Discovered: May 14, 2001
Updated: February 13, 2007 11:36:31 AM
Type: Virus
Run LiveUpdate to make sure that you have the most recent virus definitions.
- Start Norton AntiVirus (NAV), and then run a full system scan, making sure that NAV is set to scan all files.
- Delete any files detected as PHP.Carac.
- Examine each .php, .htm, or .html file to determine whether it contains virus code, and then edit these files to remove the code.
For example, if the virus file is named Virus.php, delete the file Virus.php and remove the following virus code from all php, .htm, or .htm files that have the code:
<php
include "virus.php"
/php>
- Edit the Script.ini file and remove the lines appended by the virus.
- Infected .sys, .vxd, .bat, .exe, and .ocx files in the Windows\System folder will have to be restored from a clean backup or by reinstalling Windows.
Writeup By: Peter Ferrie
Technorati
Digg
Delicious
Reddit
StumbleUpon
Yahoo Buzz
Twitter
Facebook
Newsvine