Virus on the SPV x 2

[Guest tobyfield]

I have 2 Virus's on my SPV. Every time I sync with the PC, Norton tells me that is has found 2 different virus's in the ActiveSync directory. Can't find the files on the SPV to delete them and I have never sync'd email attachments, so I'm not sure how they got on there.

How do I get rid of the virus's? Do I have to perform a Hard Reset?

TIA

[Guest]

What does Norton say the viruses are? When it gives you an alert it should tell you the file that has been infected.

Is it detecting a virus on the PC or on the SPV? If it's on the SPV the virus probably copied itself over during a previous sync. It shouldn't harm your phone because AFAIK there haven't been any viruses targeting the SPV yet, and PC viruses won't work on a different OS.

Check Norton's/ Symantec's website for details on the virus to find out how it got onto your PC.

[Guest midnight]

the activesync dir stores apps and games that have been installed on your phone, you wouldnt happen to have got any files off some dodgy place would you? :)

[Guest siu99spj]

Note: "armadillo" replaces all P2P program names (Maybe someone should make a note of that for newer users?).

But yeah, having some file names would be useful.

[Guest tobyfield]

The virus is still on the SPV.

When I synchronise, Norton tells me it has found Install375.exe in C:DOCUME~1TobyLOCALS~1TempActiveSync and it is infected with the W32.Swen.A@mm virus.

A short while later while still snychronising, Norton tells me it has found Q584621.exe in C:DOCUME~1TobyLOCALS~1TempActiveSync and it is infected with the same W32.Swen.A@mm virus.

I cannot find either of these files on the SPV and Norton deletes them from my machine each time.

Am I right in thinking that the only way to get rid of the virus from my SPV is by performing a Hard Reset?

[Guest Taoski]

Go here to the symantec website and download the Swen removal tool.

Run it.

I find that NAV don't work too well with Swen, Blaster and Welchia viruses.

So much so - that i now use McAfee

[Guest deanrh]

U couldn't find the files in the SPV cos they wre never there. the locations of the two worm files r on your computer in the directory where active sync was installed. Ur spv is safe

[Guest tobyfield]

I have downloaded the Swen removal tool, followed it to the letter and it found no Swen virus on the machine.

I put my phone back into the cradle and the virus appears again and is deleted.

What do I do now?

[Guest Brody]

And is deleted you say? Does it keep doing this every time you sync your phone?

[Guest tobyfield]

Almost everytime I sync my phone in the cradle, Norton tells me that it has found the swen virus and automatically deleted it.

Maybe I should make sure that the PC is not connected to the net, turn of Norton and then sync. I can then run the Norton Swen removal tool and see what happens.

[Guest Taoski]

Remove and reinstall ActiveStink i guess.

After you remove it using Add Remove Programs - reboot and remember to check that it has deleted the actual folder on the C Drive before you reinstall:

c:program filesMicrosoft Activesync

Also - delete your local temp files by doing a hard disk cleanup.

Under Start > All Programs > Accesories > system tools (on XP).

Could be that NAV is detecting some odd signature on the files as activesync is creating the sync.

AND.... don't forget that Swen actually disables some services/processes on the PC - and NAV could be one of them. Apparently it also disables REGEDIT too - which you can test by doing Start > Run > Regedit. If you get an error - you may have the virus!

[Guest tobyfield]

REGEDIT definitely works fine as I have been using it fine for weeks.

[Guest Taoski]

Also, download the Network Associates standalone virus scanner/removal tool from here. This also checks for the presence of Swen.

Just to get a second opinion :lol:

Oh. and make sure you are patched up the hilt from the M$ Windows Update site - especially the RPC Vunerability Patch.

[Guest tobyfield]

thanks. I do have all the latest patches. I will report back tomorrow.

[Guest tobyfield]

Also, download the Network Associates standalone virus scanner/removal tool from here.  This also checks for the presence of Swen.

Just to get a second opinion  :lol: 

Oh. and make sure you are patched up the hilt from the M$ Windows Update site - especially the RPC Vunerability Patch.

I did every thing you said to do, and reinstalled ActiveSync. I chose to install v3.7 and it seems to have worked.

I have sync'd my phone several times and as of yet, NO VIRUS! :D :)

Thanks for all your help with this.

Toby

[Guest Taoski]

Excellent. I knew i got paid for doing something useful! :wink: