WinZip32.exe/ W32.HLLW.Gaobot Virus

[Guest]

Hi,

I'm running a W2k Pro SP2 box and just removed/fixed the W32.HLLW.Gaobot
virus which infected the winzip32.exe file and quarantined it. I've deleted
the file from quarantined and also ran the fix for the virus and even
uninstalled Winzip.

However, I keep getting virus notifications that c:\winnt\winzip32.exe has
been quarantined repeatedly due to the same virus. I checked the winnt
directory afterwards and of course the file is no longer there since it gets
quarantined several times over and over.

Any suggestions would be appreciated.

Thank you.

 

[George Hester]

Why is winzip32.exe in C:\WINNT? It should not be there. It should be in C:\Program Files\WinZip

 

[Guest]

This is the mystery I'm trying to figure out along w/ the continuing virus
quarantine notifications.

 

[George Hester]

Well I would remove it. Ours is not to ask why but get it outta there. I would uninstall WinZip make sure that file is nowhere to be found on the system make sure it is not being called in the registry or anywhere else during boot then reinstall WinZip with the latest version which is supposed to protect you from this issue.

I wouldn't worry about this quarantne thing. That is just a marketing ploy which means it is no longer in your path and calls to it (SHOULD) no longer exist in the registry. Norton is good at getting it out of your path but getting calls to it in the registry removed it is not so good at. Use Hijackthis for that.