My virus story:
HOW I GOT RID OF A COMPUTER VIRUS.


I still find it hard to believe that I had a computer virus for at least 11 months.

It all started when a client of mine brought his computer over to my office. After working on his accounting files for 3 days, we decided to swap some data files. When I moved a disk from my computer back to his, his Norton Anti-Virus program told him that there was a virus on the disk!

At first I could not believe it, because both of my computers had been working flawlessly for at least a year.

I have used Microsoft Anti-Virus many times and it did not detect any viruses.

The NAV program called it the Monkey_B virus.

I got rid of the virus on the floppy diskette using his NAV and double checked the data. Everything seemed fine until several hours later I noticed the data was inconsistent. If fact, after about 8 hours of trying to recover the file, I declared it corrupt. The virus probably destroyed the fat table listing of the file and parts of it were probably missing.

After 3 days of re-entering all the data [argghh!!], I tried to use a shareware version of McAfee Anti-Virus downloaded from the Net. The McAfee Anti-Virus program told me it was the Monkey_A virus.

McAfee detected the virus, but it could not get rid of it.

In order to disinfect my computer I needed to boot from a clean boot diskette on both of my computers. I tried to do this from all of my boot diskettes and emergency disks, but they would not work! I could only get to Drive A and Drive C. The other 2 drives [D & E] I could not access. The virus I suspect.

(The Monkey virus is a Boot Sector and Fat table virus and you loose information when it corrupts those).

By this time my client had taken his computer home and I could not create a clean diskette. I could not get McAfee to create a new boot diskette, and disinfectant diskette, so I purchased Norton Anti-Virus. With NAV I was able to boot directly from an original MS-DOS disk and disinfect both of my computers.

I discovered that once I removed the virus from my MS-DOS 6.22/Windows 3.11 computer, I lost an entire hard drive [D:]. I had backed up most of my files, so I was not worried, but it had about 350 directories and 4000 files on it. Lots of work again.

On my DOS-7.0 and Win95 computer everything worked flawlessly and everything seems to work fine now. No loss of data. However NAV identified the virus there as:

empire.stoned.monkey.

I spent several hours cleaning off my floppy disks. The earliest disk I discovered that had the virus was an old backup disk dated April, 1995! Virtually every disk after that date [that was not write-protected] had the virus! I had the virus for at least 11 months and did not know it! During that time I had swapped floppies with many dozens of customers and friends. I contacted each one of them to let them know of the danger. I shudder to thinkhow many people I could have infected or continue to infect.

I still have McAfee loaded and running its Virus Shield on my Win95 computer and NAV on my Win3.11 computer. I am going to compare the two to see which one works better.

Drop me a note if you have had a similar experience. Maybe you should download McAfee and scan your computer to see if you have a hidden virus. You may be surprised!!


Some replies and advice:

I've dealt with a few virus's in my time and I have found that McAfee is a great virus scanner but that F-PROT will excel where McAfee doesn't..... for this reason, I recommend scanning with at LEAST two different scanners (myself I use McAfee and F-PROT). Also, with the virus you had if you had booted and ran FDISK /MBR on the drive it probably (not for sure, if you had the virus in memory this wouldn't work) would have elminated the virus by over writing it!.

another note: MS-Anti-Virus doesn't work well at all :). Also, I STRONGLY recommend you get a Win 95 anti virus program because Win 95 renders MANY of the scanners and techniques useless (it also gives virus's several new avenues to get into your computer and reak havok :).

Hope that helps for future dilemma's! (Glad to see your friend scans all his disks... imagine what the trouble would be now if he didn't :).


Funny you should E-Mail me about a computer virus. Right after I talked to you I put on my Norton Anti-Virus and I'd be darned if I did'nt find a Shark 1027 (1) Virus. Norton was unable to clear this up and I know the limitiations of McAphee because I had one. Right now I'm thinking of "ThunderBTYE". I have the information on how to get it in town. If you have any copies I'd buy one.

Thanks, Jimmy


I can sympatsize with you. I lost a 35,000 dollar editing computer to the Michelangelo virus on the 5th. God that was a nightmare!

Since then, I have implemented certain steps to prevent this kind of thing happening again. I have found that Windows 95 is ACTUALLY a good platform for controlling large hard drives (i have 9 gigs) and using the compination of Norton Anti-Virus and Norton Utilities (which I run every Monday and Wednesday and Friday).

Gord


Any doubt, get a second opinion. In this case the opinions come from the virus checker programs. I would seriously recommend TBAV or the Thunder byte anti-virus utility. They update their product every 2 months and the TBAV has several ways to detect polymorphic viruses (ones that evolve and alter their coding as they go along). Just go to a WWW search engine and look for TBAV or Thunder byte or Anti-Virus Utilities. You should be able to find a shareware version there. I know this may sound like closing the gate after the horses are out, but run through a virus session once ever 2 months.