virus help please!

  K.E 07:16 12 Aug 2003

I would appreciate any help with getting rid of 2 viruses. backdoor.IRC.cirebot and w32.spybot.worm. I use Xp and so far have disabled systems restore, updated the virus definitions and run a full system scan with norton antivirus 2002. however I cannot delete these two files. I'm not very technically minded so could really use any help anyone out there has

thank you!

  Jester2K II 07:29 12 Aug 2003

Can you get into Safe Mode and Scan from there??

click here Stinger can also remove the Spybot virus.

Why won't Norton Remove these? Any messages??

  temp003 08:32 12 Aug 2003

click here for backdoor.irc.cirebot. Disable System Restore first, then search for all instances of the file, and delete them. If you still can't, go into Safe Mode to delete them.

click here for w32.spybot.worm. Follow the removal instructions. You need to do a little more with this one.

  JIM 08:34 12 Aug 2003

I was like Jester2K II,

Why won't Norton Remove these? Any messages?
It is important to know what happened after the scan.

Norton may not solve the problem for you without
you being able to go into the Registry.I am not keen to push you in that direction on what you say.Will give you info and links to check out but you may need help from someone around you.


Shared drives: Spreads using the KaZaA file-sharing network, as well as
spreading through mIRC

removal easy.????

Run a full system scan.
If any files are detected as infected with W32.Spybot.Worm.

Write down the filenames, and then click Delete.

Type regedit

then click OK. (The Registry Editor opens.)

Navigate to the key:


In the right pane, delete any values that refer to the filename that was detected as infected with W32.Spybot.Worm.

Navigate to the key:


In the right pane, delete any values that reference the filename in step d.

Exit the Registry Editor. -----go to the link for the rest.

click here

Why Norton AntiVirus cannot repair files that are infected by a Trojan or a worm

click here

The Hacktool component of Backdoor.IRC.Cirebot consists of the following files:

Worm.exe (113507 bytes)

Worm.exe is an installer that creates the following files:




click here

  K.E 18:59 12 Aug 2003

thanks for all your help, when i run norton it doesn't give me any details as to why it can't be deleted or quarantined. I managed to get rid of the backdoor.IRC.cirebot using the instructions above but still have the W32.spybot.worm on after following the instructions. When I get to the part that asks me to delete the zero byte files from the start up folder I don't appear to have any listed with 0 bytes....

thanks again for any help you can give me!

  JIM 22:50 12 Aug 2003

Did you remember to disable Systems restore? try again with this below.

Can take a few attemps for the registry to bring the files up.

Just keep repeating the find for example in the registry in the Edit box,and after click on the find tab,type in SDJOIJE.EXE repeat the find next
a few times.

click here

4. Deleting the value from the registry

CAUTION: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

then click OK. (The Registry Editor opens.)

Navigate to the key:


In the right pane, delete the values:



"Winsock2 driver" ="SDJOIJE.EXE"

Navigate to the key:


In the right pane, delete the value:

"Winsock2 driver" ="SDJOIJE.EXE"

Exit the Registry Editor.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Huawei MateBook X Pro review

How Pentagram and other design agencies aim to double the number of creative female leaders

How to speed up a slow Mac

Comment résoudre des problèmes d’impressions ?