I am working with my wife's school accountant's computer. It is not usually on the internet, so was 6-9 months behind on updates, but she thought it had picked up a virus from her daughter's flashdrive.

After installing F-Prot 6 and updating the definitions, I scanned the computer. W32/Rungbu.A was found on a file docicon.exe under Microsoft Office/Office/ in the program files. It also found it on four files in the recycle directory: CTFMon.exe, Spoolssv.exe, SVCHost.exe and SMSS.exe. F-Prot quarantined the copies onder MS Office and the SMSS@.exe file. It "failed to quarantine" the other three files in the recycle bin. In fact, I had emptied the recycle bin before that.

While I was working, the computer also backed up Windows XP update files (it was currently up to 81% of the update traffic--remember that it had not been connected to internet for several months). I let it reboot to install the Windows XP updates.

Now when I reboot, under all of the user names and whether in Safe Mode or regular, the computer starts to set up according to the user name's preferences, then proceeds to turn off after saving personal parameters. It has done this dozens of times now.

F-Prot advises me that this would not seem to be an issue with the F-Prot update but rather with the Windows XP updates. I have tried various things, including Safe mode with command prompt, restoring the last good configuration (multiple times in case I need to go several steps back),

I generally go from the blue loading screen to the blue exiting screen, but sometimes I see the blank wallpaper for in instant, but too little to click anything--and none of the icons are visible anyway.

Jeff Hoover
Lubumbashi, DR Congo

Sometimes when a computer is infected with malware and you try to update it, you are updating on top of the malware and this can cause conflicts and problems. First of all, I need to know how much you can actually do with the computer. Can you boot into Safe Mode?

Second of all, I need to know what updates were installed and how behind the computer was on updates. Was it so out of date that it required an upgrade from Service Pack 1 to Service Pack 2?

Thanks

I cannot get fully into Safe Mode. The behavior is the same; the computer is loading parameters and then switches to saving parameters after only a few seconds glimpse of the Safe Mode desktop.

For more complete information for you: In addition to the W32/rungbu.A virus, some of whose copies were deleted and possibly some of which were still in the recycle bin, I later discovered another file in my wife's USB drive's recycle bin with a virus called W32/sillyworm.VV. I do not know whether that came from the accountant's computer; when Genevieve left Congo for France at the end of June, she thought her machine had gotten infected from her daughter's USB drive, so finding the first rungu infections was no surprise. The sillyworm infection may come from one of the computers in the computer lab, as it is hard to keep the antivirus up to date until the school got internet access last week.

I do not know which Windows XP updates were being installed the night the problem arose. The machine had been at our house and updated no earlier than early February while we were dealing with a year-close out issue with the accounting software provider. Certainly the machine had SP2 installed when it was new--in early 2005? You know well how Windows XP has to install certain updates by rebooting before it can install others; I THINK this was the first batch of updates that required rebooting, although it is possible not all of that batch had downloaded at the time I wanted to reboot for the antivirus operation. I don't know if you know which 2007 updates would have installed without first requiring other updates to install.

Jeff Hoover