Windows DEP Error "Windows Explorer"

kamran26 · #1 07-02-2006, 09:28 PM

Hi All,

Really could do with some help on this one, tried everything with no luck.

A few days ago i was downloading video files from limewire. Unknowingly I may have downloaded a W32.Alcra.B (also known as Win32.Alcan.D, Worm.Win32.VB.an, W32/Alcan.worm!p2p, W32/Alcra-B, WORM_VB.AS) file.

The worm first came to my attention when I tried to open a folder containing downloaded video files. The Windows "DEP" (Data Execution Prevention) dialogue error came up and closed the folder and refreshed my desktop. So I ran a Norton antivirus scan, this resulted in telling me that there was a worm, which i proceeded to then delete. I ran a second scan on my local C and also my external backup drive where other video files are stored. Further to this I downloaded Ad-Aware SE from Lavasoft and ran a spyware check. This all came up clean and I assumed the source of the worm had been deleted. HOWEVER, the problem is still there, and everytime I open the folders both on my C (local) drive and my external backup drive it continues to show the DEP error and closes the folder screen.

This is what i read on the norton site: http://securityresponse.symantec.com...2.alcra.b.html

I did everything the norton site recommended me to do, including turn off the system restore etc.

Can anyone help and tell me what is wrong AND also how to remove this worm. Because I am now beginning to get unwanted pop-ups.

Look forward to hearing from anyone. Also, having spoken to norton, who happened to be totaly useless, can anyone tell me how serious this thing is and what extent of damage it could cause?

yoni5002 · #2 07-02-2006, 10:48 PM

Hi,

I recommend you to login in safe mode by pressing F8 when you turn on your system. Select Safe Mode with networking and go to http://www.trendmicro.com/hc_intro/default.asp to run a full scan, it's free and could be very helpful... Also I suggest to get rid of Norton and get a useful antivirus. Avast is one of them, free for Home users... Hope this help

Phippy · #3 07-02-2006, 11:32 PM

One other thing, try creating another profile (user) and logging in as that. See if the problem goes away. Corrupted profiles (assuming that works) typically aren't worth the time it takes to try and fix them.

Obviously, if it's a system problem and not a profile, then something else is in order, but give that a shot first.

yoni5002 · #4 07-02-2006, 11:41 PM

That's also a posibility. Although, if you create another profile and you are still infected you have huge chances to get that profile infected as well. After the clean up you could try something like sfc/ scannow to repair corrupted system files...

kamran26 · #5 07-03-2006, 07:25 AM

Thanks both of you (yoni5002 and Phippy) for the advice. Ive tried the trendmicro scan and it picked up a HTTP worm, so i instructed it to delete. I will now download the Avast antivirus and see how that can help. On the note of the pop-ups, I am actualy still getting them while i log onto this site.

Yoni5002, could you tell me more about how to do the like sfc/ scan?

Best,
K

yoni5002 · #6 07-03-2006, 08:25 AM

So if you are still getting the pop-ups you are not Viruses or spyware free. You need to run a antispyware combo. Something like Spybot search and destroy and Webroot.

Also we need to know a little more about the pop-ups and what they say. Can you be a little more specific about the pop-ups, please?

Note: You need to uninstall Norton before installing any other Antivirus program. Make sure to update the new antivirus and run a full scan in safe mode if posible...

The sfc /scannow should not be done at this point. You need to be viruses and spyware free... Anyways How does it work? simply drop your XP installation CD in the CD Drive. Feel free to close the XP Installation window if it comes up. CLick Start/ Run and type "sfc /scannow" without quotes. Note there is a space in sfc/(space)scannow. do not use or open any application during the process. Once it is finished reboot the computer and see if issues are gonne after login back onto your Windows.

But as I said it is not a good time now for you to attempt to fix any problems you may have. Clean up your system first.

Hope this help

kamran26 · #7 07-03-2006, 09:20 AM

Hi Yoni, the pop-ups seem to be these stupid MSN icons promotions. I have kept my surfing on the net to a minimum since the worm, so therefore it might not have yet had a chance to detect my surfing patterns.

