/W] to the infected machine, run the installer, and then HJT on the infected machine, and finally transfer the generated log over to the good machine, to post your log online.

Download the latest version of Trend Micro's HiJackThis (HJT) [version 2.0.2] installer from

http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Save it to your Desktop.

Double-click on the HJTInstall.exe file you just downloaded, and click on the Install button, to install HJT in the suggested/default folder,

C:\Program Files\Trend Micro\HijackThis

( As part of the installation, a shortcut to the HJT program will be placed on your Desktop, and another shortcut in your START menu [for easy-access to using HJT in the future ---

you only need to run the program again, but not the installer ] ).

After installation, HJT will automatically open and start running.

[If this is your first time running HJT, please read and accept the EULA (End-User License Agreement)]

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then go to the forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.
Also, please indicate the steps you've already taken, if any, in terms of running anti-malware scanners or malware removal tools.

When you submit your HJT log, please make sure the box under your text which shows "Automatically convert carriage returns to HTML line breaks" is checked, or your log may not format correctly... it should consist of separate/readable lines, not one large "jumble".

Hopefully, one of the HJT experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. While it's completely safe for you to download, generate, and post your log (as described above), you should *NOT* attempt to do anything else (in particular, do NOT use it to delete/fix any entries) until you are advised to do so by a forum expert!! Improper use of this tool can severely damage your system.

Virus & Spyware

worm infection

Was this post helpful?