photo album.zip

[Philip]

I don't think Avast can catch this worm, but you can give it a try by downloading the latest Avast antivirus definitions and doing a thorough scan of your system.

The Registry line HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\She llServiceObjectDelayLoad rdshost {5344BB88-3DE1-409F-8307-C85923A1F4DD} should read:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad rdshost {5344BB88-3DE1-409F-8307-C85923A1F4DD}

If you can't find this key, just do the other steps first.

[frankie7]

nah, i dont have those keys at all.

if i install sophos, after i get rid of this, can u uninstall sophos and return to my old anti virus, and this will still be gone ?

[Philip]

Frankie:

If you want to install Sophos, you've got to completely uninstall Avast first. If you intend to revert back to Avast, you've also got to completely uninstall Sophos after it's done its job of cleaning out that photo album worm. To ensure system stability, you should have only one antivirus program running.

I hope the above makes sense to you.

[melancholy]

I have tried to download Sophos but the installation process could not be completed because it says that simple file sharing needs to be disabled, how do I do that?

[Philip]

Originally Posted by melancholy

I have tried to download Sophos but the installation process could not be completed because it says that simple file sharing needs to be disabled, how do I do that?

Hi, and welcome to the BBB Forums. Here's how you can disable simple file sharing:

1. Open My Computer from the Start Menu or Windows XP Desktop. A new My Computer window will appear.
2. Open the Tools menu and choose "Folder Options" from this menu. A new Folder Options window will appear.
3. Click on the View tab and locate the "Use Simple File Sharing (Recommended)" checkbox in the list of Advanced Settings.
4. To disable Simple File Sharing, ensure this checkbox is not checked.
5. Click OK to close the Folder Options window. The settings for Simple File Sharing are now updated; no computer reboot is required.

Hope this helps.

[kunous]

I got the photo.zip virus too, but I just cannot find any rdfhost, syshost or any of the suggested names in "ShellServiceObjectDelayLoad", and cannot find photo.zip anywhere inside the computer...... please advise

[Philip]

Originally Posted by kunous

I got the photo.zip virus too, but I just cannot find any rdfhost, syshost or any of the suggested names in "ShellServiceObjectDelayLoad", and cannot find photo.zip anywhere inside the computer...... please advise

If you've really been infected, try looking for the photo album.zip file in your C:\Windows folder. In C:\Windows\System, find the rdfhost.dll, rdihost.dll or rdshost.dll files. Delete them.

[kunous]

the problem is I cannot find any of these files...... I've been reading a lot of solution online but seems none of them is applying to my situation

[Philip]

Hmmm...difficult one, this. Have any of your contacts reported that you've been sending them the photo album.zip file? If not, by some chance, you might have cleared it from your system (since you can't find those files mentioned). Have you tried running Window's Search function, Start > Search > For Files or Folders. Has your computer been displaying any symptoms of infection? (see post #1 in this thread)

[kunous]

The MSN Windows just keep popping up..... I did not see the actual message but my friends said they received my messages which containing the photo.zip file

I do search already, but no result come up