Computer virus "e card"?

Question

i was sent an "ecard" through my school's e-mail, and upon opening it my computer was sent a virus and it completely went hay wire. I called a friend and he told me to go to the task manager, close all running programs, and then shut down my computer and remove the battery. I did all of that and my computer started up fine but with a different desktop than I previously had. I also deleted the icon that had delivered the virus. I tried to uninstall it but it wasn't in my programs.

I now have two questions: until I can get my friend to look at my laptop, what's the best procedure to take? shut it down? leave it alone?

Also, I feel as if my school should be held liable for this. My friend opened the same thing two days prior and had to buy XP because she didn't have a backup. There was no warning e-mail advising us against opening anything. I wouldn't have known it happened to anyone else had I not mentioned it to my friend. Are they responsible for replacing my computer if it's, indeed, damaged?

Answer 1

no they are responsible and you shouldn't shut it down you should have ran you anti-virus and malware remover programs right away. the best thing to do now is to boot it up into safe mode and run them to try and clean out the virus.

Answer 2

eCard.exe contains a Win32.Trojan, which has different names depending upon which antivirus you use.  There are thousands of these being mailed daily to random recipients, and all users should be aware that ecards are NOT downloaded but viewed online.

Bets advice; leave it alone until your friend can loo at it, do NOT shut it down.

The following antivirus programs will remove this, each having their own definition file, so please UPDATE your antivirus

Arcavir……….….Trojan.Downloader.Agent.A...

AVAST! ……….…Win32:Agent-ABBH [Trj]

AVG ……………..SHeur.CCDK

BitDefender ……Trojan.Dropper.Delf.Crypt.K

CA (VET) ………..Win32/Bugnraw.DK trojan

ClamAV ……….…Trojan.Crypt-63

Dr.Web ……….….Trojan.MulDrop.18319

F-Prot……….…….W32/Dropper.YLQ

F-Secure ………..Trojan-Downloader:W32/Agent.HFP [Orion]

Fortinet……….….W32/Meredr!tr

Kaspersky.………Trojan-Downloader.Win32.A...

Microsoft ……….TrojanDropper:Win32/Rooter.A

nProtect……….…Trojan.Dropper.Delf.Crypt...

Sophos……….……Troj/Meredr-Gen

Symantec………...Trojan.Dropper

Trend Micro……..TROJ_NUWAR.JTZ

VirusBuster………Trojan.DR.FakeAlert.GE

If you do not use any of the above then scan online for free with either of the following:

Housecall:

http://housecall.trendmicro.com

or  BitDefender;

http://www.bitdefender.com/scan8/ie.html

To restore your desktop:

Remove Restrictions Tool:

http://www.softpedia.com/progDownload/RR...

Download from Softpedia Secure Download (RO), install, run and check all boxes then click Apply and then reboot. This tool re-enables what codecs/viruses have disabled.

Wallpaper Hijacker Removal Tool:

http://www.majorgeeks.com/Wallpaper_Hija...

Note: You should hit all "Repair" buttons even though it may not say "Found!" This will fix a wallpaper hijack everytime if all repair buttons are pressed.

Malwarebytes Anti-Malware:

http://www.download.com/Malwarebytes-Ant...

Download, install, update and select Full Scan.

Remove all infections that it finds after scan.

Spybot S&D:

http://www.safer-networking.org/en/downl...

Download, install, update and Immunize, turn off Tea Timer then click 'Check for problems' then when complete select all and then 'Fix Checked'

Spyware Doctor Free Basic Edition - Realtime monitoring:

http://pack.google.com/intl/en/pack_inst...

Its free with Google pack, untick all boxes except Spyware Doctor. Download install, update and run.

Comodo BO Clean:

http://www.comodo.com/boclean/CBO_downlo...

Simply download and install, follow instructions on screen.

Go here to see what it protects you against and removes:

http://www.comodo.com/boclean/trolist.ht...