More Virus Protection

Virus KB Articles

• How to prevent and remove viruses and other malware
  Discusses how to remove viruses, spyware, rogue software, malware, Microsoft Security Essentials, Microsoft Safety Scanner and Windows Defender Offline Beta.
• Virus alert about the Blaster worm and its variants
  On August 11, 2003, Microsoft began investigating a worm that was reported by Microsoft Product Support Services (PSS), and the Microsoft PSS Security Team issued an alert to inform customers about the new worm. A worm is a type of computer virus that...
• A diagnostic program may immediately close and you may receive a "Stop error code 0x00000050" (PAGE_FAULT_IN_NONPAGED_AREA) or "Stop error code 0x0000000A" (IRQL_NOT_LESS_OR_EQUAL) error message in Windows Server 2003, Windows 2000, or Windows XP
  Describes a Stop error 0x00000050 (error 0x50) (PAGE FAULT IN NONPAGED AREA) or Stop error 0x0000000A (error 0x0A) (IRQL NOT LESS OR EQUAL) problem that may occur if a computer is infected with a variant of the Sdbot virus.
• Virus alert about the W32/Braid@mm worm
  Describes the attack impacts and the characteristics of the mass-mailing worm, W32/Braid@mm. The article also discusses how to prevent infection from the worm and how to recover from the infection if your computer has been infected with this virus.
• Virus alert about the W32.Fizzer.A@mm worm
  Describes the attack impacts and the characteristics of the W32.Fizzer.A@mm mass-mailing worm. The article also discusses how to prevent infection from the worm and how to recover from the infection if your computer has been infected with this virus.
• Virus alert about the W32.Lirva.A@mm worm
  Describes the attack impacts and the characteristics of the mass-mailing worm, W32.Lirva.A@mm. The article also discusses how to prevent infection from the worm and how to recover from the infection if your computer has been infected with this virus.
• Virus alert about the Mydoom and Doomjuice worm variants for Outlook and Outlook Express products
  Provides general information about the new Mydoom and Doomjuice worm variants for Outlook and Outlook Express products. You are provided with the links to Microsoft Web sites where you can get more detail information about these virus.
• A tool is available to remove Blaster worm and Nachi worm infections from computers that are running Windows 2000 or Windows XP
  After you install the 823980 security update or the 824146 security update on a computer that is infected with the Blaster worm or the Nachi worm, the computer may continue to generate network traffic on the affected Transmission Control Protocol/User...
• Virus Alert about the W32/Mimail@MM Virus
  The W32/Mimail@MM is a new e-mail worm. The Microsoft Product Support Services Security Team is issuing this alert to inform customers about this new worm. This worm appears to be spreading. Best practices, such as applying security patches, should...
• You receive a "Control ID not found" error message when you try to install Windows XP Service Pack 2 or Windows XP Tablet PC Edition 2005
  Describes behavior that occurs because the eTrust antivirus program detects a lock on a file and logs an error. A workaround is provided. You may have to contact Computer Associates for a resolution. See KB article 129972 about viruses.
• You receive an error message when you try to start a program that has an.exe file name extension
  Explains how to remove the Swen worm from your computer.
• You are prompted to accept or reject certain Windows Messenger files in Windows XP Service Pack 2
  Explains that when you receive a Windows Messenger file in Windows XP Service Pack 2, you may be prompted with a warning message.
• How to recover from a computer virus infection and how to prevent future infections from computer viruses in Windows operating systems
  Describes how to recover from a computer virus infection and how to prevent future infections from computer viruses in Windows operating systems.
• You cannot start or install Excel and the Excel.exe file on your hard disk is renamed as Excel.exe.vir
  Explains that you receive a 1706, 1309, or 1911 error message, and the name of Excel.exe file changes when you try to start or to reinstall Excel.
• Project Server users with MSDE 2000 installed may be vulnerable to the Slammer worm
  Explains that the SQL Server Desktop Engine (MSDE 2000) that is included with Project Server 2002 may be vulnerable to the Slammer worm. You must install the SQL Server 2000 Critical Update Wizard or SQL Server 2000 SP3 to resolve this problem.
• Description of how the Attachment Manager works in Microsoft Windows
  The Attachment Manager classifies files that you receive or that you download based on the file type and the file name extension. The Attachment Manager classifies files types as high risk, medium risk, and low risk.
