Win386.swp file query

Hi

My home Pc has picked up the Opas worm, not sure how, got thru Norton but it
did, anyway I've run the removal tool from Norton, applied a patch from MS
exactly as instructed, BUT it's still there. On restart I get an error
message saying scrsvr.exe is infected etc...I 'heal' it all ok but it comes
back.

One NG reports the worm can hide in the win386.swp file and you need to
delete this file, restart the PC, the file will recreate itself and all will
be well. Can i get some confirmation that this is ok to do, even if it
doesn't get rid of the worm I don't want to turn an irritating but small
problem into a much bigger one.

Thanks in advance

Tony H.

PS Apologies if this is the wrong NG, I couldn't find a more specific one to
the problem.

the win386.swp file will be recreated upon boot up. It doesn't hold anything
important, just temporary swap info. You can't delete it from windows, so
you'll have to do so from a dos prompt.
"Tony Hodson" wrote in message
...
Hi

My home Pc has picked up the Opas worm, not sure how, got thru Norton but
it
did, anyway I've run the removal tool from Norton, applied a patch from MS
exactly as instructed, BUT it's still there. On restart I get an error
message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
comes
back.

One NG reports the worm can hide in the win386.swp file and you need to
delete this file, restart the PC, the file will recreate itself and all
will
be well. Can i get some confirmation that this is ok to do, even if it
doesn't get rid of the worm I don't want to turn an irritating but small
problem into a much bigger one.

Thanks in advance

Tony H.

PS Apologies if this is the wrong NG, I couldn't find a more specific one
to
the problem.

Thanks for the quick reply, can you point me to some further instructions as
to how to do that?


Thanks in advance

Tony H.


"Robert Lawton" wrote in message
...
| the win386.swp file will be recreated upon boot up. It doesn't hold
anything
| important, just temporary swap info. You can't delete it from windows, so
| you'll have to do so from a dos prompt.
| "Tony Hodson" wrote in message
| ...
| Hi
|
| My home Pc has picked up the Opas worm, not sure how, got thru Norton
but
| it
| did, anyway I've run the removal tool from Norton, applied a patch from
MS
| exactly as instructed, BUT it's still there. On restart I get an error
| message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
| comes
| back.
|
| One NG reports the worm can hide in the win386.swp file and you need to
| delete this file, restart the PC, the file will recreate itself and all
| will
| be well. Can i get some confirmation that this is ok to do, even if it
| doesn't get rid of the worm I don't want to turn an irritating but small
| problem into a much bigger one.
|
| Thanks in advance
|
| Tony H.
|
| PS Apologies if this is the wrong NG, I couldn't find a more specific
one
| to
| the problem.
|
|
|
|

Also what do think about the point that the swp file could hold the worm and
therefore keep reinfecting?

Thanks in advance

Tony H.


"Robert Lawton" wrote in message
...
| the win386.swp file will be recreated upon boot up. It doesn't hold
anything
| important, just temporary swap info. You can't delete it from windows, so
| you'll have to do so from a dos prompt.
| "Tony Hodson" wrote in message
| ...
| Hi
|
| My home Pc has picked up the Opas worm, not sure how, got thru Norton
but
| it
| did, anyway I've run the removal tool from Norton, applied a patch from
MS
| exactly as instructed, BUT it's still there. On restart I get an error
| message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
| comes
| back.
|
| One NG reports the worm can hide in the win386.swp file and you need to
| delete this file, restart the PC, the file will recreate itself and all
| will
| be well. Can i get some confirmation that this is ok to do, even if it
| doesn't get rid of the worm I don't want to turn an irritating but small
| problem into a much bigger one.
|
| Thanks in advance
|
| Tony H.
|
| PS Apologies if this is the wrong NG, I couldn't find a more specific
one
| to
| the problem.
|
|
|
|

Well, that's going to depend on which version of windows your running. If
it's win98/win98se you should have a restart in dos mode option when you go
to shut down the computer. If it's ME, it's a little more complicated. I've
never heard of a virus hiding in the swap file, but that doesn't mean it's
not possible. First thing I would look to is to make sure your antivirus is
updated and running properly. Alot of the newer viri will terminate most
antivirus applications.
"Tony Hodson" wrote in message
...
Thanks for the quick reply, can you point me to some further instructions
as
to how to do that?


