new worm?

new worm?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
new worm? adam_r 06-20-2006
`--> Re: new worm? David H. Lipman06-20-2006
Posted by adam_r on June 20, 2006, 5:09 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi,

my AVIRA antivir personnal edition has detected a worm called
"TR/Dldr.Winvxe" in ntkernel.exe file (c:\ntkernel.exe). the problem i
can't delete this file because it's
important for windows xp home edition.
can someone help me?

thanks
adam_r


Posted by MAP on June 20, 2006, 5:35 am
If you were  Registered and logged in, you could reply and use other advanced thread options
adam_r wrote:
> Hi,
>
> my AVIRA antivir personnal edition has detected a worm called
> "TR/Dldr.Winvxe" in ntkernel.exe file (c:\ntkernel.exe). the problem i
> can't delete this file because it's
> important for windows xp home edition.
> can someone help me?
>
> thanks
> adam_r


The file used by xp "ntkernel.exe" is located here
C:\Windows\System32 (Windows XP).

Any other locations shoud be suspect.
The worm you found is in c:\ntkernel.exe. I would say that it is safe to
delete.

--
Mike Pawlak



Posted by adam_r on June 20, 2006, 10:12 am
If you were  Registered and logged in, you could reply and use other advanced thread options
MAP a =E9crit :

> adam_r wrote:
> > Hi,
> >
> > my AVIRA antivir personnal edition has detected a worm called
> > "TR/Dldr.Winvxe" in ntkernel.exe file (c:\ntkernel.exe). the problem i
> > can't delete this file because it's
> > important for windows xp home edition.
> > can someone help me?
> >
> > thanks
> > adam_r
>
>
> The file used by xp "ntkernel.exe" is located here
> C:\Windows\System32 (Windows XP).
>
> Any other locations shoud be suspect.
> The worm you found is in c:\ntkernel.exe. I would say that it is safe to
> delete.
>
> --
> Mike Pawlak

i've deleted c:\ntkernel.exe and it works fine now.
thank you Mike.

Adam_r


Posted by MAP on June 20, 2006, 12:04 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
:-)

Mike Pawlak


adam_r wrote:
> MAP a écrit :
>
>> adam_r wrote:
>>> Hi,
>>>
>>> my AVIRA antivir personnal edition has detected a worm called
>>> "TR/Dldr.Winvxe" in ntkernel.exe file (c:\ntkernel.exe). the
>>> problem i can't delete this file because it's
>>> important for windows xp home edition.
>>> can someone help me?
>>>
>>> thanks
>>> adam_r
>>
>>
>> The file used by xp "ntkernel.exe" is located here
>> C:\Windows\System32 (Windows XP).
>>
>> Any other locations shoud be suspect.
>> The worm you found is in c:\ntkernel.exe. I would say that it is
>> safe to delete.
>>
>> --
>> Mike Pawlak
>
> i've deleted c:\ntkernel.exe and it works fine now.
> thank you Mike.
>
> Adam_r

--



Posted by David H. Lipman on June 20, 2006, 6:12 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Hi,
|
| my AVIRA antivir personnal edition has detected a worm called
| "TR/Dldr.Winvxe" in ntkernel.exe file (c:\ntkernel.exe). the problem i
| can't delete this file because it's
| important for windows xp home edition.
| can someone help me?
|
| thanks
| adam_r

If Avira called it "TR/Dldr.Winvxe" then it is a Trojan as noted by the Prefix
"TR/".

You say you delted the Trojan found in the root of "C:". But are you really
clean ?


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Similar ThreadsPosted
Worm VB.AS Aliases W32.Alcra.B and W32/Alcan.worm!p2p July 18, 2005, 8:37 am
WORM/DELF.FPV - new worm?? January 14, 2008, 6:58 am
new worm i think November 22, 2006, 6:15 pm
RE NEW WORM November 23, 2006, 5:24 pm
Worm? November 11, 2008, 1:17 pm
Virus/worm? October 25, 2005, 2:29 am
Virus-Worm April 6, 2006, 5:43 pm
Worm Rontok April 20, 2006, 10:35 pm
W32.Sinnaka.A@mm worm May 2, 2006, 12:36 am
W32.Swen.A@mm worm May 4, 2006, 12:21 am

The site map in XML format XML site map

Contact Us | Privacy Policy