Discovered: April 21, 2006

Updated: February 13, 2007 12:53:05 PM

Also Known As: Polipos.a [F-Secure], P2P-Worm.Win32.Polip.a [Kasper, W32/Polip [McAfee], W32/Polipos-A [Sophos], PE_POLIP.A [Trend Micro]

Type: Virus

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When W32.Polip is installed, it performs the following actions:

1. Infects .scr and .exe files when they are opened or executed on the compromised computer.
   
   
2. Hides its presence on the compromised computer by injecting its code into running processes.
   
   
3. Attempts to spread by sharing infected files on the Gnutella file sharing network, even if the Gnutella software isn't installed on the compromised computer.
   
   
4. Tries to lower security settings by deleting certain files relating to antivirus software.

Removal

 

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan.
   

For specific details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

• How to disable or enable Windows Me System Restore
• How to turn off or turn on Windows XP System Restore

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, reenable System Restore by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article: Antivirus Tools Cannot Clean Infected Files in the _Restore Folder (Article ID: Q263455).

2. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

• Running LiveUpdate, which is the easiest way to obtain virus definitions:
  • If you use Norton AntiVirus 2006, Symantec AntiVirus Corporate Edition 10.0, or newer products, LiveUpdate definitions are updated daily. These products include newer technology.
  • If you use Norton AntiVirus 2005, Symantec AntiVirus Corporate Edition 9.0, or earlier products, LiveUpdate definitions are updated weekly. The exception is major outbreaks, when definitions are updated more often.
• Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted daily. You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to Virus Definitions (Intelligent Updater).
  
  The latest Intelligent Updater virus definitions can be obtained here: Intelligent Updater virus definitions. For detailed instructions read the document: How to update virus definition files using the Intelligent Updater.

3. To run a full system scan

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
   • For Norton AntiVirus consumer products: Read the document: How to configure Norton AntiVirus to scan all files.
   • For Symantec AntiVirus Enterprise products: Read the document: How to verify that a Symantec Corporate antivirus product is set to scan all files.
2. Run a full system scan.
3. If any files are detected, follow the instructions displayed by your antivirus program.

Important: If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode. Once you have restarted in Safe mode, run the scan again.

After the files are deleted, restart the computer in Normal mode.

 

