Spyware, Viruses, & Security forum

General discussion

Help with cleaning NYB virus

by ylselo / July 1, 2004 3:17 AM PDT

I recently discovered that my PC is infected with the NYB virus. McAfee antivirus 8.0 detected it but could not do anything about it. Norton 2004 didn't even see it there. Please, help me clean my PC.

Discussion is locked
You are posting a reply to: Help with cleaning NYB virus
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Help with cleaning NYB virus
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Re: Help with cleaning NYB virus
by Marianna Schmudlach / July 1, 2004 3:23 AM PDT
Collapse -
Re: Help with cleaning NYB virus
by ylselo / July 1, 2004 3:39 AM PDT

I use Windows XP Pro as my OS. Are the methods for the virus removal that apply to Win 98 also the same for Win XP? Thank you.

Collapse -
Re: Help with cleaning NYB virus
by Marianna Schmudlach / July 1, 2004 4:01 AM PDT

I am NOT sure of that one - I also saw Windows NT/2000 but NO XP - I'll send Grif an e-mail - he is our "McAfee Expert" - to have a look at this thread. Hang in there Happy

Collapse -
Re: Help with cleaning NYB virus
by sharpy1232000 / July 1, 2004 7:43 PM PDT

Go to Control panel, click on system, then click on performance, then click on file system, then trouble shooting, when that comes up click on disable system restore,click ok and apply. System will restart.Do all again then uncheck system restore. ok, and apply.System will restart.then run virus scan should be okay. You can do this also for trojans as it removes them from disk drive.

Collapse -
ylselo, Try This...
by Grif Thomas Forum moderator / July 2, 2004 12:50 AM PDT

There are a couple of ways to go about this and you may need to use them all. Try them in the order I give them below. Preparation for the various scans is the key.:

First, if you haven't already, you'll need to create a McAfee bootscan floppy with bootscan.exe on it. If you don't have one, you can create one on a CLEAN computer using the instructions at the link below:

How do I Use bootscan.exe?
http://ts.mcafeehelp.com/displaydoc.asp?frames=1&docid=71629&CategoryId=62305

If you don't have a Win98/ME computer around to create the Win98/ME boot floppy, you'll also need an emergency boot floppy for Windows XP. Here's how to make one on an XP machine EXCEPT that you'll need to make the floppy on a CLEAN machine. If you happen to have a Win98 boot floppy, that will work fine for these purposes.:

Simply insert a blank floppy, right-click the A(Floppy) Drive and select "Format" and check the box: "Create an MS-DOS startup disk". AFter the floppy is created, be sure to "write protect" it by moving the little slider at the bottom of the disk so both holes are open and can be looked through.

This allows you to boot into a DOS prompt.


Next....Shut down the computer. Place the boot floppy into the floppy drive, then start the computer. It should load to the "A:\>" prompt. Remove the boot floppy, then place the McAfee bootscan floppy in the floppy drive. Now....still at the "A:\>" prompt..Type
BOOTSCAN C: /boot /clean
at the flashing cursor, then press the "Enter" key. (When typing the comman, make sure to leave a single space between The scan should occur and clean the boot sector of the virus.

This procedure will clean an NTFS Master Boot Record and allow Windows XP to successfully reboot from the hard disk drive. After running the procedure above, reboot the computer into "Safe Mode", then run a full system scan to remove any infected files on the hard drive that remain.

The procedures immediately above follow the instructions in the McAfee article below:

http://vil.nai.com/vil/content/v_880.htm
___________


Next, If the above procedure didn't scan the boot sector and files correctly and fix the problem, then follow the procedures below:(These are McAfee's instructions for a DOS scan):

Windows 2000/XP

1. You can get to a command prompt in Windows XP by going into Safe Mode with Command Prompt.
2. If the computer is on: select Start | Shutdown | Restart.
3. If the computer is off, turn it on.
4. When you see the opening splash screen, hold down F8 on the top row of the keyboard or hold down the CTRL key. NOTE: On some computers if you press F8 too soon you'll get a keyboard error if this happens hit the F1 key to continue.
5. The Windows 2000 (or XP) Advanced Options Menu will come up. Choose Safe Mode with Command Prompt.
Login.

Scan Instructions

1. Type CD\
2. Press the Enter key
3. At the C:\ prompt, type CD SCAN
4. Press the Enter key.
5. At the C:\SCAN prompt, type SCAN /ADL /CLEAN /ALL /REPORT REPORT.TXT
6. Press the Enter key.

Note: The scanner will look at all files on all local drives and attempt to clean the files. An activity report called REPORT.TXT will also be created in the C:\SCAN directory. To view the report in DOS, type REPORT.TXT and press Enter.
7. Once the scan finishes, exit DOS and restart the computer.
_____________


Hope this helps.

Grif

Collapse -
Re: ylselo, Try This...
by ylselo / July 5, 2004 8:46 AM PDT
In reply to: ylselo, Try This...

Thanks. I am going to try that tomorrow when I have access to a clean pc. Thank you

Collapse -
(NT) (NT) Good Luck and Let Us Know How It Goes
by Grif Thomas Forum moderator / July 5, 2004 3:55 PM PDT
Collapse -
Re: (NT) Good Luck and Let Us Know How It Goes
by ylselo / July 6, 2004 11:38 AM PDT

2 bad news. First, I created the dos boot disk. But, when I tried to boot, I got the message: 'wrong disk'. So I rebooted in safe mode with command prompt; and I typed at the A prompt bootscan c:\boot /clean. And I got 'an application has attempted to directly access the hard disk, which cannot be supported; two options:close and ignore'. I opted for ignore. And it found no infection. There was also something about cmd.exe 16 bit.

