Virus Question

[Joy]

How does one delete a file that Norton says is a virus, when access is
denied? Norton says "Unable to repair" and "Access to file is denied". I
can find
the Object Name in My Documents (it's MSlti64dotexe) and considered High
Risk. The virus itself is W32.HLLW.Gaobot.gen. The virusNorton won't
quarantine it, either. I don't have a setting in my Norton to tell it to
quarantine when it can't delete. And the Norton Virus Alert won't let me
close the alert window; I have to reboot to get rid of that window. Also I
tried stinger.exe and it didn't find the virus. I have WinXP, and my Norton
is current. Any help will be appreciated!

 

[David H. Lipman]

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

1) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
2) Reboot your PC into Safe Mode and shutdown as many applications as possible
3) Using your NAV software, perform a Full Scan of your platform and clean/delete any
infectors found
4) Restart your PC and perform a "final" Full Scan of your platform
5) Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 200 ~ 400MB),
reboot your PC.
6) Create a new Restore point


* * * Please report back your results * * *

Dave




| How does one delete a file that Norton says is a virus, when access is
| denied? Norton says "Unable to repair" and "Access to file is denied". I
| can find
| the Object Name in My Documents (it's MSlti64dotexe) and considered High
| Risk. The virus itself is W32.HLLW.Gaobot.gen. The virusNorton won't
| quarantine it, either. I don't have a setting in my Norton to tell it to
| quarantine when it can't delete. And the Norton Virus Alert won't let me
| close the alert window; I have to reboot to get rid of that window. Also I
| tried stinger.exe and it didn't find the virus. I have WinXP, and my Norton
| is current. Any help will be appreciated!
|

 

[Guest]

Here is a toll free number to Microsoft to help with viruses 1-866-727-2338.
There is no charge for them helping you and they are the safest to ask when a
virus is in the picture. I have called them a couple of times and they have
always been very nice and helpful to me. They set this number up a few years
back and I think it is a good idea, goodness knows, Norton is not usually
much help. I have a Norton too and some experience with their support.

I like this because I hate to pay for the phone call and what they charge
for support is way too expensive. This one is free.

There is one more thing, did it show as a virus or as a threat. If it is a
threat, that is spyware and not a virus. Microsoft will know but Norton
finds things but rarely does it delete them for you. If I find it as a
threat, I manually delete it, if I possibly can. It looks like you can find
it and if it is only a threat, I just delete them myself.

I hope this helps you out.

Chloe Ann

 

[Joy]

Thank you, David, I didn't know where to look.

 

[R. McCarty]

Use Panda's On-Line scan to remove the virus:
http://www.pandasoftware.com/activescan/
You'll have to install an ActiveX module and do a short
form to access. When prompted choose "Scan My Computer"
Scan will take 15+ minutes to complete.

 

[Joy]

Thank you, Chloe Ann. I will try them as soon as I can. They helped me
once before with a virus when I first got this computer, but I wouldn't have
known (again) where to find the phone number. It definitely says "Virus
Alert". I did run my anti-Spyware just in case. Even though I can find the
file in MyDocs, it won't let me delete it.

 

[wayne]

you should try booting to safe mode that should work

If not you can boot from the Norton CD as long as you have the latest
definitions handy on floppy if In remember correctly check you manual or
help files. Safe mode should do it though

Wayne

 

[Joy]

Thanks to all! Here's my "report":

Chloe Ann, I called the Microsoft number and found a tech to help me.

Dave, essentially what that tech had me do was what you had suggested (only
also showing me where to find "System Restore" and additionally taking me to
a website (sarc.com) that has special downloads for particular viruses.) I
downloaded that (fixgaobot) to the destop, then followed your steps 1 to 3
as the MS tech had said to do. I found it interesting that Norton would
THEN (in Safe Mode) allow me to tell it to Quarantine and from there I could
delete the gaobot. In regular (not safe) mode, it would not let me
quarantine. Is this true of other such viruses? Then I ran the downloaded
fixgaobot, but since I had deleted it from the Norton Quarantine, it didn't
find anything. Dave, regarding your step 5, about changing (restoring?)
the HD space to 200 - 400 mg, I didn't think to look what it was originally
(nor did the MS tech tell me anything about that), what are the guidelines
for knowing where to set it? It defaulted to the highest amount of space.
Also I don't know what you mean by step 6 "Create a new Restore point"; how
would I do that?

Once again, thanks to all!

Joy

 

[David H. Lipman]

Hi Joy:

The System Restore Cache uses a percentage of the hard disk. If it uses 10% of a 40GB
drive, the System Restore cache will be 4GB. The cache does NOT need to be that large.
That is why I suggest (and that's all it is a suggestion) to limit the cache. 600MB is a
fine cache size.

I'm not in front of a WinXP PC (I'm on a WinXP PC) but it is something like...

start --> programs --> accessories --> System tools --> System Restore

It the program it will allow you to manually create a new Restore point.

Dave




| Thanks to all! Here's my "report":
|
| Chloe Ann, I called the Microsoft number and found a tech to help me.
|
| Dave, essentially what that tech had me do was what you had suggested (only
| also showing me where to find "System Restore" and additionally taking me to
| a website (sarc.com) that has special downloads for particular viruses.) I
| downloaded that (fixgaobot) to the destop, then followed your steps 1 to 3
| as the MS tech had said to do. I found it interesting that Norton would
| THEN (in Safe Mode) allow me to tell it to Quarantine and from there I could
| delete the gaobot. In regular (not safe) mode, it would not let me
| quarantine. Is this true of other such viruses? Then I ran the downloaded
| fixgaobot, but since I had deleted it from the Norton Quarantine, it didn't
| find anything. Dave, regarding your step 5, about changing (restoring?)
| the HD space to 200 - 400 mg, I didn't think to look what it was originally
| (nor did the MS tech tell me anything about that), what are the guidelines
| for knowing where to set it? It defaulted to the highest amount of space.
| Also I don't know what you mean by step 6 "Create a new Restore point"; how
| would I do that?
|
| Once again, thanks to all!
|
| Joy
|