Virus SevenDust C

[Azora]

Hi,

I run Norton AntiVirus 7.0.2 (latest Virus definitions!) and there is still this message from the standard protection of Antivirus when opening some progs like GoLive5 or PhotoShop6 and so on:

A strain SevenDust C was found and was successfully removed

How can I really remove it successfully?

[DeltaMac]

Go to the Extensions folder and delete the extension named ' 666'. Probably has a space at the beginning of the name

[Azora]

Hi Delta!

I have deleted everything named _666. But the problem is, that it appears again after rebooting!

[DeltaMac]

This virus has no payload, according to Symantec web site. Meaning, it presents no danger to files or apps, but your system remains infected. The Symantec site does not really give any removal instructions, except for the 666 file. Try the Agax program, download from versiontracker.com. If I remember, this program will remove the sevendust junk.

[Azora]

So, I have downloaded several different versions of Agax from different servers, but after unstuffing, it always says that it has a virus itself.

Do you know another one? Disinfectant 3.7.1 ?

[DeltaMac]

Go to http://asia.cnet.com/downloads/mac/s...068310s,00.htm You should temporarily disable NAV protection when you download this file, It's supposed to completely remove all forms of the Sevendust virus. NAV may not like this file, so temporaily turn it off. Once youv'e run this Agax Additive, you may want to keep it on an external disk, so if NAV alerts, you have a way of quickly removing it, The sevendust virus is several years old, but you found it once, you may see it again, Looks like the major updates to virus software no longer can remove sevendust, good luck!

[Azora]

Everything runs perfectly now!!!! And I hope it stays away...
Thank you very much for your help!

[Jasoco]

Yeah. The only way to safely keep Agax on the computer with the Virus is to lock the App. Which makes me wonder why they didn't lock it before stuffing in the first place??

I chased 666 off my old macs and even my old iMac a couple times before I finally got it killed.

Right now I actually have it sittin on my 8100 in the Extensions (Disabled) folder inactive. I don't know why it's there but at least it's not actually doing anything. I'll delete it next time I start up.