How could I disinfect a PC using remote control tools?

[Emil]

Hi guys!

I'm right coming back !

I've some problems with a PC station at 300 Km from me.
The computer is connected through dial-up.
The virus (I think it's agobot) don't let user to stay on the net more than 2-10 minutes, because the computer is turned off.
I didn't find a free tools, that to have little size, to be quickly downloaded
Its were trying all resources: downloading trial version of NOD with a download manager, I've could instal a remote control server on that PC but I can't stay online more than the virus allow. Exist the posibility to scan the system piece by piece online, through the RC instrument? Other resources are not available.

Any solution (except formatting)?


Emil

[kjempen]

Has the infected user tried the "shutdown -a" command to abort system shutdown (I think this command works with both Windows 2000 as well as Windows XP)?

[steve1955]

can you send a set of kav bootable recovery discs with up to date defs?

[thecrow]

i tryed the NOD dos version once i had agobot but it coundt findt it all all
in windows it could find agobot but it was too late cause agobot shut the scanning off after 10-20 secs

so i ended up doing a reinstall but maybe theres a better way ?

but it was because i didnt download the newest windows update right away i got it on my system

that mistake i wont do twice..

[Emil]

Originally Posted by steve1955

can you send a set of kav bootable recovery discs with up to date defs?

1. It's a good ideea but I don't know where from I could find those discs..Let me know please

2. Maybe it's also better to try nod for dos but I don't know how could be updated (especially regarding also the post of thecrow). DOS version od nod I've not experienced yet. It could be useful for visuses as AGOBOT.

So?

Emil

[Emil]

For the 2nd way I have to know if I have XP with NTFS (so noddos is not useful), it's enough to restart XP in safe mode? In that case it's possible to AGOBOT shuting down the scanner?

Emil

[vinayms]

You can try using symantec removal tool for Agaobot(gaobot). We also had problems with nod initially when gaobot was released. Nod took some time updating the signatures.

vinu

[Mele20]

You might want to look at the thread I just started.
http://www.wilderssecurity.com/showthread.php?t=31602

You can download and run AVDisk (free and NOD32 is supported) and make bootable floppies with NOD32 definitions on them and AVDISK also supports NTFSDOS for NT based systems. Only bad thing (aside from the problems I am having running it) is that I just learned that the free NTFSDOS driver that comes with the download of NTFSDOS from systeminternals.com is the basic driver and that driver allows for read priviledges only so you can find the infection but you will not be able to disinfect. In order to disinfect, you will have to purchase a better driver from systeminternals.

[steve1955]

If you know anybody with kav installed on a pc there is an option to create them,they use linux so ntfs drives are scanned ok unlike dos(install a trial version on your pc,not demo!,and create some)
Steve