Thanks in advance

Tony H.


"Robert Lawton" wrote in message
...
| the win386.swp file will be recreated upon boot up. It doesn't hold
anything
| important, just temporary swap info. You can't delete it from windows,
so
| you'll have to do so from a dos prompt.
| "Tony Hodson" wrote in message
| ...
| Hi
|
| My home Pc has picked up the Opas worm, not sure how, got thru Norton
but
| it
| did, anyway I've run the removal tool from Norton, applied a patch
from
MS
| exactly as instructed, BUT it's still there. On restart I get an error
| message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
| comes
| back.
|
| One NG reports the worm can hide in the win386.swp file and you need
to
| delete this file, restart the PC, the file will recreate itself and
all
| will
| be well. Can i get some confirmation that this is ok to do, even if it
| doesn't get rid of the worm I don't want to turn an irritating but
small
| problem into a much bigger one.
|
| Thanks in advance
|
| Tony H.
|
| PS Apologies if this is the wrong NG, I couldn't find a more specific
one
| to
| the problem.
|
|
|
|

Tony Hodson wrote in message ...
Also what do think about the point that the swp file could hold the worm and
therefore keep reinfecting?

I think it is baloney.

Are you in compliance with EVERYTHING listed below.

BEFORE running the removal tool,
if you are using Windows 95/98/Me,
you MUST download and install the Microsoft patch from

http://www.microsoft.com/technet/sec...n/MS00-072.asp

NOTE: If you are on a network, or have a full time connection
to the Internet such as DSL or Cable modem,
you MUST disconnect the computer from the network
and the Internet before attempting to remove this worm.

If you have shared files or folders, these MUST be disabled.

When you have finished the removal procedure,
if you decide to reenable file sharing,
Symantec suggests that you do not share the root of drive C.
Share specific folders instead.
These shares must be password-protected with a secure password.
Do not use a blank password.



Thanks in advance

Tony H.


"Robert Lawton" wrote in message
...
| the win386.swp file will be recreated upon boot up. It doesn't hold
anything
| important, just temporary swap info. You can't delete it from windows, so
| you'll have to do so from a dos prompt.
| "Tony Hodson" wrote in message
| ...
| Hi
|
| My home Pc has picked up the Opas worm, not sure how, got thru Norton
but
| it
| did, anyway I've run the removal tool from Norton, applied a patch from
MS
| exactly as instructed, BUT it's still there. On restart I get an error
| message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
| comes
| back.
|
| One NG reports the worm can hide in the win386.swp file and you need to
| delete this file, restart the PC, the file will recreate itself and all
| will
| be well. Can i get some confirmation that this is ok to do, even if it
| doesn't get rid of the worm I don't want to turn an irritating but small
| problem into a much bigger one.
|
| Thanks in advance
|
| Tony H.
|
| PS Apologies if this is the wrong NG, I couldn't find a more specific
one
| to
| the problem.
|
|
|
|

The worm cannot hide in the SWP file. It is possible that a virus scan will
report the worm in that file, and that may indicate the worm is active, but
it cannot re-infect from within the file.
--
Jeff Richards
MS MVP (DTS)
"Tony Hodson" wrote in message
...
Hi

My home Pc has picked up the Opas worm, not sure how, got thru Norton but
it
did, anyway I've run the removal tool from Norton, applied a patch from MS
exactly as instructed, BUT it's still there. On restart I get an error
message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
comes
back.

One NG reports the worm can hide in the win386.swp file and you need to
delete this file, restart the PC, the file will recreate itself and all
will
be well. Can i get some confirmation that this is ok to do, even if it
doesn't get rid of the worm I don't want to turn an irritating but small
problem into a much bigger one.

Thanks in advance

Tony H.

PS Apologies if this is the wrong NG, I couldn't find a more specific one
to
the problem.

"Tony Hodson" wrote:

Hi

My home Pc has picked up the Opas worm, not sure how, got thru Norton but it
did, anyway I've run the removal tool from Norton, applied a patch from MS
exactly as instructed, BUT it's still there. On restart I get an error
message saying scrsvr.exe is infected etc...I 'heal' it all ok but it comes
back.

