Begin of the article Mal/Behav-220 removal process
1.DownloadGoogle recommend safer browser Web browser, For more safe , Stay Secure on the Web and stay far away virus,Download URL http://www.oral8.net/firefox/firefox.htm
2. Temporarily Disable System Restore (Windows Me/XP).
3. Update the virus definitions. Reboot computer in SafeMode
4. Run a full system scan and clean/delete all Mal/Behav-220 infected files and Delete/Modify any values added to the registry.
Navigate to the subkey and delete the valuesas following:
Mal/Behav-220 is a malicious program for the Windows platform.
Detection for members of Mal/Behav-220 is behavior based. It is extremely important that customers report detections of Mal/Behav-220 to Sophos and send a sample for analysis.
Removing generically detected files
1. Using Enterprise Console
2. Sophos Anti-Virus for Windows, version 7
3. Sophos Anti-Virus for Windows, version 6
4. Windows 95/98/Me
5. Macintosh OS X computers
6. NetWare
7. Linux
8. UNIX
9.OpenVMS
1. Using Enterprise Console
You can remove generically detected files over a network using Enterprise Console.
2. Sophos Anti-Virus for Windows, version 7
To remove a generically detected file:
Close down all programs.
Go to Start|Programs|Sophos|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
In the 'Available scans' list, select the scan for which you want to enable removal, or use 'Setup a new scan' to scan your local disks. (Do not select a scheduled scan, as you will not be able to run this manually.)
Click Edit|Configure this Scan.
Select the Cleanup tab and select 'Automatically clean up items that contain virus/spyware'. Click Apply|OK.
Click 'Save and Start' to save the scan, and run it immediately.
At the end of the scan, click the link in 'Items passed to Quarantine' to open Quarantine manager.
Select any items needing removal.
From the 'Perform action' dropdown, select 'Delete'.
Select 'Yes' or 'Yes to all' to delete files.
Run another scan to ensure that the file has been removed.
Click Edit|Configure this Scan.
Select the Cleanup tab and deselect 'Automatically clean up items that contain virus/spyware'. Click Apply|OK.
If Sophos Anti-Virus cannot delete files because they are held open by the operating system, make a note of the names of the files, then do as follows.
Download an emergency copy of SAV32CLI. On an uninfected Windows computer, run this file to extract the contents into a SAV32CLI folder on a medium that can be write-protected. Copy the SAV32CLI folder produced onto a medium that can be write-protected. Add any relevant IDEs to this folder and write-protect the disk (on a CD/R or CD/RW close the session).
Restart the computer in Safe Mode. Go to Start|Shut Down. Select 'Restart' from the dropdown list and click 'OK'. Windows will restart. Press F8 when you see the following text at the bottom of the screen "For troubleshooting and advanced startup options for Windows 2000, press F8". In the Windows 2000 Advanced Options Menu, select the third option 'Safe Mode with Command Prompt'.
At the affected computer, place the CD in the CD drive (D: in this example). At the command prompt type
D:
to access the CD drive. Type:
CD SAV32CLI
Then type:
SAV32CLI -REMOVE -P=C:\LOGFILE.TXT
to remove the file.
Before leaving Safe Mode, edit any registry entries mentioned in the analysis recovery instructions. If problems persist, contact support.
3. Sophos Anti-Virus for Windows, version 6
To remove a generically detected file:
Close down all programs.
Go to Start|Programs|Sophos Anti-Virus and run the 'Sophos Anti-Virus' program.
In the 'Available scans' list, select the scan for which you want to enable removal. (Do not select a scheduled scan, as you will not be able to run this manually.)
Click Edit|Configure this Scan.
Select the Cleanup tab and select 'Automatically clean up items that contain a virus'. Click Apply|OK.
Click 'Save and Start' to save the scan, and run it immediately.
Click 'OK' when asked if files should be deleted.
Run another scan to ensure that the file has been removed.
Click Edit|Configure this Scan.
Select the Cleanup tab and deselect 'Automatically clean up items that contain a virus'. Click Apply|OK.
If Sophos Anti-Virus cannot delete files because they are held open by the operating system, make a note of the names of the files, then do as follows.
