[Tom-boy]

Somehow I managed to get this worm. It's supposed to register keystrokes and send them out. So far, I've veen able to prevent it from accessing the net but I can't get rid off it. Virus scanner, Ad-Aware or Spybot won't recognise it, so I can't delete it. What the heck?
Oh, I'm running Win2kPro + SP3.

[sapiens74]

I have always believed in a complete format and reinstall when a nasty worn hits.


Any other method and you just cant be sure

[Sampson]

According to PestPatrol this is a keylogger also known as Starr. This is their take on removing it: http://www.pestpatrol.com/PestInfo/other/007_starr.asp

[Tom-boy]

Success, thank God! I had to try every trick and then some suggested by pestpatrol until I got rid off it. The SOB just wouldn't die. Thanks Sampson
@ sapiens 74- Yeah, you have a point there. If struck by a clear cut malicious worm, which you can't get ridd off by ordinary means, there really isn't much you can do but format. Searching help from the web would be downright irresponsible, for instance. However, I'm in the process of installing Mandrake aside Win2k, so just wouldn't want to go and do the whole shite all over again, if at all possible.

[sapiens74]

Invest in some backup software like Drive IMage 2003

Make an backup of your hard drive and then downtime and resintalling will be easy

[Tom-boy]

Hmm. Since dealing with CDs is such a drag and not even very safe alternative for backups, I'll have to think about that.
Thanks

[PascalB]

Sorry, I am french with a poor knowledge in IT, so be kind with me

Could somebody explain to me with simple words how to remove this svcini.exe from my windows 98SE ?

For the time being, Norton has moved it in a temporary file. I contacted Symantec who told me that I can definitively removed this file from my computer but when I reboot my machine, Windows request me this file

I tried to remove the command line in my win.ini file but it comes again the next reboot...

Do not ask me to format my disk, I am not able to do that

How could I proceed ???

[cornflake]

post a hijackthis log. There is a spyware program trying to load this file. It is unable to do so since the file has been quarantined. The HijackThis log will help to show where the bad processes are.