Comments

Add New Search RSS

Anonymous   |222.174.116.xxx |10-06-2010 13:12:29 Do you want to become more charming and attractive?Wearing our beautiful link:http://www.unshoessales.com/ Shoes with a charming link:http://www.unshoessales.com/herve-leger-c-35 .html,you will become the focus that numerous people fixes eyes upon.If you feel that it is not gorgeous enough,please select our link:http://www.unshoessales.com/jimmy-choo-shoes -c-49.html and link:http://www.unshoessales.com/manolo-blahnik-s hoes-c-48.html which can make your feet more attractive.However,If you choose link:http://www.shoeseasybuy.com/ Which have the ability to make you seem higher, link:http://www.unbootssale.com/ which are endlessly comfortable and watching link... Reply 0   0 zcc   |222.211.192.xxx |14-06-2010 15:37:10 Alessa link:http://www.oakleysunglassessale.com of link:http://www.oakleysunglassessale.com North link:http://www.oakleysunglassessale.com Ber link:http://www.oakleysunglassessale.com and link:http://www.oakleysunglassessale.com Al link:http://www.oakleysunglassessale.comof link:http://www.oakleysunglassessale.comwood link:http://www.oakleysunglassessale.com Park link:http://www.oakleysunglassessale.com were link:http://www.raybanglassesale.com charged link:http://www.raybanglassesale.com with link:http://www.raybanglassesale.com cons link:http://www.raybanglassesale.compiring link:http://www.raybanglassesale.com to link:http://www.raybanglassesale.com com link:http://www.raybanglassesale.com an link:http://www.raybanglassesale.com act l... Reply 0   0 zcc   |222.211.192.xxx |14-06-2010 15:38:54 by link:http://www.ed-hardy-sale.com the link:http://www.ed-hardy-sale.com US link:http://www.ed-hardy-sale.com as link:http://www.ed-hardy-sale.com a link:http://www.ed-hardy-sale.com/caps-c-12_50.ht ml terrorist link:http://www.ed-hardy-sale.com/shoes-c-12_45.h tml group link:http://www.ed-hardy-sale.com/tshirts-c-12_29 33.html in link:http://www.ed-hardy-sale.com/tshirts-c-11_39 .html 2008 link:http://www.ed-hardy-sale.com/swimwear-c-11_4 8.html The link:http://www.buyraybansunglass.com FBI link:http://www.buyraybansunglass.com and link:http://www.buyraybansunglass.com the link:http://www.buyraybansunglass.com New link:http://www.buyraybansunglass.com York link:http://www.buyraybansunglass.com Police link:http... Reply 0   0 zcc   |222.211.192.xxx |14-06-2010 15:40:16 details link:http://www.raybansunglassesonsale.com FBI link:http://www.raybansunglassesonsale.com spokesman link:http://www.raybansunglassesonsale.com/ray-ba n-3025-sunglasses-45.htm l Richard link:http://www.raybansunglassesonsale.com Kolko link:http://www.raybansunglassesonsale.com in link:http://www.raybansunglassesonsale.com Washington link:http://www.raybansunglassesonsale.com said link:http://www.brandbagsshop.com no link:http://www.brandbagsshop.com threat link:http://www.brandbagsshop.com was link:http://www.brandbagsshop.com made link:http://www.brandbagsshop.com at link:http://www.brandbagsshop.com the link:http://www.brandbagsshop.com/shop-by-brand-c oach-s-1619_1619.html airport link:http://www.b... Reply 0   0 zcc   |222.211.192.xxx |14-06-2010 15:41:36 took link:http://www.raybansunglassesale.com them link:http://www.raybansunglassesale.com into link:http://www.raybansunglassesale.com custody link:http://www.raybansunglassesale.com the link:http://www.raybansunglassesale.com officials link:http://www.raybansunglassesale.com said link:http://www.mlbjerseysale.com They link:http://www.mlbjerseysale.com are link:http://www.mlbjerseysale.com scheduled link:http://www.mlbjerseysale.com to link:http://www.mlbjerseysale.com appear link:http://www.mlbjerseysale.com Monday link:http://www.mlbjerseysale.com in link:http://www.ghdhairshop.com/ghd-purple-p-184. html federal link:http://www.ghdhairshop.com/ghd-purple-p-184. html court link:http://www.ghdhairshop.com/ghd-purple-p-184.