Help removing worm

[Lynn Holland]

I ran an online virus scan from Trend Micro called housecalls. It shows 1
infected file - C:\windows\system32\msnms with WORM/ABOGOT.UY and states
that the file cannot be accessed and is non cleanable. Before running the
scan, I was receiving the SYSTEM SHUTDOWN - RPC message that I have been
reading about that is linked to the Blaster worm. I have been running AVG
anti-virus and 3 different product scans could not find a virus until the
housecall scan was run. I cannot find information to delete or remove this
worm. I tried reformatting and re-installing but it is still there. I am
able to prevent the shutdown by the advise to run CMD and type shutdown -a.
Please advise!! and thanks for your help.

 

[Rocks]

Hi Lynn Here is a site I used to fix the same problem

http://www.tweakxp.com/tweak2108.aspx

 

[Kevin]

Disable the Restore utility. The worm is hiding in there so it is respawned
after a clean up. You should be able to find removal tools at Trend Micro,
www.grisoft.com (the home of AVG Anti-Virus, which I heartily recommend) or
at the Symantec website. After you have removed the critter, make sure your
firewall is up to date and update all your anti-virus and adware and spyware
removal software. Only restart the Restore utility after you have confirmed
that your system is clean.