• Computer stops responding with a black screen when you start Windows XP
  Describes what to do if you cannot start Windows XP because the computer stops responding (hangs), and the screen goes black instead of displaying the Windows XP logo after the power-on self test (POST) is completed.
• Mydoom, Zindos, and Doomjuice Worm Removal Tool
  Provides information about how to use the Microsoft Mydoom Worm Removal Tool. Includes answers to frequently asked questions.
• A tool is available to remove the Sasser worm variants
  Provides information about how to download and use the Microsoft Sasser Worm Removal Tool and provides answers to frequently asked questions.
• Update Available for Scriptlet.Typelib and Eyedog Security Vulnerability and the BubbleBoy Virus
  Microsoft has released an update that eliminates security vulnerabilities in the following two ActiveX controls: Object for constructing type libraries for scriptlets (Scriptlet.Typelib) Eyedog For more information about these controls, view the...
• How to help protect your computer if you decide to remove Windows XP Service Pack 2 from your Windows XP-based computer or from your Windows XP Tablet PC 2005-based Tablet PC
  Describes how to help protect your computer if you decide to remove Windows XP SP2 from your computer or from your Tablet PC. Includes steps to turn on Internet Connection Firewall.
• You are prompted to save the changes to the global template every time that you exit Word 2007 or Word 2010
  Describes a problem where you are prompted to save the changes to the Normal.dotm global template every time that you exit Word 2007. Provides workarounds.
• You may receive an error message on a Windows-based computer: "STOP 0x00000050" or "STOP 0x0000008e"
  Explains that the HaxDoor virus may generate a Stop error message or restart your computer in Windows Server 2003, Windows 2000, or Windows XP. You can manually remove the variant of the HaxDoor virus to resolve this issue.
• Your Internet Explorer home page is reset to "about:blank" and Windows Defender unexpectedly quits in Windows 2000, Windows XP, or Windows Server 2003
  Describes a problem where your home page is reset and Windows Defender unexpectedly quits. When this problem occurs, your computer may be affected by the TrojanSpy:Win32/Banker Trojan horse program.
• You receive a "Data Execution Prevention" error message in Windows XP Service Pack 2 or in Windows XP Tablet PC Edition 2005
  Describes the Data Execution Prevention feature in Windows XP Service Pack 2 and why the feature may generate an error message.
• Multimedia Files on Your Hard Disk May Move to Another Folder and May Be Renamed
  You may discover that multimedia files on your hard disk are missing from their original location and the files may be renamed with "change atleast now to LINUX" in the file name extension. You may also discover that e-mail messages that you send...
• Indications of Virus Infection from the W32/KRIZ Viruses
  You may receive an error message related to the Krized.tt6 file. The error message may look similar to any of the following error messages: -or- -or- -or- -or- -or- You may also experience slow performance when you try to browse network shares.
• Virus Alert About the "W32.Chir.B@mm" Virus
  W32.Chir.B@mm is a network-aware, mass-mailing worm. It is also a file-infector virus. W32.Chir.B@mm is a variant of W32.Chir@mm. W32.Chir.B@mm uses its own Simple Mail Transfer Protocol (SMTP) engine to send itself to all of the e-mail addresses that...
• Incoming mail flow stops, or the SMTP service fails when you try to fail over a node in Exchange Server 2003 or in Exchange 2000 Server after you install McAfee VirusScan Enterprise
  Describes a known issue that occurs because the Access Protection feature in McAfee VirusScan Enterprise blocks port 25. Provides a resolution.
• McAfee Internet Security version 4.0 quits unexpectedly during installation in Windows XP Service Pack 2
  Describes an issue where McAfee Internet Security version 4.0 quits during installation.
• Computer Stops Responding (Hangs) When Opening a Large Local File
  If you installed TCP/IP, and you open a large file from your hard disk, the computer does not respond (hang). It may also take a long time for the computer to find a Local Area Network (LAN) resource.
• How to reduce the chances of macro virus infection in Word
  This article describes ways you can reduce the risk of infecting Microsoft Word and your documents and templates with macro viruses.
• New York Boot (NYB) Virus
  The New York Boot (NYB) virus is a simple Master Boot Record (MBR) virus. It is a stealth virus and is contracted when an infected floppy disk is started. The virus was previously known as Stoned.i, B1 and was discovered in 1995. This virus creates a...
• Virus Alert About the w32.Myparty@mm "My Party" Worm Virus
  The w32.Myparty@mm virus is a mass-mailing e-mail worm that sends e-mail messages to everyone in the Windows Address Book and by searching for e-mail addresses in Microsoft Outlook Express Inboxes and folders.
