Solved

Virus ??

Posted on 2000-04-25
24
464 Views
Last Modified: 2010-04-27
A frend called me with the following :
He say he has 4 Virus
VBS.FRELINK
VBS.FRELINK
VBS.NETWORK
VBS.WORM GENERIC

The following files are infected :
LINKS.VBS
RUNDLL.VBS

Northon an Pc_cellin don't find anything.
The machine is very slow starting...
It is a NEC computer with Win98.
Can any one help me on this ? Jacques
0
Comment
Question by:jacrous
  • 5
  • 5
  • 4
  • +3
24 Comments
 
LVL 12

Expert Comment

by:Otta
ID: 2749850
Try http://AntiVirus.CAI.COM

Download and install "Inoculate IT Personal Edition".
It is 100% "free" for personal use.
0
 
LVL 12

Expert Comment

by:Otta
ID: 2749853
Also, see:

http://www.viruslist.com/eng/viruslistfind.asp?findWhere=011&findTxt=freelink

for details from the AVP web-site.
-----
VBS.FreeLink
Virus Encyclopedia
This is a worm written in Visual Basic Script language (VBS). This worm spreads via e-mail and IRC (Internet Relay
             Chat) channels. Being executed the worm script creates new script file "RUNDLL.VBS" in the Windows system
             folder and modifies system registry to execute this scri...
0
 
LVL 11

Expert Comment

by:RoadWarrior
ID: 2750519
Oh yes, I think the Kids got that one for me from IRC a while back and I used F-Prot to get rid of it.

F-prot is good but hasn't been updated in a while. It got rid of a couple of viruses I had about a year ago that Norton didn't see, and thier online database discounted as a rumoured viruses only, never known in the wild. I kind of wish I'd kept a copy of them to send to their research center. Works in DOS and one has to set back the system date because the only available version has "expired"

I'll go looking if you want it.

Road Warrior
0
 
LVL 10

Expert Comment

by:emery800
ID: 2751178
For what its worth the only two anti-virus programs I use and have found effective are the two identified above, Inoculate and FPROT which is Command System Software. They have found and fixed viruses that the others couldn't find. Probably a better one around where its user preference but have not heard or researched any further. Dave
0
 
LVL 12

Expert Comment

by:Otta
ID: 2752337
RoadWarrior wrote:

> the only available version has "expired"

Check: http://www.complex.is/f-prot/

FP-Win v3.07 has been released on February 25th, 2000.
0
 
LVL 11

Expert Comment

by:RoadWarrior
ID: 2752396
Oh cool, guess I don't check very often. Actually I think it was around  december I last checked  :-)
0
 
LVL 6

Expert Comment

by:1cell
ID: 2752415
F-prot is good but hasn't been updated in a while. > the only available version has "expired" >>Check: http://www.complex.is/f-prot/

here is where I go for F-prot which is free for personal use and updates quite frequently.  The best as far as I am concerned and the only I recommend to my customers

ftp://ftp.datafellows.com/anti-virus/free

download the latest revision and LOVE it
0
 
LVL 11

Expert Comment

by:RoadWarrior
ID: 2752497
I'm starting to think I must have found a mirror that fell into disuse, I was all ready to mourn it's passing and all.

Just curious, anybody actually detect a virus with a regular check? I usually detect them within a day due to system behaviour. Never ran a virus check when I thought the system was okay and had it find anything.
0
 
LVL 6

Expert Comment

by:1cell
ID: 2752522
hehe, I barely ever run my virus software on my home systems.  Mostly because I have a small network behind a good firewall and I know when risks are high.  That's when I run it once and shut it off.

For clients and my office systems, it's a different story.

Anyway, jacrous, check out F-prot.  It's a bit cryptic but once you understand it, you'll love it and you will feel secure in the future.  Heck, I ask people to send me virii!!!

1cell
http://members.home.com/liquitech
0
 
LVL 1

Accepted Solution

by:
makisupa earned 100 total points
ID: 2753480
I just had this Virus at work on 4/25/00 , I used Norton Antivirus w/ up to date virus definitions, what you have is actually a worm kinda like a virus
delete all references of LINKS.VBS RUNDLL.VBS from your hard drive as well
as the windows regestry. I've included info about these viruses and a link to a really good antivirus web site (Norton Antivirus)

VBS.NETWORK
This VBS worm does little but replicate. It attempts to copy itself
across a network by first locating shared network drives, then
 mapping them to a local drive letter. Once a drive is infected, the
worm tries to copy itself to the \Startup folder of the drive
(assuming the infected drive is a Win95/98/NT system drive) to
ensure execution at startup. The worm remains in memory until
the system is restarted.

