Not Configuration or Virus..A stinking Worm!

Hi,

I want to thank everyone who took the time to answer my earlier questions. Rolling Rog..

I downloaded a program this morning called examiner32.

It allows you to search any kind of file for a string of text. You can even edit some of the files once it finds them.

I found a three files that all contained the words:

wormhole
payload
inproc32
dirty

The files are all in the WINNT/debug folder. I tried to delete them but I couldn't. I tried to boot from a 98 cd to boot from DOS when "safe mode" wasn't working, and I got an error message to the effect of it couldn't read the CDROM.

So.
I shut the computer down. It's a Shuttle MB/P4 processor.

I cleared the CMOS
Low level reformated the drive
Never went online.
Never installed a thing other than 2000 Pro
and the Video Driver off the disk that came with the Shuttle MB.

It was deja vu all over again. ms.dos, config.sys, IO.systems, schedglulog.txt, boot.ini in the straight Crive

Same problems. Those are:
I can't upgrade my 5. IE to 6 from a PC World CD, it always gives me the message "another installation of IE 6 is already in progress. please reboot

that I can only use IE 5 to surf the net 3 or 4 times before I get one error message or another, mostly that the homepage could not be found.

Then AOL (7.0) starts acting shaky as well.

The worm makes a dll with the same name as most of the exe files in the system32 folder. (or maybe it's the other way around)

Why isn't clearing CMOS and doing fdisk /mbr, reformatting the drive getting rid of this thing from H.E.double hockey sticks?

My firstborn to anyone who can figure this out.

I am truly stumped.

Dianne

 

Dianne, can you download, unzip and run the StartupList program from this site? Once you run it, just copy/paste the full results to a reply. This should allow us a good look at what is currently running on the system.

http://www.lurkhere.com/~nicefiles/

It could be that the floppy you used to fdisk/format from is itself infected. Have you tried downloading IE6 instead of installing from that CD?