• You receive an error message in a program that interacts with Word 2000 when Norton AntiVirus or SystemWorks is installed on your computer
  Describes how you receive an error message in version 2000 of Project, Excel, Office Binder, Outlook, PowerPoint, or Publisher that is interacting with Word 2000 when Norton AntiVirus or SystemWorks is installed on your computer. Provides a workaround.
• Information About the .NET W32.Donut Virus
  If you run the W32.Donut virus, the virus attempts to infect all .exe files that contain .NET code in the folder that contains the virus and up to 20 parent folders. After the files are infected, the virus replicates. You can identify infected files...
• Virus Alert About the "Frethem" Virus
  The W32.Frethem.J@mm and W32.Frethem.K@mm worms are mass-mailer worms that are variants of the W32.Frethem.B@mm worm.
• Computer Stops Responding or an Error Message Is Displayed When Running ScanDisk or Disk Defragmenter
  When you run ScanDisk, Disk Defragmenter, or other hard disk tools, such as Symantec Norton Disk Utilities 2000, your computer may stop responding (hang). Or, ScanDisk, Disk Defragmenter, or other hard disk tools may run, but you may receive the...
• Information About the VBS.LOVELETTER Worm Virus
  After you receive an e-mail message with an "'ILOVEYOU' Message 'kindly check the attached LOVELETTER coming from me'" subject and a LOVE-LETTER-FOR-YOU.TXT.vbs attachment, you may experience the following behaviors on your computer: Files with the...
• You May Receive a Macro Warning Message When You Open an Office Program and Files May Be Deleted That You Did Not Delete
  When you open a Microsoft Office document, you may receive the following macro warning message: This warning message does not necessarily mean that you computer is infected with a virus. Also, you may discover that files on your computer have been...
• Error Message: Wininit.exe Cannot Be Run from Within Windows
  When you start your computer, you may receive the following error message:
• Virus Hoax: Microsoft Debugger Registrar for Java (Jdbgmgr.exe) Is Not a Virus
  There is a virus hoax that advises customers to delete a valid Windows file that is named Jdbgmgr.exe. This file is the Microsoft Debugger Registrar for Java. If you receive the e-mail message that is listed in the "More Information" section of this...
• How to deal with a macro virus in Word 2000 or Word 2002
  Describes some of the symptoms that a Word macro virus may cause or exhibit. For a long-term solution to macro viruses, we recommend that you install antivirus software that is specifically designed to detect macro viruses.
• Description of plain text mode in Outlook Express in Windows XP Service Pack 2
  Describes the differences between plain text mode and HTML in Outlook Express. Also explains why you may want to use plain text mode and how to switch between plain text mode and HTML.
• "Installation failed: Access is denied" error message when you try to perform a remote installation of Computer Associates eTrust Antivirus 7.0 client software on a computer that is running Windows XP Service Pack 2
  Explains that you cannot perform a remote install of the eTrust Antivirus client on a Windows XP SP2-based computer because of changes that were made to the Remote Procedure Call service. Includes two workarounds.
• McAfee Virusscan Professional version 6.0 quits unexpectedly after you install it on a Windows XP Service Pack 2-based computer
  Describes an issue where McAfee Virusscan Professional version 6.0 quits unexpectedly after you install it on a Windows XP SP2-based computer.
• Pictures do not appear as expected, or you receive an error message when you open an HTML file on a Windows XP Service Pack 2-based computer
  Describes some issues that may occur when you view an HTML file in a Windows-based program or in Internet Explorer. These issues may occur after you install Windows XP Service Pack 2. To resolve these issues, you must change a registry setting.
• Virus Protection and Security Patch Information for Windows 2000 and Windows NT 4.0
  This article describes how to obtain the latest security information for Windows 2000 and Windows NT 4.0. You can use the links in this article to download security hotfixes, patches, and updates that may protect your computer from a malicious user....
• A Norton AntiVirus 2003 scan that is scheduled to run when your computer starts does not start in Windows XP Service Pack 2
  Describes a problem where Norton AntiVirus 2003 scans that are scheduled to run when your computer starts do not complete. To work around this problem, run the scan manually after you log on.
• SOURCENEXT VirusSecurity2004 real-time monitor does not work correctly on a Windows XP Service Pack 2-based computer
  Discusses an issue where the SOURCENEXT VirusSecurity2004 Real Time Scanner Service does not start after you install Windows XP Service Pack 2.
