Endpoint Protection Small Business Edition

hii...

i am having one virus problem in my windows server 2003 r2 standard 64 bit operating system and some windows xp clients. i am using symantec endpoint protection 11 in server and clients. now in server am getting one error when everytime i am login to server. am attaching the file "Error". and i cannot access regedit and msconfig. when i am trying to access this am getting error that also am attaching file "error1". in clent i am getting the same qurantine message everytime...please help me to find a solution to remove this virus manually permanently and recover my regedit and msconfig without effecting operating system. please help me...

use this file to open registry

http://www.symantec.com/security_response/writeup.jsp?docid=2004-050614-0532-99

check the runonce and run registry key; 

restart the system in safe mode and run  a full scan.

Try this tool for the regedit,msconfig etc.

https://www-secure.symantec.com/connect/downloads/simple-utility-reset-folder-options-show-all-hidden-enable-registry-editing-enable-task-ma

you should try running a full scan using Norton Power Erazer or SEP in safe mode or Malwarebytes.

However make sure you are having current virus defs before running the scan.

thanks for your great support..but this one is not resolved my problem...i tried everything...no way!!!!!!!.....i am having the same problem in some of our client pcs....please help...

thanks for your great support..but this one is not resolved my problem...i tried everything...no way!!!!!!!.....i am having the same problem in some of our client pcs....please help...

Give the SERT tool a try to remove this threat. You can download it from your Fileconnect account.

http://www.symantec.com/business/support/index?page=content&id=TECH131732&locale=en_US

Video - https://www-secure.symantec.com/connect/videos/symantec-endpoint-recovery-tool-sert

"Pending Side Effect Analysis" is not usually the final word, as it were, by the scanning engine.  There is usually more information in the scan log as to what the final action was that was taken.

I agree with Cycletech, regarding SERT.  You may also wish to apply rapid release definitions, put the machine in Safe Mode and do a full system scan (say NO to any messages about trying to turn on Symantec Services--they will not run in Safe Mode).

Good luck!

sandra

hii everyone...

i intstalled node32...and it deleted that virus...now i cannot access regedit task manager and msconfig...but now i am not getting that message...it means that virus is removed and system is working...only problem is accessing those things...i tried mpam4_regedit_2k.exe and i can access regedit in win xp...but i din try this in my server...i am afraid about this doing in my server...nybody knows that kind of registry tool for windows server 2003...now when i am accssing task manager i am getting error message..can not find script file "c:\windows\system32\regedit.vbe"...any way to restore this file to get my xp regedit n taskmanager...i tried sfc \scannow...din work for me...but atleast i removed that virus from my clients...thank god...please help if nybody know about this...please...

Hi,

I would recommend you to disable messenger service on windows XP.I guess your OS is windows XP SP1.You should strongly consider updating to SP3

http://support.microsoft.com/kb/330904

Also use this symantec tool to restore access to regedit/task manager

http://securityresponse.symantec.com/avcenter/UnHookExec.inf

Just save UnHookExec.inf and install it by right clicking and selecting install. Installing the file will not show any popup or notice box.