w32/banker.g@pws

[ora]

my anti virus keeps popping up saying my computer is
infected with W32/banker.G@pws virus and cannot be
removed. it says i have to delete the file infected which
is c:\windows\winupd.exe. is it safe to delete this file
as i know nothing about this. please help. thank you.

 

[Kristofer Gafvert]

Hello,

It is safe to delete this file.

 

[Rick \Nutcase\ Rogers]

Hi,

Yes it is safe to delete. However, you will likely need to start the system
in Safe mode in order to delete both the file and the reference in the
system registry that loads it. If you don't use Safe mode, the file will
likely be "in use" and be undeletable. Ensure you delete both the file and
the startup reference, likely found under one of these keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Windows
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone