win32.perlovga

[Dreamer]

Happy new year for you all!

Please, could you people help me with this nasty problem here?

I got this virus, win32.perlovga. After a while thinking I succeeded in
removing it from my notebook. But it let a small but boring problem here.

When I go to "My Computer" and click in "C: " icon, a pop up warning appears
and says that windows could not find "copy.exe", which was one of the files
of this nasty virus. When I right-click the C: icon, a new option appears,
"autorun", in first place, when "open" should be there. I think the virus
has changed this thing. How can I put it right back? I don't wish to
format my hard disk. Thanks for any help.

Best wishes to you all.

[PA Bear]

The machine is still infected, most likely via P2P file-sharing!

W32/Salga.A
http://www.sophos.com/virusinfo/analyses/w32salgaa.html

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://aumha.net/viewforum.php?f=30,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7, or other appropriate
forums for expert analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)



Dreamer wrote:
> Happy new year for you all!
>
> Please, could you people help me with this nasty problem here?
>
> I got this virus, win32.perlovga. After a while thinking I succeeded in
> removing it from my notebook. But it let a small but boring problem here.
>
> When I go to "My Computer" and click in "C: " icon, a pop up warning
> appears
> and says that windows could not find "copy.exe", which was one of the
> files
> of this nasty virus. When I right-click the C: icon, a new option
> appears,
> "autorun", in first place, when "open" should be there. I think the virus
> has changed this thing. How can I put it right back? I don't wish to
> format my hard disk. Thanks for any help.
>
> Best wishes to you all.

[David H. Lipman]

From: "PA Bear" >

| The machine is still infected, most likely via P2P file-sharing!
|
| W32/Salga.A
| http://www.sophos.com/virusinfo/analyses/w32salgaa.html
|

"system copy.exe" is not "copy.exe" associated with this Trojan.

Usually the Trojan Perlovga is assocaited with "xcopy.exe".

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Dreamer]

Here is how I finally dealt with the right-click issue: Opened explorer,
tools, folder options, and in the file section I created a new action to
the unity icon, with explorer.exe, and it worked. I think I finally
finnished with this virus. Thansk for your help.



"Dreamer" > escreveu na mensagem
...
> Happy new year for you all!
>
> Please, could you people help me with this nasty problem here?
>
> I got this virus, win32.perlovga. After a while thinking I succeeded in
> removing it from my notebook. But it let a small but boring problem here.
>
> When I go to "My Computer" and click in "C: " icon, a pop up warning
> appears and says that windows could not find "copy.exe", which was one of
> the files of this nasty virus. When I right-click the C: icon, a new
> option appears, "autorun", in first place, when "open" should be there. I
> think the virus has changed this thing. How can I put it right back? I
> don't wish to format my hard disk. Thanks for any help.
>
> Best wishes to you all.
>
>
>

[Dreamer]

Just one more thing... I got this virus with a pen drive, that I have tested
in a store computer... when I connectec it to my notebook after testing, I
got the virus (it was in the pen drive).

"Dreamer" > escreveu na mensagem
...
> Happy new year for you all!
>
> Please, could you people help me with this nasty problem here?
>
> I got this virus, win32.perlovga. After a while thinking I succeeded in
> removing it from my notebook. But it let a small but boring problem here.
>
> When I go to "My Computer" and click in "C: " icon, a pop up warning
> appears and says that windows could not find "copy.exe", which was one of
> the files of this nasty virus. When I right-click the C: icon, a new
> option appears, "autorun", in first place, when "open" should be there. I
> think the virus has changed this thing. How can I put it right back? I
> don't wish to format my hard disk. Thanks for any help.
>
> Best wishes to you all.
>
>
>

[David H. Lipman]

From: "Dreamer" >

| Just one more thing... I got this virus with a pen drive, that I have tested
| in a store computer... when I connectec it to my notebook after testing, I
| got the virus (it was in the pen drive).
|

Correction. That's how you got this Trojan. It was NOT a virus.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm