scrsvr / brasil / alevir virus

i had this virus on my comuter. i deleted it manually once so far but it came back. i guess maybe its time to install anti-virus software on my computer. anyone else get it? anyone else know anything about it?

to delete manually it is necessary to remove any references to it from the startup by going to:

programs -> accessories -> system tools -> system information -> tools -> system configuration utility -> startup

also open win.ini (in the windows directory) and delete any "run= " lines that reference it.

now, after restarting, you can manually delete the .exe / .pif files in your windows directory (scrsvr.exe, brasil.exe, brasil.pif, alevir.exe)

also i just changed the sharing on my c: drive to password-protect full access.


[Edited on 1-11-2002 by The General]

[Edited on 1-11-2002 by The General]

This was a very evil worm, General, and congrats on fighting it.
Theer's a reasonably straightforward -even Estragon can understand it -little menu here:
www.sophos.com...

fellow posters, beware....
www.symantec.com...

came back again. this time, my computer came up with a notepad window with a file called 'marco.scr' with a bunch of jibber jabber on it.

this time, in addition to the above steps, i removed it from the registry:

start -> run -> regedit (type) -> edit -> find ->

then search for "brasil" "alevir" "scrsvr" -- delete any entries found. keep clicking on 'find next' until it says its completed.




[Edited on 2-11-2002 by The General]

i think i got it this time. this forum isn't about viruses but i think the information i've given could be helpful in fighting any virus to the lay-person (non-virus-fighting-expert).

btw thx estragon for your input.



[Edited on 3-11-2002 by The General]