godfoot

I am having this problem still with one of our PCs at work that is running Windows 98 due to a virus that has more or less been taken care of but not quite.
I THINK I have it narrowed down to a particular registry entry (although I am not positive, that's why I am here) in the following tree:

HKEY_LOCAL_MACHINE
Software
Microsoft
Internet Explorer
International

The entry is rundll32.exe and the value is 6.0.2600.0-6.0.9999.9999
This value is the same as well for entries explorer.exe and iexplore.exe

I checked XP and noticed it did not even have the International folder as stated above and this is one of the reasons I am suspect. The other reason is that when Win98 starts, I get a popup box saying something to the effect that "a file named myjvd.exe is missing or corrupt...blah, blah, blah. This file was part of the virus that was inoculated a while ago and has been deleted (had a hell of a time there and had to go into DOS to do it) since but the popup remains. When I do a Ctrl+Alt+Del the only thing running that shouldn't (necessarily) be is rundll32.exe
Is my deductive reasoning flawed or can anyone confirm this? Thanks in advance.

j-dogg

I know how to fix it, it's called format.exe

We had a PC in the shop recently with a similar virus, I re-installed Win98SE on it. We were all day in DOS copying files and pasting them in the 98 system directory

godfoot

I have been suggesting that for months now but this is a "small company with small town values" type operation as the head honcho is a tight-wad.
On second thought though, they may finally listen to me since I caught the Mydoom virus before my department got infected. (But here is the kicker), The big boss - the aforementioned tight-wad and class-A pr|ck - is the one that brought it back to my department to open it because "I already unzipped it and tried double clicking it a few times and I couldn't get it to open!" I calmly explained to him to go turn off his computer until one of us researches the virus further if he knows what is good for him. Of course, I then had to explain to him just how a worm operates and generally propogates itself, all of which I could see was going right over his head almost faster than I was saying the words.
So I finally got him convinced that he should turn off his computer either until someone else that knows anything about how to clean it comes along or until I get in tomorrow. Hopefully, Norton will actually have a fix by tomorrow.