Ripper is in memory and cannot repair! 
Author Message
 Ripper is in memory and cannot repair!

Hi all

Win98SE machine.

Got a very remote user that has discovered that they have the ripper virus
in their system.  They seem to remember booting one day with a disc in the
floppy drive!

I've got them to use the McAfee Emergency disc to try and repair and all
appears well on boot now (no warning message) but if you try to run a scan
from within windows it reports ripper in memory.  If you disable the memory
check in the job it runs fine.

I've got them to run bootscan from a clean floppy and McAfee is finding it
but cannot fix it.

2 other machines detected ripper the same day but they were win95 and the
McAfee Emergency disc cleaned them no problem.

It's not the same disc being used on all machines.  All repair discs are
being created on clean machines using the same OS.

Where do I go from here.

All and any help welcome.

Barry



Tue, 11 Nov 2003 23:11:26 GMT  
 Ripper is in memory and cannot repair!
Hi,

you can visit http://vil.nai.com/vil/virusSummary.asp?virus_k=1037 for the
details of Ripper.

you can also get the final scan engine and Dat for emergency dat at :

http://www.mcafeeb2b.com/avert/avert-research-center/virus-4e.asp

you can also find some other tools of AVERT at :

http://www.mcafeeb2b.com/avert/avert-research-center/tools.asp

***** it is advised for the Ripper by NAI that, for Windows 95/98 OS :

Note for Windows 9x systems - during the boot process a Windows95 created
boot disk will access the hard drive for information. Because of this an
image of the virus may be in memory but not active.
To remove the virus, follow the following steps:
- If you use the McAfee emergency disk, hit F8 at the starting Windows 95
message, and select Step-by-step Configuration. Say yes to everything except
processing the autoexec.bat file.
- At the a:, type
BOOTSCAN C: /BOOT /CLEAN /NOMEM


Quote:
> Hi all

> Win98SE machine.

> Got a very remote user that has discovered that they have the ripper virus
> in their system.  They seem to remember booting one day with a disc in the
> floppy drive!

> I've got them to use the McAfee Emergency disc to try and repair and all
> appears well on boot now (no warning message) but if you try to run a scan
> from within windows it reports ripper in memory.  If you disable the
memory
> check in the job it runs fine.

> I've got them to run bootscan from a clean floppy and McAfee is finding it
> but cannot fix it.

> 2 other machines detected ripper the same day but they were win95 and the
> McAfee Emergency disc cleaned them no problem.

> It's not the same disc being used on all machines.  All repair discs are
> being created on clean machines using the same OS.

> Where do I go from here.

> All and any help welcome.

> Barry



Tue, 11 Nov 2003 23:37:20 GMT  
 Ripper is in memory and cannot repair!
Hi Orhan

Tried all this and console scan is still reporting that it's in the memory.

Barry



Quote:
> Hi,

> you can visit http://vil.nai.com/vil/virusSummary.asp?virus_k=1037 for the
> details of Ripper.

> you can also get the final scan engine and Dat for emergency dat at :

> http://www.mcafeeb2b.com/avert/avert-research-center/virus-4e.asp

> you can also find some other tools of AVERT at :

> http://www.mcafeeb2b.com/avert/avert-research-center/tools.asp

> ***** it is advised for the Ripper by NAI that, for Windows 95/98 OS :

> Note for Windows 9x systems - during the boot process a Windows95 created
> boot disk will access the hard drive for information. Because of this an
> image of the virus may be in memory but not active.
> To remove the virus, follow the following steps:
> - If you use the McAfee emergency disk, hit F8 at the starting Windows 95
> message, and select Step-by-step Configuration. Say yes to everything
except
> processing the autoexec.bat file.
> - At the a:, type
> BOOTSCAN C: /BOOT /CLEAN /NOMEM



> > Hi all

> > Win98SE machine.

> > Got a very remote user that has discovered that they have the ripper
virus
> > in their system.  They seem to remember booting one day with a disc in
the
> > floppy drive!

> > I've got them to use the McAfee Emergency disc to try and repair and all
> > appears well on boot now (no warning message) but if you try to run a
scan
> > from within windows it reports ripper in memory.  If you disable the
> memory
> > check in the job it runs fine.

> > I've got them to run bootscan from a clean floppy and McAfee is finding
it
> > but cannot fix it.

> > 2 other machines detected ripper the same day but they were win95 and
the
> > McAfee Emergency disc cleaned them no problem.

> > It's not the same disc being used on all machines.  All repair discs are
> > being created on clean machines using the same OS.

> > Where do I go from here.

> > All and any help welcome.

> > Barry



Tue, 11 Nov 2003 23:55:36 GMT  
 Ripper is in memory and cannot repair!

Hi Barry,

I guess it is the time to contact NAI Support team.

Good Luck !

