Kona has a BIG problem!

from WinCustomize Forums
Somehow I got that new Worm, Sobig f@mm. Does anyone know how to get rid of it?

Here is what I have tried:

First I tried Norton Virus scanner. It failed to remove it, although Norton has been updated completely.

I then tried the online scan from Trend Micro, otherwise known as PCillin. It detected it but could not remove it because it said the file is in use and can not be deleted.

Then I tried the stinger program from mcaffee but it sees the virus but can not delete it. Again, something about the file can not be deleted because it is in use.

I also updated windows.

This worm is embedded in the C:/_restore/temp files and although I have disabled system restore it still says (any virus program) that it IS in use and can not be deleted.

How do i remove the damn worm?

Do I have to reformat and reinstall?

Thanks from Kona!
3,282 views 12 replies
Reply #1 from WinCustomize Forums Top
Kona go to symantec web site and download the fix it's there takes 20 seconds hope this helps...calles fixtool for SobigF
Reply #2 from WinCustomize Forums Top
Not sure if you have this in Win ME, but ....... in system tools run disk mgr and click on options...in system restore options (at bottom) click on remove all your restores except the last good one.....



Powered by SkinBrowser!
DeskScapes - Bring your desktop background to life.
Reply #3 from WinCustomize Forums Top
In ME the easiest way is to set the System Restore cache size to zero
Reply #4 from WinCustomize Forums Top
Try restarting into "Safe Mode" and run Stinger, but make sure your Restore System Files is turned off.


Powered by SkinBrowser!
[Message Edited]
Reply #5 from WinCustomize Forums Top
Sounds like there's a running process that needed to be terminated before it could be removed.

Here's Symantec's site which has links to info and the removal tool for SobigF:
http://symantec.com

Let us know how it goes.

Oh, just wondering, have you rebooted after diabling system restore and then try to remove the worm? I think theoretically the reboot should clear the temp files? Worth a try.



Powered by SkinBrowser!

[Message Edited]
Reply #6 from WinCustomize Forums Top
Yea, like sig said. Have you tried ctrl+alt+del/"TaskMan", then try your scan> to End the process first? Shut down the virus's prog. 1st, then try your scan Good luck kona
Reply #7 from WinCustomize Forums Top
Kona go to symantec web site and download the fix it's there takes 20 seconds hope this helps...calles fixtool for SobigF


thanks alot for this peice of advice. KNOCKED THAT WORM OUT OF MY SYSTEM!

Thank you everyone.

In ME the easiest way is to set the System Restore cache size to zero


How is this acomplished?
Reply #9 from WinCustomize Forums Top
To set the System Restore cache size in ME:

Select Start > Settings > Control Panel > System
Select the Performance tab
Click the File System button
On the Hard Disk tab, adjust the System Restore disk space use slider to the preferred size


Reply #10 from WinCustomize Forums Top
thx again guys. But I tell ya next time (if there is a next time) I get a worm I am going to reformat and use mandrake/win 98....
Reply #11 from WinCustomize Forums Top
Don't think these are free from virii, worms, spam, bugs and/or security issues, but I can imagine you have enough of it.
Reply #12 from WinCustomize Forums Top
no it is the fact that 98 would run better on my 233 laptop and as far as mandrake... well i just want to play around with that. I have ME right know and the bugs in it are getting to me.

nice to see you madice.