&nbsp... Reply 0   0 zcc   |222.211.192.xxx |14-06-2010 15:43:02 group link:http://www.raybansunglasseshotsale.com of link:http://www.raybansunglasseshotsale.com friends link:http://www.raybansunglasseshotsale.com and link:http://www.raybansunglasseshotsale.com was link:http://www.raybansunglasseshotsale.com able link:http://www.raybansunglasseshotsale.com/ray-b an-2140-sunglasses-47.ht ml to link:http://www.raybansunglasseshotsale.com/ray-b an-2132-sunglasses-46.ht ml monitor link:http://www.ghdhairdirect.com their link:http://www.ghdhairdirect.com consumption link:http://www.ghdhairdirect.com of link:http://www.ghdhairdirect.com jihadist link:http://www.ghdhairdirect.com videos link:http://www.ghdhairdirect.com and link:http://www.ghdhairdirect.com/limited-edition -ghd-... Reply 0   0 zcc   |222.211.192.xxx |14-06-2010 15:46:36 saving link:http://www.guccibagsales.com thousands link:http://www.guccibagsales.com of link:http://www.guccibagsales.com dollars link:http://www.guccibagsales.com under link:http://www.guccibagsales.com/handbags-g-1.ht mlgoing link:http://www.guccibagsales.com/hobos-g-4.html tactical link:http://www.guccibagsales.com/messenger-bags- g-5.html training link:http://www.guccibagsales.com/shoulder-bags-g -2.html and link:http://www.guccibagsales.com/totes-g-3.htm test link:http://www.mbtsanatoryshoes.com runs link:http://www.mbtsanatoryshoes.com at link:http://www.mbtsanatoryshoes.com paint link:http://www.mbtsanatoryshoes.comball link:http://www.mbtsanatoryshoes.com fields link:http://www.mbtsanatoryshoes.com to lin... Reply 0   0 cheap warhammer gold  - cheap warhammer gold   |221.6.130.xxx |11-08-2010 08:15:03 Do you know link:http://www.wargold4game.com?if you play online game,you will know link:http://www.wargold4game.comis the game gold,in the game,if you had more link:http://www.wargold4game.com,you can had a tall level.but you want to bought link:http://www.wargold4game.com.you can come here and spend a little money to bought link:http://www.wargold4game.com.Quickly come here. Reply 0   0 timberland boots  - timberland boots   |59.58.152.xxx |13-09-2010 09:00:03 He lovingly thinks about us all the time link:http://www.timberland4you.co.uk/ and he even temporarOnce we get there, so many wonderful dreams will come true and the pieces of our link:http://www.timberland4you.co.uk/sitemap.html lives will fit together like a completed jigsaw puzzle. How restlessly we pace the aisles, bing the minutes for link:http://www.timberland4you.co.uk/ loitering --waiting, waiting, waiting for the station. It is a good link:http://www.timberland4you.co.uk/ thing that the God Who made us is not impatient with people like me with my link:http://www.timberland4you.co.uk/ orchid. YQ Reply 0   0 yaobingjian  - links of london   |123.165.110.xxx |02-12-2010 12:43:46 there are the flower, and link:http://www.linkslondon.uk.com leaf wandering  link:http://www.linkslondon.uk.com in the cool night early links of London sweetie, lonely link:http://www.linkslondon.uk.com in the moonlight.Any thoughts of the link:http://www.linkslondon.uk.com water are in the night. At night, there link:http://www.linkslondon.uk.com is the only static link:http://www.linkslondon.uk.com breath. Those in the bottom line of sadness link:http://www.linkslondon.uk.com/sweetie-bracel ets began. Look, Reply 0   0 weibao  - vibram   |123.165.110.xxx |02-12-2010 12:47:32 youth years, a vow link:http://www.vibram.us.com/ to earth, a review will be out of time.Is like link:http://www.vibram.us.com/ enthusiasm, this is a moth of love, is link:http://www.vibram.us.com/ this really longing for love, link:http://www.vibram.us.com/ to look back, vibram i found tears Reply 0   0 Montblanc Sport Watches  - Blancpain Collection Léman watches   |59.61.148.xxx |29-01-2011 16:00:03 our shop gives you a hefty chance of restriction throughg a drunk appearance link:http://www.replica-watches-fan.com, link:http://www.replica-watches-fan.com/replica-b rm-gp44-gp44111-watch-p- 1030.html, link:http://www.replica-watches-fan.com/dior-watc hes-dior-dior-christal-c ollection-watches-c-182_26 8.html on-lpreferrede in the absence of discarding your inhabitant. we surrender you the men's in the midst of ladies' link:http://www.replica-watches-fan.com/replica-b reitling-windrider-colle ction-cockpit-488-watch-p- 895.html, link:http://www.replica-watches-fan.com/iwc-watch es-iwc-portugaise-watche s-c-224_227.html, link:http://www.replica-watches-f... Reply 0   0 ccocoo  - a good news   |174.139.230.xxx |29-07-2011 14:02:05 Today link:http://www.northfacevip.com/ can be already in the market very! link:http://www.northfacevip.com/the-north-face-w omen-c-1.html Exclusively, there may be very little employ cuddling in your favourite denim jacket if your cool wind can be roaring outside the house link:http://www.northfacevip.com/the-north-face-m en-c-2.html. This is why make sure you examine