One NG reports the worm can hide in the win386.swp file and you need to
delete this file, restart the PC, the file will recreate itself and all will
be well. Can i get some confirmation that this is ok to do, even if it
doesn't get rid of the worm I don't want to turn an irritating but small
problem into a much bigger one.


Hi Tony.

Scrsvr.exe is 110% pure virus. You do not want to clean or salvage or
retain in any way even the slightest remnant of that file. Delete it
completely.

Good luck


Ron Martell Duncan B.C. Canada
--
Microsoft MVP
On-Line Help Computer Service
http://onlinehelp.bc.ca

"The reason computer chips are so small is computers don't eat much."

I'm trying really hard to delete it completely as you say. But after a few
days it reappears, my virus software picks up scrsvr.exe, we go through a
quarantine and delete procedure, remove the entry from the run folder in the
registry and the line in win.ini, BUT still it comes back. Incidentally
contrary to an earlier reply this PC is not on a network.

Anyone any other suggestions?--

Thanks in advance

Tony H.


"Ron Martell" wrote in message
...
| "Tony Hodson" wrote:
|
| Hi
|
| My home Pc has picked up the Opas worm, not sure how, got thru Norton but
it
| did, anyway I've run the removal tool from Norton, applied a patch from
MS
| exactly as instructed, BUT it's still there. On restart I get an error
| message saying scrsvr.exe is infected etc...I 'heal' it all ok but it
comes
| back.
|
| One NG reports the worm can hide in the win386.swp file and you need to
| delete this file, restart the PC, the file will recreate itself and all
will
| be well. Can i get some confirmation that this is ok to do, even if it
| doesn't get rid of the worm I don't want to turn an irritating but small
| problem into a much bigger one.
|
|
| Hi Tony.
|
| Scrsvr.exe is 110% pure virus. You do not want to clean or salvage or
| retain in any way even the slightest remnant of that file. Delete it
| completely.
|
| Good luck
|
|
| Ron Martell Duncan B.C. Canada
| --
| Microsoft MVP
| On-Line Help Computer Service
| http://onlinehelp.bc.ca
|
| "The reason computer chips are so small is computers don't eat much."

Tony

What version of Windows are you using? Why are you so sure you are still =
infected? Where is the message you are getting coming from? What is the =
exact wording of the error message?

--=20

~~~~~~


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any=20
suggested solution worked for you.
http://dts-l.org/goodpost.htm
~~~~~~~~~~~~~~~~~~~~~~~~


"Tony Hodson" wrote in message =
...
I'm trying really hard to delete it completely as you say. But after a =
few
days it reappears, my virus software picks up scrsvr.exe, we go =
through a
quarantine and delete procedure, remove the entry from the run folder =
in the
registry and the line in win.ini, BUT still it comes back. =
Incidentally
contrary to an earlier reply this PC is not on a network.
=20
Anyone any other suggestions?--=20
=20
Thanks in advance
=20
Tony H.
=20
=20
"Ron Martell" wrote in message
...
| "Tony Hodson" wrote:
|
| Hi
|
| My home Pc has picked up the Opas worm, not sure how, got thru =
Norton but
it
| did, anyway I've run the removal tool from Norton, applied a patch =
from
MS
| exactly as instructed, BUT it's still there. On restart I get an =
error
| message saying scrsvr.exe is infected etc...I 'heal' it all ok but =
it
comes
| back.
|
| One NG reports the worm can hide in the win386.swp file and you =
need to
| delete this file, restart the PC, the file will recreate itself and =
all
will
| be well. Can i get some confirmation that this is ok to do, even if =
it
| doesn't get rid of the worm I don't want to turn an irritating but =
small
| problem into a much bigger one.
|
|
| Hi Tony.
|
| Scrsvr.exe is 110% pure virus. You do not want to clean or salvage =
or
| retain in any way even the slightest remnant of that file. Delete =
it
| completely.
|
| Good luck
|
|
| Ron Martell Duncan B.C. Canada
| --=20
| Microsoft MVP
| On-Line Help Computer Service
| http://onlinehelp.bc.ca
|
| "The reason computer chips are so small is computers don't eat =
much."
=20