NOD32 does not clean explorer.exe

Discussion in 'NOD32 version 1 Forum' started by sokrates, May 6, 2003.

Thread Status:
Not open for further replies.
  1. sokrates

    sokrates Guest

    I ran NOD32 to get rid of the Win32/Ganda.A worm (swedish virus). NOD32 cleaned most infected files, but the worm is still present in the explorer.exe file. In the log NOD32 says it has cleaned the file, but that a restart is needed

    In a following dialogue box I get this message: "Some of the cleaned files were executed or used by other applications. The actions which were performed on them will be visible after the computer is restarted"

    After restart the worm is re-detected and I'm looped to the log-message that restart is needed.

    On www.nod32.com FAQ I'm advised to disable system restore (I've got ME operative system).
    I've taken the following actions (from the support site), but to no avail:
    "
    1. Right click on the "My Computer" icon on the Windows desktop and click "Properties"
    2. Click on "Performance">"File system"
    3. Click "Troubleshooting"
    4. Check "Disable system restore"
    5. Click on OK, Close and restart the system
    "

    After restarting, the virus is still present. Has anyone experienced this? Solutions?

    Most grateful for any help and advise :p
     
  2. Metallica

    Metallica Guest

    Please go to http://www.tomcoyote.org/hjt/, and download 'Hijack This!'.
    Unzip, doubleclick HijackThis.exe, and hit "Scan".
    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log as a .txt file, and copy and paste its contents into your next post.
    Also click Config > Misc Tools > Generate Startuplist. That will produce a .txt file. Add that to the post
     
  3. jan

    jan Former Eset Moderator

    Joined:
    Oct 25, 2002
    Posts:
    804
    Hi sokrates,

    pls. try to clean that worm in the Windows Safe Mode.

    When using WinME you can also try to use the NOD32 for DOS.

    Thanks, :D

    jan
     
  4. Q Section

    Q Section Registered Member

    Joined:
    Feb 5, 2003
    Posts:
    778
    Location:
    Headquarters - London & Field Offices -Worldwide
    Hello sokrates
    You might consider adding an anti-worm program in addition to NOD32. A great one is here:

    http://wormguard.diamondcs.com.au/

    Best wishes.

    HMSS Q Section
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.