Author Topic: worm_winur.c  (Read 8840 times)

0 Members and 1 Guest are viewing this topic.

katerina

  • Guest
worm_winur.c
« on: July 21, 2003, 03:26:53 PM »
Hello.New here...
I "picked up" the worm_winur.c probably from winmx.I used avast 4 home edition and pccillin but nothing works.I searched for information about this virus and I think I'm gonna have to delete it manualy.The problem is that I have neither sysdir-windir programm running  nor winrun.exe anywhere in my pc to delete it(as instructed by avast internet page).
The virus is located in C:/RESTORE/~.CPY files(in around 600 of them!!!!).
The problem I'm having by this virus is that my pc is extremely slow...it takes 5 seconds or so just to open the start button...
Any suggestions would be more than welcome!
Thank you very much!

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:worm_winur.c
« Reply #1 on: July 21, 2003, 03:33:09 PM »
It would be nice if you said which Windowsversion you use. You may read this  guide to delete the folder( The Systemrecovery) and create it  again. http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm .
Here are some infos about "your" Virus: http://www.virusbtn.com/resources/vgrep/vgrep.cgi?terms=worm_winur.c&product=0


« Last Edit: July 21, 2003, 03:34:39 PM by raman »
MfG Ralf

katerina

  • Guest
Re:worm_winur.c
« Reply #2 on: July 21, 2003, 03:45:55 PM »
 :D  that was fast!
I have windows 98.
I'll check the sites you suggest.Thanx a lot

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:worm_winur.c
« Reply #3 on: July 21, 2003, 03:49:16 PM »
Hm, Windows 98 does not have a Systemrecovery!? But you can shutdown to MS-DOS and type "deltree c:\restore" (without the "") that will delete the folder, too.

BTW: You can start Windows in safe mode and check the Startupsettings if the Virus will start at the normal Windowsstart by starting msconfig.exe.
« Last Edit: July 21, 2003, 04:00:24 PM by raman »
MfG Ralf

Offline Michal Zrůbecký

  • Avast team
  • Jr. Member
  • *
  • Posts: 83
    • avast! software
Re:worm_winur.c
« Reply #4 on: July 21, 2003, 03:55:02 PM »
 Disable the disputable feature of Windows ME or XP called SYSTEM
 RESTORE (to know how to do that refer to Windows help) and restart
 your computer. All file in folder C:\_RESTORE will be deleted. Then
 you can turn that feature on again, if you wish.
avast! support team

katerina

  • Guest
Re:worm_winur.c
« Reply #5 on: July 21, 2003, 04:26:04 PM »
well I disabled system restore and then enabled it.Now everything seems normal...I also run antivirus and found nothing! :) :)

problem solved!!Thank you everyone!
amazing! ;D
« Last Edit: July 21, 2003, 04:27:59 PM by katerina »

whocares

  • Guest
Re:worm_winur.c
« Reply #6 on: July 21, 2003, 06:27:37 PM »
well I disabled system restore and then enabled it.

Hi Katerina,
if you want to continue using System-Restore, got to windows-update and make sure that you have all the relevant patches installed..
otherwise, due a bug in ME-Restore, it will not properly restore the restore-Points made AFTER somewhen in 2001 (and who would want to go back this far in the past with his system...)

 ;)

Offline Michal Zrůbecký

  • Avast team
  • Jr. Member
  • *
  • Posts: 83
    • avast! software
Re:worm_winur.c
« Reply #7 on: July 22, 2003, 10:04:16 AM »
IMHO the feature System Restore is unusable. It only eats the disk space and stores viruses.  ;D
avast! support team

whocares

  • Guest
Re:worm_winur.c
« Reply #8 on: July 22, 2003, 01:30:18 PM »
Hi Odpad,

of course experienced users can do without RESTORE, or use better solutions, like Images.
But I've seen quite a few examples were it helped restore some system files/config ;)

katerina

  • Guest
Re:worm_winur.c
« Reply #9 on: July 22, 2003, 03:22:29 PM »
I'm definitely not an experienced user...  ::)

whocares

  • Guest
Re:worm_winur.c
« Reply #10 on: July 22, 2003, 04:05:33 PM »
Hi Katerina, have you done all the necessary Windowsupdates (check your Private messages) ?
otherwise RESTORE
 IS useless for you.. :)