General Discussion - Any way to remove this virus?

Print Page | Close Window

Any way to remove this virus?

Printed From: Web Wiz Forums
Category: General Discussion
Forum Name: General Discussion
Forum Description: General discussion and chat on any topic.
URL: https://forums.webwiz.net/forum_posts.asp?TID=5907
Printed Date: 30 March 2026 at 3:03am
Software Version: Web Wiz Forums 12.08 - https://www.webwizforums.com

Topic: Any way to remove this virus?

Posted By: PrivateEye
Subject: Any way to remove this virus?
Date Posted: 23 September 2003 at 5:54am

I have dual boot OS 98 SE and Win2K. Few days back I saw number of folder.htt and desktop.ini files in different folders. I scaned hard disk with Norton Antivirus 2002 (Virus def. updated on 15 Sep. 2003), it detected it as VBS/RedLof virus. Surprisingly Norton was unable to remove the virus from files. I can't keep these files in "Quarentine" because I have to use those HTML and ASP pages. I installed AVG, it did the same like NAV, detects but unable to remove virus from infected files. If anyone know which Antivirus can remove VBS/Redlof virus, please tell me. Any quick help is highly appreciated.

-------------
The Judgement Day

Replies:

Posted By: Bluefrog
Date Posted: 23 September 2003 at 6:25am

HTML is never "infected" with a virus, nor is ASP. They can have exploits, but not virii.

The safest thing to do is delete the files. If you can't do that, open them up with some kind of a debugger or hex editor and then cripple the virus or remove it manually. (e.g. Softice)

That is best done from a command line though, and not Explorer.

Posted By: eksimba
Date Posted: 23 September 2003 at 10:17am

Detailed instructions for removal can be found at http://securityresponse.symantec.com/avcenter/venc/data/html.redlof.a.html - Symantec's Security Response website dedicated to the HTML.Redlof.A virus.

The instructions say to delete the infected files.

Symantec wrote:

HTML.Redlof.A is a polymorphic, encrypted, Visual Basic Script virus that infects .html, .htm, .asp, .php, .jsp, and .vbs files on all drives. Depending on the location of the Windows System folder, the virus copies itself to either %windir%\System\Kernel.dll or %windir%\System\Kernel32.dll. It changes the default association for .dll files.

-------------
- eric

Posted By: PrivateEye
Date Posted: 23 September 2003 at 4:14pm

Thanks eksimba I trying to follow instructions at Norton website.

-------------
The Judgement Day