• WD97: No Macro Warning Opening File in Template Folder
  The macro warning message does not appear when you attempt to open a document or template that contains macros.
• WD97: What to Do If You Have a Macro Virus
  The first macro virus was discovered in the summer of 1995. Since that time, other macro viruses have appeared. This article describes what to do if you think you might have a Word macro virus, or if you want to ensure that your documents never become...
• WD98: What to Do If You Have a Macro Virus
  The first macro virus was discovered in the summer of 1995. Since that time, other macro viruses have appeared. This article describes what to do if you think you might have a Word macro virus, or if you want to ensure that your documents never become...
• Virus warning appears when you click hyperlink to program
  When you click a hyperlink to go to an object or location outside of your PowerPoint presentation, you may receive the following warning message: This behavior occurs whether or not the Macro Virus Protection option is turned on. (To locate the Macro...
• WD98: No Macro Warning Opening File in Template Folder
  The macro warning message does not appear when you attempt to open a document or template that contains macros.
• WD97: Macro Warning Doesn't Appear Opening File Attached to Template That Contains Macros
  When you open a Word document or RTF format file that is attached to a template that contains macros, the macro virus warning message may not appear. Word provides a macro warning message when a document that contains a macro is opened; however, if...
• OL2000: Error Message: "The Operation Failed ..." After Happy99 Virus
  When you attempt to send a mail message with Microsoft Word as your e-mail editor, you may receive the following error message: The operation failed due to network or other communication problems. Check your connections and try again. This problem...
• Script blocking software prevents installation or use of Visual Studio .NET, Visual Studio 2005, or prerequisites
  Describes that when you use Visual Studio .NET or Visual Studio 2005 on a computer that has McAfee VirusScan antivirus software enabled, you will receive some error messages. Provides a resolution for the issue.
• How to configure Forefront Security to send e-mail notifications to users about filtered e-mail messages or documents
  Describes how to configure e-mail notifications to warn senders and recipients of virus infected messages or of keyword filter matches that are detected in Forefront Security.
• How to Use the Virus Search Add-in for Microsoft Excel (WE1280)
  The Application Note "Virus Search Add-in" (WE1280) is now available from Microsoft. The disk included with this Application Note includes versions 1.2 and 2.0 of the add-in. You can use the add-in to remove the Excel Macro/Laroux concept virus, which...
• WD: Frequently Asked Questions About Word Macro Viruses
  This article answers some of the more frequently asked questions concerning Word macro viruses.
• WD97: Frequently Asked Questions About Word Macro Viruses
  This article answers some of the more frequently asked questions concerning Word macro viruses.
• WD97: "Can't Find Project or Library" When You Run a Macro
  In Microsoft Word, when you attempt to run a WordBasic macro that has been converted to a Microsoft Word Visual Basic for Applications macro, you may receive the following error: Also, while in the Visual Basic Editor, when you check the installed...
• WD97: Macro Virus Warning Message When You Start Word
  When you start Word, the following macro virus warning message appears:
• XL98: Graphic Not Displayed in Step 4 of PivotTable Wizard
  In Microsoft Excel 98 Macintosh Edition, a gray box may appear in step 4 of the PivotTable Wizard, instead of the graphic that normally appears in the dialog box.
• XL98: Excel Stops Responding While Running Virus Search
  When you run the Virus Search add-in for Microsoft Excel 98 Macintosh Edition, your computer stops responding. When you run the Virus Search add-in for Microsoft Excel 98 Macintosh Edition, you may be prompted to enter a password. When you type your...
• Frequently asked questions about Word macro viruses
  This article answers some of the more frequently asked questions concerning Word macro viruses.
• WD2000: Macro Virus Warning Message When Using Word
  When you start Word, open an existing document, or create a new document, one of the following may occur: Case 1 The following macro virus warning message appears: C:\<path>\<filename> contains macros. Macros may contain viruses. It is always safe...
• You receive a virus warning message when you click hyperlink to a program in Office 2002 or Office 2000
  Explains that a virus warning appears when you click a hyperlink to a program in Office 2002 or Office 2000. This behavior is designed to protect you against potential viruses. To work around this behavior, you can view the page in a Web browser.
• You receive a 2889 error message when you install an Office product
  Describes that you may receive a 2889 error message when you install an Office product. This behavior can occur when your computer is infected with the W32.Nimda.A@mm virus. You might have to reinstall your Office program.