VBS.Freelink
VBS.Freelink is an encrypted worm that will work under Windows
98, Windows 2000 and all the other Windows applications that
support VB Scripting language. Once the worm is launched, it uses MS Outlook to automatically send an email with an
attachment of itself.


check out www.sarc.com loo up your virus and it'll give you ways to delete it
w/ or w/o antivirus software.
hope some of this helps
0
 
LVL 10

Expert Comment

by:emery800
ID: 2753684
Otta: I just checked my version of FPROT and its 4.58.3, I think you are visiting the wrong site! Me
0
 

Author Comment

by:jacrous
ID: 2753833
Well,well, things are getting worse, I downloaded Inoculate and F-Prot + updates, they both istalled well on my computer, but on my frend, no dice, tomorrow I will try makisupa idea. Jaro
0
New! My Passport Wireless Pro Wi-Fi Mobile Storage

Portable wireless storage to offload, edit, and stream anywhere.

High-capacity, wireless mobile storage designed to accompany professional photographers and videographers in the field to easily offload, edit and stream captured photos and high-definition videos.

 
LVL 10

Expert Comment

by:emery800
ID: 2753848
You have to give an "A" for effort! We are still trying! Dave
P.S. Don't know what engine you used from FPROT, was it the 4.58.3 with the up to date definitions?
0
 

Author Comment

by:jacrous
ID: 2755222
emery800 : The version I downloaded is 3.07 with macro.def dated 26/04/00
and sign.def dated 19/01/00. Where did you get your version ? Jaro
0
 
LVL 6

Expert Comment

by:1cell
ID: 2755999
jacros, you say "no dice".  What happened exactly?  The install from the zip file can be kind of confusing.  If you can tell me what happened, we can probably straighten it out.
0
 
LVL 12

Expert Comment

by:Otta
ID: 2756164
EMERY800 wrote:
> I just checked my version of FPROT
> and its 4.58.3, I think you are visiting the wrong site!

I'm not -- are you sure?

F-Prot is the product of an Icelandic citizen (Fridrick Skulason).

His web-site, within the '.IS' (Iceland/Island) domain, is the official source for F-PROT.
0
 
LVL 6

Expert Comment

by:1cell
ID: 2756246
perhaps I'm confused but I thought F-Prot (f-protect) was a product of Datafellows.  That's who I bought it from for my company.
0
 
LVL 10

Expert Comment

by:emery800
ID: 2756317
I purchase it through a distributor or get it on-line. The web page is http://www.commandcom.com/ you just want to make sure you get the latest engine from them. Its works great for me, I have never seen the one you are talking about. Sorry. Dave
Its command system software and if you search that name it will take you right to its url.
0
 
LVL 12

Expert Comment

by:Otta
ID: 2757640
> I thought F-Prot was a product of Datafellows.

No, although Datafellows has marketing-rights for the software.
0
 

Author Comment

by:jacrous
ID: 2757911
1cell : I installed on my computer, all works allright for F-Prot and InoculateIT, on my frend's computer, it won't finish install, it tells me that files are missing, the software is not up to date,  to get the update, and then with the updated data, it still does not work, same problem. Jaro

0
 
LVL 11

Expert Comment

by:RoadWarrior
ID: 2759036
set your system date back to the release date of the version your have, then run it in dos mode  then put your system date right again. This is what I had to do.
0
 

Author Comment

by:jacrous
ID: 2763782
makisupa : I accepted your answer, being the one that worked perfectly.
I also thanks all of you, the effort was remarqable and I wish I could have paid everybody. Thanks you all. Jacques
0
 
LVL 10

Expert Comment

by:emery800
ID: 2763786
Not looking for the points only the self-satisfaction as working as part of the team in helping others and fixing their problems, glad yours is fixed. Dave
0
 
LVL 1

Expert Comment

by:makisupa
ID: 2763949
Well thanks for the pionts which aren't really important to me, I'm
glad I could of been of assistance in solving your problem. and I hope in return you can help someone else out in a time of need

Dennis
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

this article is a guided solution for most of the common server issues in server hardware tasks we are facing in our routine job works. the topics in the following article covered are, 1) dell hardware raidlevel (Perc) 2) adding HDD 3) how t…
In this article we have discussed the manual scenarios to recover data from Windows 10 through some backup and recovery tools which are offered by it.
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now