Thanks for all the virus help,

We finally fixed it by a complex process which involved scanning the
infected machines remotely, over the network. We used Norton AV, but had to
run it remotely because when installed on the local machine, the infected
DLL files seemed to interfere with its Live Update feature, which was
necessary to get a recent enough update in order to recognize this virus.
We also had to edit the registry (as per Symantec's site's instructions)
and reboot the machine and scan again (it seemed to leave the virus in
memory which then left one additional infected file on the drive).

This virus is fascinating because it was actually intended to download
plugins for itself from a web site (which has now been shut down). The
virus also detects when an AV program is running and lies dormant, which
explains why some of our machines were exhibiting no symptoms and others were.

Thanks again,

Sean

At 09:39 AM 9/20/00 +0200, you wrote:
>Hi Sean.
>
>You can find the description here :
>
>http://vil.nai.com/vil/virusChar.asp?virus_k=98797
>
>McAfee says that it will be cleaned with DAT 4095.
>
>rgds
>Jan

--
http://www.piclist.com hint: The list server can filter out subtopics
(like ads or off topics) for you. See http://www.piclist.com/#topics