Daily virus attack and IE script error messages

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Please could someone help? I'm using XP Home Edition with SP2 and Norton AV
alerts to a virus attack by W32.Gaobot.SN the first time I go online each
day. Six messages - unable to repair, access denied, auto deleted, unable to
repair, access denied, auto deleted. Followed removal info but the values
mentioned were not in the registry and nothing found in the scan. A few days
later Norton found 3 infected files of trojan languard.exe. It's in the
registry but I don't dare delete it from there as XP came installed on my pc
and doesn't seem to have backup utility. I downloaded AdAware SE, Spybot S+D
and SpywareBlaster, updated them and AdAware found 10 critical, Spybot about
70 inc negligible threat items. On startup later there were lots of IE script
error boxes which continue to appear on startup (40 today). The url says
file://C:\Doc+Settings\All users\Start
menu\Programs\Startup\WindowsUpdate.hta. Full system scans with Norton,
AdAware and Spybot found nothing today.
2 answers Last reply
More about daily virus attack script error messages
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Please consult the experts in the virus removal newsgroup:
    news://msnews.microsoft.com/microsoft.public.security.virus

    Symantec Security Check
    http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym&plfid=23&pkj=YVXRORVWHFHMFNZMBBX

    Antivirus software: Frequently asked questions
    http://www.microsoft.com/athome/security/protect/antivirus.mspx

    3 Simple Steps to Help Ensure the Protection of Your PC
    http://www.microsoft.com/athom­e/security/protect/default.msp­x

    --
    Carey Frisch
    Microsoft MVP
    Windows XP - Shell/User
    Microsoft Newsgroups

    Get Windows XP Service Pack 2 with Advanced Security Technologies:
    http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

    -------------------------------------------------------------------------------------------

    "Monsal" wrote:

    | Please could someone help? I'm using XP Home Edition with SP2 and Norton AV
    | alerts to a virus attack by W32.Gaobot.SN the first time I go online each
    | day. Six messages - unable to repair, access denied, auto deleted, unable to
    | repair, access denied, auto deleted. Followed removal info but the values
    | mentioned were not in the registry and nothing found in the scan. A few days
    | later Norton found 3 infected files of trojan languard.exe. It's in the
    | registry but I don't dare delete it from there as XP came installed on my pc
    | and doesn't seem to have backup utility. I downloaded AdAware SE, Spybot S+D
    | and SpywareBlaster, updated them and AdAware found 10 critical, Spybot about
    | 70 inc negligible threat items. On startup later there were lots of IE script
    | error boxes which continue to appear on startup (40 today). The url says
    | file://C:\Doc+Settings\All users\Start
    | menu\Programs\Startup\WindowsUpdate.hta. Full system scans with Norton,
    | AdAware and Spybot found nothing today.
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    "Monsal" <Monsal@discussions.microsoft.com> wrote in message
    news:D4639729-B0F5-4343-996D-CBA120BABD27@microsoft.com...
    > Please could someone help? I'm using XP Home Edition with SP2 and Norton
    > AV
    > alerts to a virus attack by W32.Gaobot.SN the first time I go online each
    > day. Six messages - unable to repair, access denied, auto deleted, unable
    > to
    > repair, access denied, auto deleted. Followed removal info but the values
    > mentioned were not in the registry and nothing found in the scan. A few
    > days
    > later Norton found 3 infected files of trojan languard.exe. It's in the
    > registry but I don't dare delete it from there as XP came installed on my
    > pc
    > and doesn't seem to have backup utility. I downloaded AdAware SE, Spybot
    > S+D
    > and SpywareBlaster, updated them and AdAware found 10 critical, Spybot
    > about
    > 70 inc negligible threat items. On startup later there were lots of IE
    > script
    > error boxes which continue to appear on startup (40 today). The url says
    > file://C:\Doc+Settings\All users\Start
    > menu\Programs\Startup\WindowsUpdate.hta. Full system scans with Norton,
    > AdAware and Spybot found nothing today.

    Gaobot is a nasty that can spread over the Internet or a local network. If
    you have more than one computer networked together you must clean each one
    in turn. Turn off all computers except one. Clean that computer. Turn it
    off. Turn on the next computer and clean it. Turn it off. Repeat until all
    computers are clean. Different variations of Gaobot will turn off firewalls,
    corrupt antivirus programs etc. Once a computer is clean, reinstall your
    antivirus software and make sure either the Windows firewall is functioning
    or you have a third party firewall installed. While doing the cleaning make
    sure your internet connection is physically disconnected or you are behind a
    hardware firewall.

    One cleaner program is here:

    http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html

    As there are many variations of Gaobot this particular cleaner may not work.
    A google search for W32.Gaobot will come up with many downloadable cleaner
    programs. Hopefully one of them will be able to clean the variation you have
    contracted.

    Kerry
Ask a new question

Read More

Windows XP