help with possible virus !!!!

[LabR@t]

hi I have just taken a look at friend comp , i was informed that it kept shutting down after 5-60 mins of use. I felt sure this was a heat issue due to the fact he has down recent extensive building work (dust) so i stripped down and cleaned hs/fan reseated and gave genral clean

after checking temps which are ok ( P4_ cpuidel= 40 Sysidle=28)

the problem is after booting into XP after a few mins the calculator pops up and then computer shuts down.

does anyone know of any viruses that do this ???


please any advice would be handy as I cant keep comp up long enough to run v-scan, even in safe mode.



cheers

 

[Messiah Khan]

Not sure of the virus, but can you take a screenshot of the taskmanager, so we can see if there are and dodgy processes. Also, one way to fix it woulkd be to make sure your pc is fully up to date with AV software, and plug his harddrive into your machine and do the scan from there.

 

[LabR@t]

found some info now I know what im dealing with should be ok !

any linux distro i can boot off cd and scan with ??

When the attachment is run, the virus checks the system date. If the date is January 28, 2004 or later, the virus simply exits and does not propagate. Otherwise, the virus executes the standard Windows calculator program CALC.EXE. Meanwhile, the virus copies itself to the WINDOWS SYSTEM directory (%SysDir%) as bbeagle.exe , and creates a registry key to load itself at system startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "d3dupdate.exe" = C:\WINNT\System32\bbeagle.exe