HLLP-vova 10.1-b found in processes

Viruses and worms
1

Hi all!

We have had a recurring virus problem on one of our computers. ADNM says that it found an “Infection: HLLP-vova 10.1-b” in one or more processes, and that the “File is marked to be deleted during the following system start…”. The name of the file that is infected is called “*PROCESS<3 digit number><7 digit string><6 digit string>”, which doesn’t mean a heck of a lot to me :-\ .

We’ve restarted the computer, and it doesn’t seem to help. What can we do about this?

Thanks for your help!

2

Can you schedule a boot time scanning in the infected computers?

3

Its an old parasitic virus and there are lots of google hits in Russian. Here’s one of the few in English

http://www.viruslist.com/en/viruses/encyclopedia?virusid=13211

HLLP.Vova It is encrypted virus. It contains the strings: (C) Dialogue, Rust. 1993 vir *.com *.exe COMMAND.COM NCMAIN.EXE EMM386.EXE NC.EXE \VIR comspec /c ren v /c>nul copy/b \vir /c del vir? ***ProfVovaVir 10.1 (INVECTOR),Give my best regards to LENA !!! (c) 1992-94 by Vova of Ufa,11/03/94 (max. probability accident=1/128)***

If an avast! boot scan doesn’t clean it try one of the online scanners (Kasperski, Trend House Call, etc). It might be a false positive.

4

We’ll try the bootscan as soon as we can. As far as scanning the infected file, we can’t (as far as I know) because it is a process, not a file.

Thanks.