• Description of virus alert about the W32/Bugbear@mm virus
  Describes a virus issue. When you view an e-mail message that is used by the W32/Bugbear@mm worm, the messages uses the "Incorrect MIME Header Can Cause IE to Execute E-mail Attachment" vulnerability to run automatically on some computers.
• Virus alert about the W32/Palyh@MM worm (SoBig worm), and its variants
  Describes the attack impacts and the characteristics of the mass-mailing worm, W32/Palyh@MM worm (SoBig worm) and its variants. The article also discusses how to prevent infection by the worm and how to recover from infection.
• WD97: FileOpen and Auto Macros Renamed
  If you create a FileOpen, AutoExec, AutoNew, or AutoOpen macro in Microsoft Word 97 for Windows, and WinStone anti-virus software is installed, the macro will not run. When you restart Word, the macros have been renamed to similar names, such as...
• XL98: How to Use the Virus Search Add-in for Microsoft Excel 98
  This article contains information about the obtaining and installing the Virus Search add-in for Microsoft Excel 98 Macintosh Edition.
• WD95: No Macro Warning Opening File in Template Folder
  The macro warning message does not appear when you attempt to open a document or template that contains macros.
• XL97: Patch Available for Excel 97 Virus Warning Vulnerabilities
  Microsoft has released a patch for Microsoft Excel 97 SR-2 that fixes a vulnerability to its Macro Virus Warning. To correct this problem, download and install the latest update for Excel 97. The latest update includes this and all other Excel-specific...
• You do not receive a macro warning when you open a file that contains macros
  When you open a Microsoft Word document or template that contains macros, the following message is not displayed, and you are not given the opportunity to enable or disable the macros: filename contains macros. Macros may contain viruses. It is...
• Text is displayed as unreadable symbols when you open a document in Word 2002
  Describes that the contents of the file is replaced by symbols and characters when you open a file in Word. This may be caused by the Klez worm and its known variants. To remove the worm, you must contact your antivirus manufacturer.
• Visual Studio .NET 2003 Setup or Visual Studio 2005 Setup may fail when antivirus or firewall program is running
  Explains that setup may fail when you try to install Visual Studio .NET 2003 or Visual Studio 2005 on a computer where an antivirus or firewall program is running. Provides a resolution for the problem.
• Internet Information Services (IIS) 5.0 – Download.Ject detection and recovery advisory
  Describes how IIS administrators can detect and recover from malicious code that exploits the vulnerability that is addressed in Microsoft Security Bulletin MS04-011 (835732).
• PPT97: Virus Warning Appears When You Click Hyperlink to Program
  When you create hyperlinks to objects or locations outside of your PowerPoint presentation, you may receive the following warning message: This behavior occurs regardless of your Macro Virus Protection settings. To locate the Macro Virus Protection...
• OL2000: Error Message When Attempting to Start Mail Merge in Outlook
  When you try to start a mail merge in Outlook, you may receive the following error message: The operation failed due to network or other communication problems. Check your connections and try again. If you click New Letter to Contact on the...
• W32.FunLove.4099 Virus Compromises Server Security
  The W32.FunLove.4099 virus can attack the Windows NT file security system and infects the Ntoskrnl.exe file. This virus can give all users full access to each file, regardless of its protection, when the computer is booted with the modified kernel...
• SQL Server 2000 Evaluation Edition supports security patch
  SQL Server 2000 Evaluation Editions are intended for short-term testing and should not be used in production environments. IMPORTANT: After installing SQL Server 2000 Evaluation Edition, it should be updated using the SQL Server 2000 Security Tools,...
• MSDE 2000 security updates are not installed as expected when you install UDDI Services on Windows Server 2003
  Describes a problem that may occur when you install UDDI Services on Windows Server 2003, and MSDE 2000 security updates are not installed as expected. Includes a workaround.
• The characteristics of the restricted version of MOM 2005 that is available together with Forefront Client Security
  Describes the characteristics of the restricted version of MOM 2005 that is available together with Forefront Client Security.
• How to query the Microsoft Knowledge Base by using keywords and query words
  Describes and lists keywords and query words that you can use to search Microsoft Knowledge Base articles.
• The computer may automatically restart, or you may receive a "serious error" message or a Stop error message in Windows Server 2003, in Windows XP, or in Windows 2000
  Describes how to determine whether the computer is infected with kernel driver rootkit spyware and how to remove this spyware.