Collapse -
Ylselo, Try This Next...
by Grif Thomas Forum moderator / July 6, 2004 3:07 PM PDT

Instead of dealing with the McAfee bootscan disk, try using the F-Prot for DOS antivirus scanner. You'll still need to have a Windows XP boot floppy as described earlier, but after putting the Windows XP (or 98) boot floppy in the floppy drive, restart the computer to the A:\> prompt, then place the F-Prot floppy disk in the drive per the instructions below. (Once again, you'll need to create the F-Prot floppies while on a clean computer.)
___________

Here is a link to F-Prot for DOS, which can be downloaded and then placed on three floppies, (while on a "clean" computer) from which you can scan and clean out the infected computer while in DOS. You'll want to boot up to DOS using a standard boot floppy, but then place the F-Prot program floppies in the drive. Here is the link and instructions on how to use the program:

F-Prot For DOS Main Page

F-Prot Download Site Click on the link, then scroll to the middle section of the page and download the "F-Prot Antivirus for DOS" file to your desktop. (You'll need an UNzipper program, like WinZip, etc. to open the file.) Then go back to the link above and download the newest virus signatures that are lower down on the page (both files) and replace the older ones that are currently in the download.

Instructions on how to create the floppy disks and run the program from DOS:
How can I run F-Prot? for Dos from floppy disks?
__________

As before, this DOS program won't be able to access the entire NTFS file system, but it should be able to access the boot sector and clean it correctly. In addition to performing the above steps, and when there is a stubborn "memory resident" virus, I occasionally will unplug the computer tower and remove the CMOS battery for about 30 minutes. Replace the CMOS battery and the BIOS settings will be placed to their default. If it comes to this, you may prefer to have a qualified technician reformat and reinstall everything.

Hope this helps.

Grif

Collapse -
Re: Ylselo, Try This Next...
by ylselo / July 8, 2004 3:25 AM PDT

I tried everything that you advised but to no avail. I was trying to avoid having to reformat my hard drive. I guess now that I have very few options left. I want to thank you, guys, for the support that you've provided me.

Collapse -
Ylselo, What Happens When You Run F-Prot?
by Grif Thomas Forum moderator / July 8, 2004 3:50 AM PDT

Although reformatting may be required, let's get some more information here....Are you able to boot using the Windows bootfloppy, then, at the A:\> prompt, can you start F-Prot? Does it indicated that the bootsector has been scanned and cleaned?

I'm just trying to find specific information....Where EXACTLY is McAfee detecting the virus? Is it finding the infection in the bootsector, or somewhere else? A particular file maybe and if so, where is the file located?

Apparently you're still up and running, so maybe you have more time to give removal a chance. It's your choice.

Hope this helps and let us know.

Grif

Collapse -
Re: Ylselo, What Happens When You Run F-Prot?
by ylselo / July 27, 2004 9:17 AM PDT

Sorry Guys, I was away for three weeks. Yes the virus is in the boot sector. Now, I am in the process of reformatting my hd. So far, it's been two hours and counting. For the life of me, I cannot seem to find the proper way of reformatting the hd. By the way, my pc is running XP Pro.
Thanx

Collapse -
Ylselo, Reformatting and Reinstalling XP Depends....
by Grif Thomas Forum moderator / July 27, 2004 1:53 PM PDT

...on how it was installed in the first place, which you haven't provided to us yet.

If there is a Recovery Partition already installed, such as on HP and Compaq computers, you should be able to reformat and reinstall using the user manual instructions. Likewise, if there are Recovery CD's that came with the computer.

If you only have a Windows XP CD from which to reinstall, maybe the links below should help:

Windows XP Home Fresh CD Install on a Used Hard Drive (After clicking on the link below, read the info, then click on the "Click Here To Begin" link at the bottom.)
http://www.windowsreinstall.com/winxphome/installxpcdoldhdd/index.htm

Release Notes for WinXP Home Version
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q306824

Release Notes for WinXP Pro Version
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q286463

Windows XP Setup From DOS
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q307848

Troubleshooting WinXP Setup Problems When You Upgrade
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q310064

Hope this helps.

Grif

Collapse -
Fprot DOS Instructions
by BFoxtek / June 10, 2009 5:42 AM PDT

I am stuck with the NYB virus on a WIN XP pro/DOS dual boot machine. I have tried a dozen anti-virus programs to no avail.

I am looking at your thread and the link to creating the F-Prot diskette is no longer active. Do you recall how to create the F-Prot DOS diskette?

Thanks

Barry

Collapse -
Suggest You Start a New Thread
by tobeach / June 10, 2009 2:43 PM PDT
In reply to: Fprot DOS Instructions

of your own for this problem. Not surprised that link dead after 5 years. Starting your own will catch those eyes who'd otherwise by-pass such an old post.

In new thread, include link to your post here and please tells exactly WHICH A/Vs & versions you've already tried (& IF regular mode or in Safe Mode) to avoid repeats in advice. Thanks! Happy

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

FALL TV PREMIERES

Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!