4 Replies Latest reply on Dec 12, 2009 12:58 AM by hylocvijay

    VSE8.7i not detecting Win32.Imaut.exe

      Greetings of the day.

      About a couple of days back had been to a friend who had some virus problems, to help him as he is installed with VSE8.7i Patch2, Antispyware.

      His pc was affected with virus in msconfig/startup/...../Regsvr.exe.

      VSE 8.7i could not detect the same. uninstalled Mcafee and installed Norton 2009 and it detected Win32.imaut.exe virus. this was affected on 28th/29th Nov 2009.

      checked on the threat centre at mcafee and not mentioned here recently. but on through check there is a entry on threat centre in 2008.

      could anyone help and guide me.

      thanks in advance.

        • 1. Re: VSE8.7i not detecting Win32.Imaut.exe

          Hi,

           

          i. Pls download new Stringer

           

              Before Run Do the steps..

           

           

          ii. Run the Combofix.

           

          iii.

          1.    If the task manager and registry editor

          is disabled then we need to enable them first..

          2.    Delete the Autorun.inf file created by the virus.

          3.    Now type msconfig in the Run dialog and click on startup tab.

          4.    Look for regsvr and uncheck any options, click OK.

          5.    Now traverse to control panel -> scheduled tasks, and delete the At1 task that might be listed there.

          6.    Type regedit in the Run dialog to open the registry editor.

          7.    Click on Edit -> Find and search for regsvr.exe

          8.    Just delete all the occurrences of regsvr.exe virus (do not confuse it with regsvr32.exe which is not a virus).

          9.    Navigate to entry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and modify the entry Shell = “Explorer.exe regsvr.exe” to delete the regsvr.exe from it.

          10.    Now to actually delete the virus from the system go to system32 folder and delete the regsvr.exe virus file from there (you will need to uncheck the option of “Hide Protected System Files and Folders” in Folder Options to view the virus file).

          • 2. Re: VSE8.7i not detecting Win32.Imaut.exe

            hi Anilk0512,

            greetings of the day.

            yes thanks for the suggesstion.

            well have already downloaded and run the scan of stinger, MBAM and have successful removed the virus before you could suggest me.  But thats fantastic guide to me about the other facts in sl. no. iii.  i was not aware of it and thanks a lot for having guided me and made me learn on that issue. am grateful to u.

            the main reason for me to post this discussion here is that when norton 2009 could detect it, y did mcafee not detect it??.

            we are spending money on licenses for having the legal version and if mcafee could not detect it, then there is some problem.

            have we to contact mcafee and make them aware of it? have we to contact the support team and recite them about it.  thats the only concern.

            thanks.

             

             

            Message was edited by: hylocvijay on 10/12/09 11:11:01 AM IST
            • 3. Re: VSE8.7i not detecting Win32.Imaut.exe
              wwarren

              Yes, you ought to contact McAfee Support about situations like this.

              A sample should be collected and submitted to McAfee Labs.

              And Support can review your scanning configuration to ensure it is set appropriately for detection.

              1 of 1 people found this helpful
              • 4. Re: VSE8.7i not detecting Win32.Imaut.exe

                Greetings William,

                thanks a lot for your reply and message.

                would now certainly contact support and make them aware of the non-detection of the virus.

                thanks for the help and guidance.