NOD32 does not clean explorer.exe

I ran NOD32 to get rid of the Win32/Ganda.A worm (swedish virus). NOD32 cleaned most infected files, but the worm is still present in the explorer.exe file. In the log NOD32 says it has cleaned the file, but that a restart is needed

In a following dialogue box I get this message: "Some of the cleaned files were executed or used by other applications. The actions which were performed on them will be visible after the computer is restarted"

After restart the worm is re-detected and I'm looped to the log-message that restart is needed.

On www.nod32.com FAQ I'm advised to disable system restore (I've got ME operative system).
I've taken the following actions (from the support site), but to no avail:
"
1. Right click on the "My Computer" icon on the Windows desktop and click "Properties"
2. Click on "Performance">"File system"
3. Click "Troubleshooting"
4. Check "Disable system restore"
5. Click on OK, Close and restart the system
"

After restarting, the virus is still present. Has anyone experienced this? Solutions?

Most grateful for any help and advise

 

Please go to http://www.tomcoyote.org/hjt/, and download 'Hijack This!'.
Unzip, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log as a .txt file, and copy and paste its contents into your next post.
Also click Config > Misc Tools > Generate Startuplist. That will produce a .txt file. Add that to the post

 

Hi sokrates,

pls. try to clean that worm in the Windows Safe Mode.

When using WinME you can also try to use the NOD32 for DOS.

Thanks,

jan

 

Hello sokrates
You might consider adding an anti-worm program in addition to NOD32. A great one is here:

http://wormguard.diamondcs.com.au/

Best wishes.

HMSS Q Section