Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Resolved Question

MGR and Internet Explorer "virus"

Dec 23, 2011 3:00AM PST

This started yesterday on our Windows Server 2003 machine running Citrix.When a user logs on, it opens up 2 IE windows (Internet Explorer Cool. Then if the user tries to open up an Office product (Word, Excel, Outlook...version 2003), it opens up another 2 IE windows.

Discussion is locked

exg001 has chosen the best answer to their question. View answer

Best Answer

- Collapse -
Some thoughts..
Dec 23, 2011 6:26AM PST

Ed..

You haven't mentioned which variant of "W32/Ramnit" McAfee detected. Have a look at how McAfee describes "W32/Ramnit.f". Note the date of discovery ("f") reflects yesterday's date. In other words, that specific variant was added recently.

As is noted here (and elsewhere), "the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS". If another moderator or member has another way of approaching it, I'm sure they'll chime it.

What I would FIRST suggest doing. I see you also posted at a forum, which offers "Virus/Trojan/Spyware" help. They make use of HijackThis and various tools we don't utilize here. I have NO doubt, when they read your post from this morning, they will recommend you post the appropriate logs. If they feel a reformat or install is in order, they will suggest it.

Best of luck..
Carol

- Collapse -
Only a heads up..
Dec 25, 2011 11:04PM PST

Ed..

In case you hadn't seen it, you received a response to your post at the other forum you also posted at. As suspected, they requested you post at their "Virus/Trojan/Spyware Help - Tech Support Forum ", after following the instructions included within the reply.

Furthered good luck!
Carol

- Collapse -
Thanks
Dec 27, 2011 2:00AM PST

Carol,

- Collapse -
You're welcome, Ed
Dec 27, 2011 7:51AM PST

I know it's easier said then done, but sometimes it is the best course of action.

Better luck in the New Year! Happy
Carol