Advice on repairing virus damage please

[B16 RFF]

I have McAfee security suite installed on my computer and it is fully up to date. However, it seems to have let through a virus/trojan called exploit-byte. It did pick it up when I did a routine scan, but when I tried to delete it, it said it could not be found. Subsequent scans have found nothing.
The McAfee website says it can cause a script that changes outlook express, and that appears to be the problem. Every time I reboot the computer, it changes my incoming mail server to 127.0.0.1 instead of POP.FREESERVE.CO.UK.
Whilst not really serious, it is bloody irritating having to change the server everytime I want to check my email.
Can anybody advise me how to stop this happening, before I tear my hair out, please??
I have tried searching for 127.0.0.1 . It found a file under Adobe Acrobat 6.0 that contained this string, but removing the Acrobat 6.0 made no difference. Oh, and I have had System Restore turned off for quite a while (Running XP home).
I guess it's somewhere in the registry, but I don't know how to proceed or look for it there.
Help!!!!!!

Paul.

[YarisSi]

I have same kind of problem. Have you been told to go itno DOS and delete it?

[danhay]

If you are running XP, try doing a system restore to a date before the problem occured.

Start => Help and Support
Under the Pick a Task heading there is an option to undo changes to your computer using system restore.

[B16 RFF]

YarisSi said:

I have same kind of problem. Have you been told to go itno DOS and delete it?

No, and I would be very careful about fiddling with the registry when I don't really know what I am doing. That's why I'm hoping someone knowlegeable on PH can tell me what to do next.

[B16 RFF]

danhay said:

If you are running XP, try doing a system restore to a date before the problem occured. Start => Help and Support Under the Pick a Task heading there is an option to undo changes to your computer using system restore.

Have just tried that, thanks. As System Restore has been off, it has no restore points before today, dammit.

[richyj]

Turning system restore off is usually a good idea when removing recent virii, as a fair few are capable of hiding within the restore data.

I believe the byte-exploit virus detection is a cover-all for java apps that exploit a Microsoft system vulnerability. It may be worth updating your copy of windows with the latest security patches to prevent re-infection.

Also try restarting in safe made to run a virus check, as anything hidden in/being a system service won't get to start up with the rest of windows. This should make it easier to remove.

(Edited to correct my terrible speeling)

>> Edited by richyj on Sunday 14th November 12:10

[jimmyjimjim]

I'd also check your startup folder to see if anything else is running that shouldn't be.

Some adware/malware doesn't get picked up by virus checkers, so ad-aware and other applications are worth a try.

[B16 RFF]

richyj said:

Turning system restore off is usually a good idea when removing recent virii, as a fair few are capable of hiding within the restore data. I believe the byte-exploit virus detection is a cover-all for java apps that exploit a Microsoft system vulnerability. It may be worth updating your copy of windows with the latest security patches to prevent re-infection. Also try restarting in safe made to run a virus check, as anything hidden in/being a system service won't get to start up with the rest of windows. This should make it easier to remove. (Edited to correct my terrible speeling) >> Edited by richyj on Sunday 14th November 12:10

Have downloaded all updates except service pack 2, as I'm afraid it may conflict with the McAfee security suite. How do I start in safe mode, and what do I do after that?
Sorry, getting rapidly out of my depth here.
Paul.

[richyj]

To go into safe mode you have 2 options:

1) After the intial bootup screen press F8 a lot until you get a startup menu, where you choose SAFE MODE (This method takes timing)

2) In windows, click Start -> Run and type msconfig. A window will appear with tabs at the top. Choose "Boot.ini" and tick the /SAFEBOOT box. When the PC reboots it will do so in safe mode. (Remember to go in and untick the box when you're done, otherwise it will always boot safe).

When in safe mode just run your virus checker.

>> Edited by richyj on Sunday 14th November 12:28

[B16 RFF]

richyj said:

To go into safe mode you have 2 options: 1) After the intial bootup screen press F8 a lot until you get a startup menu, where you choose SAFE MODE (This method takes timing) 2) In windows, click Start -> Run and type msconfig. A window will appear with tabs at the top. Choose "Boot.ini" and tick the /SAFEBOOT box. When the PC reboots it will do so in safe mode. (Remember to go in and untick the box when you're done, otherwise it will always boot safe). When in safe mode just run your virus checker. >> Edited by richyj on Sunday 14th November 12:28

OK, have just done a scan in Safe mode, but it found nothing.
Is it possible it has deleted itself after having done it's evil work? Perhaps I should be looking to reverse what it has done. Any thoughts?

[B16 RFF]

jimmyjimjim said:

I'd also check your startup folder to see if anything else is running that shouldn't be. Some adware/malware doesn't get picked up by virus checkers, so ad-aware and other applications are worth a try.

Sorry if I'm being thick, but can't seem to find a startup folder. Where should it be in XP?
Thanks.

[parrot of doom]

This sounds more like a spyware problem than a virus problem.

I suggest you install BOTH of the following two pieces of software:

Lavasoft Ad-Aware
Spybot search and destroy

[ErnestM]

Be very careful here, and contact McAfee first.

Reason? The way some email AV programs work is that they intercept your email with their own server. They then redirect your email program to check that server that is on your local system. 127.0.0.1 is a reserved IP address for LOCALHOST.

I would see if McAfee uses this scheme prior to rooting around in the registry

ErnestM

[B16 RFF]

parrot of doom said:

This sounds more like a spyware problem than a virus problem. I suggest you install BOTH of the following two pieces of software: Lavasoft Ad-Aware Spybot search and destroy

McAfee Security Suite says no spyware or adware present.

[arcturus]

ErnestM is quite right. Many anti spam programs change the mail server address to 127.0.0.1 . This is not unusual - it is part of how they work.

Changing it back to pop.freeserve.co.uk may actually reduce your security since you will be bypassing some of McAfee's filters.

>> Edited by arcturus on Sunday 14th November 17:02

[B16 RFF]

arcturus said:

ErnestM is quite right. Many anti spam programs change the mail server address to 127.0.0.1 . This is not unusual - it is part of how they work. Changing it back to pop.freeserve.co.uk may actually reduce your security since you will be bypassing some of McAfee's filters. >> Edited by arcturus on Sunday 14th November 17:02

That's interesting. The error message I get for 127.0.0.1 is incorrect password. So if I enter my password for the Freeserve server, then of course it is rejected. Maybe time to reload the McAfee software.
Thanks for that,

Paul.