link:http://www.northfacevip.com/the-north-face-m en-c-2.html insulated denim link:http://www.northfacevip.com/the-north-face-m en-c-2.html a new blend regarding denim dress and the efficiency needed to preserve people comfortable and also comfortable link:http://www.northfacevip.com/the-... Reply 0   0 mac cosmetics  - mac cosmetics   |58.22.65.xxx |30-07-2011 08:35:47 Why will need to it be okay for celebrities and rock stars anyway link:http://www.googlechiflatiron.com/, link:http://www.googlechiflatiron.com/ and not the normal man on the street link:http://www.googlechiflatiron.com/. link:http://www.googlechiflatiron.com/ When you believe about it link:http://www.googlechiflatiron.com/chi-flat-ir on-collection-c-24.html, link:http://www.googlechiflatiron.com/chi-camo-co llection-c-25.html it is just a way of a man expressing his individuality link:http://www.googlechiflatiron.com/chi-hair-dr yer-collection-c-26.html , link:http://www.googlechiflatiron.com/chi-turbo-f lat-iron-collection-c-27 .html his enthusiasm for diverse link:http:/... Reply 0   0 shuijin  - links of london   |112.111.166.xxx |03-08-2011 13:14:43 Although you may think that flat irons are only for this type of hair link:http://www.ghdhairs-au.com/, link:http://www.ghdhairs-au.com/ they also work great straight hair link:http://www.ghdhairs-au.com/. link:http://www.ghdhairs-au.com/ They add volume and direction to the hair link:http://www.ghdhairs-au.com/2010-new-ghd-red- lust-iv-styler-p-51.html . link:http://www.ghdhairs-au.com/2010-new-ghd-iv-g reen-envy-p-50.html Straightening irons also works to tame your frizzies link:http://www.ghdhairs-au.com/2010-new-ghd-blue -serenity-iv-styler-p-47 .html. link:http://www.ghdhairs-au.com/ghd-new-iv-styler -p-52.html Did you know that you can also use it to curls your hair l... Reply 0   0 jodie  - pavilions   |123.153.66.xxx |24-08-2011 12:42:23 tortue watches link:http://www.sanwatches.org/tag_heuer-watches. html replica tag heuer watches nevus fake graham watches link:http://www.stilwatches.com/ superocean watches link:http://www.watchesbasic.org/breitling-watche s.html replica breitling landon link:http://www.watchesairs.com/cartier-watches.h tml replica cartier watches for sale fake tissot watches link:http://www.watchesbasic.org/omega-watches.ht ml omega replica link:http://www.sanwatches.org/rolex-watches.html cook watches rolex tudor watches. Reply 0   0 isaiah  - yachtmaster ii watches   |123.153.66.xxx |24-08-2011 14:40:57 fake patek philippe watches link:http://www.watchesun.net/cartier-watches.htm l cartier replica link:http://www.cor-watches.org/omega-watches.htm l fake omega watches avenger watches link:http://www.watchesdoc.org/rolex-watches.html fake rolex tluminor watches responsibility link:http://www.watchescode.org/tag_heuer-watches .html replica tag heuer watches cartier santos watches link:http://www.keepwatches.org/ classic watches museum link:http://www.watchesdoc.org/breitling-watches. html watches breitling. Reply 0   0 sime  - fake u boat watches   |123.153.66.xxx |24-08-2011 16:10:21 breitling bentley motors watches windrider link:http://www.sanwatches.org/omega-watches.html fake omega watches found professional watches link:http://www.watchesdoc.org/rolex-watches.html replica rolex link:http://www.watchesun.net/tag_heuer-watches.h tml replica tag heuer fake audemars piguet link:http://www.watchesairs.com/ timewalker watches link:http://www.canwatch.org/breitling-watches.ht ml fake breitling watches link:http://www.tricwatches.com/cartier-watches.h tml cartier replica. Reply 0   0 Coach Outlet Online  - Coach Outlet Online   |121.158.55.xxx |16-11-2011 13:27:38 One link:http://www.coachsfactoryoutlet.org/ of clothing link:http://www.coachfactorysoutletstoreonline.ne t/ be loose link:http://www.coachfactorystore-online.com/ compliment the link:http://www.coachoutletstoreonline.ca/ of the [url=http://www.coachsfactory- online.net/]Coach Factory[/url]. A loose link:http://www.coachfactorysoutletstoreonline.ne t/ or a skirt link:http://www.coachsfactoryoutlet-online.net/ help the link:http://www.coachfactoryoutletonlineh.com/ Bags flow link:http://www.mycoachfactorystoreonline.org/ what you link:http://www.coachoutletstoreonlineh.com/ wearing. Small link:http://www.coachfactorystore-online.com/ with a link:... Reply 0   0 Powered by !JoomlaComment 3.26

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."