Orhan


Quote:
> Hi Orhan

> Tried all this and console scan is still reporting that it's in the
memory.

> Barry



> > Hi,

> > you can visit http://vil.nai.com/vil/virusSummary.asp?virus_k=1037 for
the
> > details of Ripper.

> > you can also get the final scan engine and Dat for emergency dat at :

> > http://www.mcafeeb2b.com/avert/avert-research-center/virus-4e.asp

> > you can also find some other tools of AVERT at :

> > http://www.mcafeeb2b.com/avert/avert-research-center/tools.asp

> > ***** it is advised for the Ripper by NAI that, for Windows 95/98 OS :

> > Note for Windows 9x systems - during the boot process a Windows95
created
> > boot disk will access the hard drive for information. Because of this an
> > image of the virus may be in memory but not active.
> > To remove the virus, follow the following steps:
> > - If you use the McAfee emergency disk, hit F8 at the starting Windows
95
> > message, and select Step-by-step Configuration. Say yes to everything
> except
> > processing the autoexec.bat file.
> > - At the a:, type
> > BOOTSCAN C: /BOOT /CLEAN /NOMEM



> > > Hi all

> > > Win98SE machine.

> > > Got a very remote user that has discovered that they have the ripper
> virus
> > > in their system.  They seem to remember booting one day with a disc in
> the
> > > floppy drive!

> > > I've got them to use the McAfee Emergency disc to try and repair and
all
> > > appears well on boot now (no warning message) but if you try to run a
> scan
> > > from within windows it reports ripper in memory.  If you disable the
> > memory
> > > check in the job it runs fine.

> > > I've got them to run bootscan from a clean floppy and McAfee is
finding
> it
> > > but cannot fix it.

> > > 2 other machines detected ripper the same day but they were win95 and
> the
> > > McAfee Emergency disc cleaned them no problem.

> > > It's not the same disc being used on all machines.  All repair discs
are
> > > being created on clean machines using the same OS.

> > > Where do I go from here.

> > > All and any help welcome.

> > > Barry



Wed, 12 Nov 2003 00:41:55 GMT  
 Ripper is in memory and cannot repair!
Hi again Orhan

Thanks for trying.

The office is closed now until Tuesday (Bank holiday on Monday in UK).  I'll
give NAI a call on Tuesday and see if they can help.  Otherwise I'll swop
the drive out just to be on the safe side, unless somebody else has
something to add to this.

Barry



Quote:

> Hi Barry,

> I guess it is the time to contact NAI Support team.

> Good Luck !

> Orhan



> > Hi Orhan

> > Tried all this and console scan is still reporting that it's in the
> memory.

> > Barry



> > > Hi,

> > > you can visit http://vil.nai.com/vil/virusSummary.asp?virus_k=1037 for
> the
> > > details of Ripper.

> > > you can also get the final scan engine and Dat for emergency dat at :

> > > http://www.mcafeeb2b.com/avert/avert-research-center/virus-4e.asp

> > > you can also find some other tools of AVERT at :

> > > http://www.mcafeeb2b.com/avert/avert-research-center/tools.asp

> > > ***** it is advised for the Ripper by NAI that, for Windows 95/98 OS :

> > > Note for Windows 9x systems - during the boot process a Windows95
> created
> > > boot disk will access the hard drive for information. Because of this
an
> > > image of the virus may be in memory but not active.
> > > To remove the virus, follow the following steps:
> > > - If you use the McAfee emergency disk, hit F8 at the starting Windows
> 95
> > > message, and select Step-by-step Configuration. Say yes to everything
> > except
> > > processing the autoexec.bat file.
> > > - At the a:, type
> > > BOOTSCAN C: /BOOT /CLEAN /NOMEM



> > > > Hi all

> > > > Win98SE machine.

> > > > Got a very remote user that has discovered that they have the ripper
> > virus
> > > > in their system.  They seem to remember booting one day with a disc
in
> > the
> > > > floppy drive!

> > > > I've got them to use the McAfee Emergency disc to try and repair and
> all
> > > > appears well on boot now (no warning message) but if you try to run
a
> > scan
> > > > from within windows it reports ripper in memory.  If you disable the
> > > memory
> > > > check in the job it runs fine.

> > > > I've got them to run bootscan from a clean floppy and McAfee is
> finding
> > it
> > > > but cannot fix it.

> > > > 2 other machines detected ripper the same day but they were win95
and
> > the
> > > > McAfee Emergency disc cleaned them no problem.

> > > > It's not the same disc being used on all machines.  All repair discs
> are
> > > > being created on clean machines using the same OS.

> > > > Where do I go from here.

> > > > All and any help welcome.

> > > > Barry



Wed, 12 Nov 2003 03:21:37 GMT  
 Ripper is in memory and cannot repair!


