kismetk Posted March 12, 2005 Report Share Posted March 12, 2005 I ran a full virus scan using the latest McAfee DAT (4445) and it reported winis.exe in the system folder related to W32/Gaobot.worm.gen.l. I tried to "clean" this and was told that it could not be cleaned. Next time the PC was started up I repeated the scan and it reported no infected items but there is a file winis-exe-2FFBC2B7.pf in the Prefetch folder. I am not sure whether the worm has gone or infected, and would be grateful of help please. Quote Link to comment Share on other sites More sharing options...
benb Posted March 12, 2005 Report Share Posted March 12, 2005 You should firstly post a Hijack this log so that the experts can help you. You may also want to try some free online virus scans because they may be able to remove the worm also. Here are some.TrendMicro HousecalleTrust Antivirus Web ScannerPanda ActiveScanIf worse comes to worse, you can just manually delete the worm from Windows Explorer. If it is very pesky, go here and find the part where someone tells how to get "Delete on Reboot" into the context menu. That way the file should be deleted. Quote Link to comment Share on other sites More sharing options...
deuces wild Posted March 12, 2005 Report Share Posted March 12, 2005 I had the exact same problem and Nellie helped me remove it. She will most likely want you to post a HiJack This test.Read THIS LINK for more information on the virus/worm. Quote Link to comment Share on other sites More sharing options...
kismetk Posted March 13, 2005 Author Report Share Posted March 13, 2005 The virus checker has now reported the presence of this file related to the W32/Gaobot/worm.gen.lC:\System Volume Information\_restore{62FFCE82-38A2-480D-AAD1-DDDEAF923286}\RP569\A0099355.exeand says that it cannot be cleaned, so should be deleted and replaced with a new copy. Could anyone advise me how to proceed with this please? Quote Link to comment Share on other sites More sharing options...
nellie2 Posted March 13, 2005 Report Share Posted March 13, 2005 The malware is in a restore point, so you need to flush system restore to get rid of it.In windows XP1. Turn off System Restore.On the Desktop, right-click My Computer.Click Properties.Click the System Restore tab.Check Turn off System Restore.Click Apply, and then click OK.2. Reboot.3. Turn ON System Restore.On the Desktop, right-click My Computer.Click Properties.Click the System Restore tab.UN-Check *Turn off System Restore*.Click Apply, and then click OK. Quote Link to comment Share on other sites More sharing options...
kismetk Posted March 13, 2005 Author Report Share Posted March 13, 2005 Thanks Nellie I have done this. Further to my original post, now that winis.exe has disappeared am I clear of the worm? Quote Link to comment Share on other sites More sharing options...
nellie2 Posted March 14, 2005 Report Share Posted March 14, 2005 I would hope so, yes ;) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.