Can't Install AV software or online scan

[msolheim]

Buddy's computer seems to have a virus.
His inbox is filled with "undeliverable" mail from his ISP from
emails he didn't send out. Sounds like a virus.

When he tried to install Norton it started the install process,
then just kicked him out. He tried the online scan at symantec's
site and was kicked off the site.

Anyway to find out what virus this is and remove manually?

I'm going to have him try housecall site. Not real confident that
will work either.

Any ideas?

thanks
Mike

[not important]

This is a good place also.
http://www.trendmicro.com/en/home/us/enterprise.htm

[Redo40]

What operating system? If you can get into DOS, try F-Prot for DOS (http://www.f-prot.com/download/getfpdosfree.html) , here are instructions for setting up the floppies (http://www.f-prot.com/support/06.html), you will also need a boot disk.

[msolheim]

Just as I thought,
housecall did not work either, was kicked off the site.

Redo, thanks for the site. I've forgotten all about f-prot.
I remember back in win3.11 that was the shiznit!

I'll let you know what happens.

Also, I had him print off one of the emails that was returned
by is ISP. It had attachements, ATT00020.DAT & New Image().eml

Does this mean anything to anyone?

thanks
Mike

[morriswindgate]

http://lists.ulv.edu/pipermail/route66lug/2002-August/000243.html

[glc]

Run msconfig and list everything in the startup - I might be able to recognize what virus it is by an entry in there - and by disabling it you may be able to get a good housecall or Norton install. I'm guessing it's probably Klez or Yaha.

[msolheim]

ok
the f-prot on floppy didn't work. I followed their instructions copied the listed files to disk 1 & 2. When it runs it ask for disk with the and when asks for the disk with "sign.def" which is disk 2. put that in then it asks for "sign2.def", put in disk 1 and it
ask for a command module of some sort. Don't know what going on.

MSconfig list looks good, except a line for "winkuko.exe" and "Load=". Tried unchecking all lines, restarting and trying an online scan with no results.

mike

[glc]

winkuko.exe is the virus.

You got the Klez. Download the removal tool:

http://securityresponse.symantec.com/avcenter/FixKlez.com

Run it in safe mode.