 > Hi all
Quote:
> Win98SE machine.
> Got a very remote user that has discovered that they have the ripper

 > virus
 > in their system.  They seem to remember booting one day with a disc
Quote:
> in
 > the
> > floppy drive!

 <snip>

     See if they can use the boot virus remover at
http://www.invircible.com/iv_tools.php

Ben



Wed, 12 Nov 2003 07:00:37 GMT  
 Ripper is in memory and cannot repair!


Quote:
> Hi Orhan

> Tried all this and console scan is still reporting that it's in the

memory.

Go to www.complex.is and download FPROT. Boot to DOS from a known clean boot
disk and use that in accordance with the instructions for a dos based scan.



Wed, 12 Nov 2003 07:14:29 GMT  
 Ripper is in memory and cannot repair!
That would be a great idea if corporate policies did not forbid it.
F-prot's DOS version is free for home use but if you intend to use it in
your corporate computers you should pay

--
_______________
Jorge E. Jaramillo


Quote:



> > Hi Orhan

> > Tried all this and console scan is still reporting that it's in the
> memory.

> Go to www.complex.is and download FPROT. Boot to DOS from a known clean
boot
> disk and use that in accordance with the instructions for a dos based
scan.



Wed, 12 Nov 2003 21:31:09 GMT  
 Ripper is in memory and cannot repair!



Quote:
> That would be a great idea if corporate policies did not forbid it.

If corporate policies block something that is a good idea, the idea is still
good, its the policies that are bad.

Quote:
> F-prot's DOS version is free for home use but if you intend to use it in
> your corporate computers you should pay

I have. I was suggesting that someone try it to "get themselves out of jail"
with a problem, and I am quite sure when they see how good it is, they'll
want to buy a few licences to backtop their NAI scanner.


Thu, 13 Nov 2003 04:01:17 GMT  
 Ripper is in memory and cannot repair!
You've got a point there

--
_______________
Jorge E. Jaramillo
remove no spam to reply directly

Quote:

> > F-prot's DOS version is free for home use but if you intend to use it in
> > your corporate computers you should pay

> I have. I was suggesting that someone try it to "get themselves out of
jail"
> with a problem, and I am quite sure when they see how good it is, they'll
> want to buy a few licences to backtop their NAI scanner.



Thu, 13 Nov 2003 21:59:36 GMT  
 Ripper is in memory and cannot repair!
Thanks to all the above for their suggestions.

I have had the disc removed from the machine and DHL are delivering it
tomorrow, so I'll let you know how I got on.

Barry



Quote:
> You've got a point there

> --
> _______________
> Jorge E. Jaramillo
> remove no spam to reply directly

> > > F-prot's DOS version is free for home use but if you intend to use it
in
> > > your corporate computers you should pay

> > I have. I was suggesting that someone try it to "get themselves out of
> jail"
> > with a problem, and I am quite sure when they see how good it is,
they'll
> > want to buy a few licences to backtop their NAI scanner.



Sun, 16 Nov 2003 06:20:06 GMT  
 Ripper is in memory and cannot repair!


Fri, 19 Jun 1992 00:00:00 GMT  
 Ripper is in memory and cannot repair!
Very big thanks to Ben for his suggestion of ivinit.exe,  worked a treat.

Saved formating and re-installing, was a bit worried as it seemed to work so
fast and well but cannot find any trace of "Ripper" any more.

Thanks again Ben

To all others that made suggestions, never got round to trying them as Ben's
solution worked but thanks again.

Barry


Quote:
> Thanks to all the above for their suggestions.

> I have had the disc removed from the machine and DHL are delivering it
> tomorrow, so I'll let you know how I got on.

> Barry



> > You've got a point there

> > --
> > _______________
> > Jorge E. Jaramillo
> > remove no spam to reply directly

> > > > F-prot's DOS version is free for home use but if you intend to use
it
> in
> > > > your corporate computers you should pay

> > > I have. I was suggesting that someone try it to "get themselves out of
> > jail"
> > > with a problem, and I am quite sure when they see how good it is,
> they'll
> > > want to buy a few licences to backtop their NAI scanner.



Sun, 16 Nov 2003 19:49:14 GMT  
 
 [ 13 post ] 

 Relevant Pages 

1. Cannot Find DLL Component or Out of Memory???

2. Execute of ????.exe Failed, Cannot find DLL Component or Out Of Memory

3. cannot allocate memory

4. Memory cannot more than 1MG ?

5. Compilation cannot continue; not enough memory is available

6. ANN: Debian packages of FreeRIDE, FOX, FXRuby, Ripper, FXScintilla, etc

7. REQ: Gif to db ripper.

8. new application: RIP-L, a CD ripper/encoder

9. I am not deaf, but am I mute?

10. House in need of repairs?

11. Abt repairing a bmp in Application Model

12. REPAIR YOUR CREDIT- LEGALLY!

 

 
Powered by phpBB® Forum Software