RE: FN-FORUM: Mydoom virus- how to get rid of it?

date posted 1st February 2004 16:48


> If you read to the bottom of that page you sent, it says just
> what I said:
> "Recovery.
> Identify and terminate the virus process (explorer.exe) using
> the Windows Task Manager, taskkill.exe (Windows XP), tlist.exe and
> kill.exe (Windows NT/2000 Resource Kit), or a third party
> utility. (etc)"
>
> Not being able to delete a virus 'cos it is active is hardly rare.

My point was that James' message makes it look like he's
not infected by the virus, but merely has a copy of it
in his e-mail. The file could be undeleteable if, for
example, his e-mail client is currently running and has
the file open, or the file is held open if he's running
the SMTP component of IIS.

I haven't seen any copies of MyDoom thus far which have any
scripting with them to try to run the virus even if the
message has been viewed in the Outlook (Express) preview
pane. Therefore, if James hasn't double clicked an attachment,
he should not be /infected/ by the virus. The fact that AVG
has spotted the virus in a .eml file (rather than
%windir%\system32\exporer.exe or %windir%\system32\ctfmon.dll
would seem to support that. AVG should also spot the registry
changes that go along with a MyDoom infection, if it's
worth its salt.

Anyway, I was trying to inject a little calm since it sounds
like James' machine isn't infected and he needn't fly into a
panic.

Lastly, Cert's intructions to kill explorer.exe are a trifle
unhelpful: NT, 2k and XP (and I think 95 et. al.) always have
a running explorer.exe process, so it's easy to read that
part of the advisory and fly into a panic if the other signs
of infection mentioned further up in the advisory aren't
heeded (.exe, .dll, registry changes).

Regards,

--Chris

Chris Marshall
Secure Systems Integration Ltd
Web: http://www.secure-si.co.uk/
Tel: +44 (0) 7970 459 553
Fax: +44 (0) 1954 201 741
E-mail: [EMAIL REMOVED]
Pager: [EMAIL REMOVED]
(short message only)