Byway

Removing the Byway virus is simple. If you rename an infected file to a non-executable extension (i.e. rename CHKDSK.EXE to CHKDSK.EEE), the stealth routines of the virus automatically remove the virus code from the file by correcting the FAT chain to properly point to the beginning of the file.

This only happens if the virus is resident in the memory, so you need to do this after booting from the infected hard drive instead of booting from a clean boot disk.

You can use this feature of the virus to remove it from a system: rename all *.COM and *.EXE to *.CCC and *.EEE. The easiest way of doing this is by giving the following commands (this works under MS-DOS 5.0 and newer):

cd \ ren *.com *.ccc /s ren *.exe *.eee /s

Repeat the commands to all hard drives on your system.

After this, reboot the system from a clean diskette, issue commands:

a:\attrib -h c:\chklist*.*a:\attrib -r c:\chklist*.*del c:\chklist*.*

Then rename all the files back to their original extensions:

cd \ren *.ccc *.com /sren *.eee *.exe /s

Again, repeat for all hard drive partitions.

Your system should now be clean of the virus. Check all floppies.

If this is too complicated, you can also download a separate disinfector written by Luis Paris. It is available at

[link removed]

[Thanks to Luis Paris for providing aditional details]

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

• Check for the latest database updatesFirst, check if your F-Secure security program is using the latest updates, then try scanning the file again.
• Submit a sampleAfter checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
• Exclude a file from further scanningIf you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.Note: You need administrative rights to change the settings.