Self replicating VIRUS help needed please.. :(

pug_in_a_bed

I was pleased to find this thread as I have also had this swine. I'm using mcafee and it seemed to find and delete the culprit in a scan in safe mode. I've also used ccleaner but i'm just wondering whether to now do a scan with trojan hunter for final piece of mind. Will it conflict with mcafee though?

Also, I tried the thing at the beginng where you go to explore all users and then delete folders on the first page of this thread but I can't seem to find a folder with 'sun' or 'java'...

Mcafee kept detecting this in scans but said it could not be cleaned and to check where it was right protected, however i could delete it but obviously it kept coming back. I think (fingers crossed) I have got it now but want to make sure!

pchelpman

Hi

If you go back to my post #6 that will explain how to reveal "hidden files and folders". You will need to do that first or else you won't find some of those files.

Now....you say you can't find "sun" or "java". I find this odd as this java bytever virus is java specific. it will only attack your PC if you have java somewhere on it.

You aslo say you think you have nailed it now. Well, I hope you have but please post back if you have more trouble. This virus does return if you don't root it out fully. I also suggest you start your own topic rather than follow on from someone else's. It can get confusing for all who try to help.

Let us know how you get on.

StephenB_2

pug_in_a_bed: http://javatester.org/version.html will identify your java version (the pink box just under "Method 1: Ask Java") And it is ... ?

SJB

pug_in_a_bed

Right i've found those folders now and cleared them out, thanks. I will do some more scans and hope for the best.

The pink box says:

Java Version: 1.5.0_06 from Sun Micro Systems Inc.

StephenB_2

pug: you're up to speed with the latest Sun java, I was worried that you had the old Microsoft java. I'm surprised you can't see it in "program files". Mine is at C:\Program Files\Java\jre1.5.0_06

SJB

pug_in_a_bed

I figured out that instead of being in 'owner', it was under my name instead as I am the administrator (?) on my pc.
Thanks for the help, looks like its all gone now thankfully.

pchelpman

pug_in_a_bed wrote:

Thanks for the help, looks like its all gone now thankfully.

Glad to hear it. Well done. Just remember..."java_bytever" has a nasty habit of returning. I suggest you clear out the java/deployment/cache folder manually from time to time. Can't hurt.