Download an emergency copy of SAV32CLI. On an uninfected Windows computer, run this file to extract the contents into a SAV32CLI folder on a medium that can be write-protected. Copy the SAV32CLI folder produced onto a medium that can be write-protected. Add any relevant IDEs to this folder and write-protect the disk (on a CD/R or CD/RW close the session).
Restart the computer in Safe Mode. Go to Start|Shut Down. Select 'Restart' from the dropdown list and click 'OK'. Windows will restart. Press F8 when you see the following text at the bottom of the screen "For troubleshooting and advanced startup options for Windows 2000, press F8". In the Windows 2000 Advanced Options Menu, select the third option 'Safe Mode with Command Prompt'.
At the affected computer, place the CD in the CD drive (D: in this example). At the command prompt type
D:
to access the CD drive. Type:
CD SAV32CLI
Then type:
SAV32CLI -REMOVE -P=C:\LOGFILE.TXT
to remove the file.
Before leaving Safe Mode, edit any registry entries mentioned in the analysis recovery instructions. If problems persist, contact support.
4. Windows 95/98/Me
To remove a generically detected file:
Check the threat analysis for details on the file and its removal.
Go to Start|Programs|Sophos Anti-Virus and run the Sophos Anti-Virus program.
Select the Immediate tab.
Go to Options|Configuration. Select the 'Disinfection' or the 'Action' tab, (according to what is displayed in your window) select 'Infected files', select 'Delete' then click 'OK'.
Click the green 'scan' arrow, or the 'GO' button (as appropriate) to run the scan.
Delete the file. Run another scan to check it has gone.
Go back to Options|Configuration. Select the 'Disinfection' or the 'Action' tab, then deselect 'Infected files' and 'Delete'. Click 'OK'.
Reboot and run a final scan to be certain it has gone.
If the file cannot be removed because it is held open by the operating system:
Reboot the computer from a clean startup or system disk.
Delete the file manually, or using the following DOS instructions:
You will need SWEEP for DOS on floppy disk. To do this, make a set of Emergency SAV disks.
Check the threat analysis for details on the file and its removal.
Reboot your PC from a clean system disk, put the SWEEP for DOS disk in the floppy drive and at the A: prompt type:
SWEEP *: -REMOVEF
5. Macintosh OS X computers
To remove a generically detected file:
Check the threat analysis for details on the file and its removal.
Close down all programs.
Run the Sophos Anti-Virus program.
Go to 'Sophos Anti-Virus preferences'.
Choose 'Disinfection' from the 'Immediate Mode' menu.
Select 'Infected Files' and 'Delete'.
Close 'Sophos Anti-Virus preferences'.
Click the green 'Play' arrow button.
Click 'OK' when asked if files should be deleted.
Run another scan to ensure that the file has been removed.
Go back to 'Virus Action' and deselect 'Infected Files' and Delete.
If problems persist, contact support.
6. NetWare
Note: This will delete any documents infected with macro viruses. Deal with them first.
Check the threat analysis for details on the file and its removal.
Run a scan to locate all files.
Select 'Delete' in the Removal mode option of the Immediate Mode menu.
Delete the files.
7. Linux
Check the threat analysis for details on the file and its removal.
Use savscan with the -remove option
savscan -remove
Run a scan to check that affected files were deleted.
8. UNIX
Check the threat analysis for details on the file and its removal.
Use SWEEP with the -remove option
sweep -remove
Run a scan to check that the files were deleted.
9. OpenVMS
Check the threat analysis for details on the file and its removal.
Delete the files by running VSWEEP from DCL using the command line qualifier '/REMOVEF'.
Note: '/REMOVEF' does not prompt for confirmation before deletion and should be used with caution.
For details on the use of these command line qualifiers and sample batch files using them, see the Sophos Anti-Virus for OpenVMS
5. Exit registry editor .
6.delete the IE temp files or you may download ATF temp files cleaner to run a full cleaning.and restart the computer.
8. Now you may remove Mal/Behav-220 successfully.
Affected operating systems Windows
Characteristics Installs itself in the registry
Included in our products from June 2008 (4.30)
Protection available since 21 April 2008 14:14:56 (GMT)
|