On the other note, i removed norton and installed Avast. It ran a scan on my local drive and came up with nothing.

The DEP problem still seems to be there. Whever I open that folder, it basicaly refreshes the desktop and closes that particular folder.

K

yoni5002 · #8 07-03-2006, 10:45 AM

Well there is a new Virus online that is acting as a Windows WGA (Genuine validation Tool) and it installs a bunch of crap in your system. Very similar behavior to what you are getting. I can't say for sure that is what you have in your system though. Did you try the Webroot Software?? and the Spybot search and destroy I posted before???

kamran26 · #9 07-03-2006, 10:56 AM

Hey Yoni,

OK, im running a full system scan with the Avast software, and it seems to be picking up a bunch of worms mainly. So im basicaly following the tool recommendations and either quarantine or repair. Going to wait until its finished, but so far it has picked up several that none of the other spyware programmes picked up.

When you mentioned combo tools, is this Avast one of them? It appears to be as it picks up the worm and then repairs or deletes it. So i assume it is a combo thingy.

Again, thanx for ur help here.

K

yoni5002 · #10 07-03-2006, 11:21 AM

Yeah. Avast has been very effective for me and I have not purchase is because it is free but I have made donations more than once. It is a good Antivirus program and it has one of the better real time protecion while working on your system and Surfing the internet.

when I mentioned the antispyware "Combo" I was talking about spybot and webroot, they won't delete or pick up viruses in your system but it is always good to have them to keep your system away from spywares. That is the best combo I have used and that's why I recommend it to you. After you finish the antivirus scan and once you clean the infected files or delete them consider running the antispyware combo and I'm sure you are gonna find something else...

I'm glad you followed the suggestions and I'm almost sure Avast is gonna clean everything up.

I had a nasty Virus in my computer while running Norton 2006 for testing pruposes. Norton scans said the system was clean and everything was ok, while I had a troyan copying itself in a folder that grew from 1.2MB to 29.97MB in less than 1 hour. I have never used Norton and I don't like it. Uses to much resourses and is not effective while cleanning and or scanning. Norton was a good antivirus long time ago. Not anymore they have just fallen down with the time.
Anyways, let me know the results if you don't mind and please take one more advice into count and do the Antispyware combo scan... That should get you completly out of troubles...

kamran26 · #11 07-03-2006, 11:32 AM

Hi Yoni,

Thanks buddy, appreciate the help.

The scan is still undergoing so i'll do as you instructed.

Regarding the antispyware combo, can you suggest which one, or is it actualy called antispyware combo.

Best,
K

yoni5002 · #12 07-03-2006, 11:45 AM

Quote:

Originally Posted by kamran26

Hi Yoni,

Thanks buddy, appreciate the help.

The scan is still undergoing so i'll do as you instructed.

Regarding the antispyware combo, can you suggest which one, or is it actualy called antispyware combo.

Best,
K

When we say "COMBO" we mean to use more than 1 Antispyware soft in your system.

Combo = pair = 2 or more

I recommend
1- SPYBOT SEARCH & DESTROY 1.4 (FREE)
2- Webroot (NOT FREE) unless you ask me for it

lol

You can also consider Spywareblaster which is also (free)
Windows washer, etc and a bunch of others

Just keep your Ad-adware and add the combo I recommended or just the one you consider the better for you...

kamran26 · #13 07-03-2006, 11:52 AM

hi Yoni,

Thanks for update. OK, let me tell you what I currently have on my system, STOPzilla, Ad-Aware SE Personal & CounterSpy. I assume these meet the requirements.

Webroot looks good ;-) wonder where I could get a copy of that, hmmm??!!

Look forward to hearing from you.

Cheers,
K

kamran26 · #14 07-03-2006, 04:43 PM

hi Yoni,

Thanks for update. OK, let me tell you what I currently have on my system, STOPzilla, Ad-Aware SE Personal & CounterSpy. I assume these meet the requirements.

Webroot looks good ;-) wonder where I could get a copy of that, hmmm??!!

Look forward to hearing from you.

Cheers,
K