Daily virus attack and IE script error messages

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Please could someone help? I'm using XP Home Edition with SP2 and Norton AV
alerts to a virus attack by W32.Gaobot.SN the first time I go online each
day. Six messages - unable to repair, access denied, auto deleted, unable to
repair, access denied, auto deleted. Followed removal info but the values
mentioned were not in the registry and nothing found in the scan. A few days
later Norton found 3 infected files of trojan languard.exe. It's in the
registry but I don't dare delete it from there as XP came installed on my pc
and doesn't seem to have backup utility. I downloaded AdAware SE, Spybot S+D
and SpywareBlaster, updated them and AdAware found 10 critical, Spybot about
70 inc negligible threat items. On startup later there were lots of IE script
error boxes which continue to appear on startup (40 today). The url says
file://C:\Doc+Settings\All users\Start
menu\Programs\Startup\WindowsUpdate.hta. Full system scans with Norton,
AdAware and Spybot found nothing today.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Please consult the experts in the virus removal newsgroup:
news://msnews.microsoft.com/microsoft.public.security.virus

Symantec Security Check
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym&plfid=23&pkj=YVXRORVWHFHMFNZMBBX

Antivirus software: Frequently asked questions
http://www.microsoft.com/athome/security/protect/antivirus.mspx

3 Simple Steps to Help Ensure the Protection of Your PC
http://www.microsoft.com/athom­e/security/protect/default.msp­x

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Microsoft Newsgroups

Get Windows XP Service Pack 2 with Advanced Security Technologies:
http://www.microsoft.com/athome/security/protect/windowsxp/choose.mspx

-------------------------------------------------------------------------------------------

"Monsal" wrote:

| Please could someone help? I'm using XP Home Edition with SP2 and Norton AV
| alerts to a virus attack by W32.Gaobot.SN the first time I go online each
| day. Six messages - unable to repair, access denied, auto deleted, unable to
| repair, access denied, auto deleted. Followed removal info but the values
| mentioned were not in the registry and nothing found in the scan. A few days
| later Norton found 3 infected files of trojan languard.exe. It's in the
| registry but I don't dare delete it from there as XP came installed on my pc
| and doesn't seem to have backup utility. I downloaded AdAware SE, Spybot S+D
| and SpywareBlaster, updated them and AdAware found 10 critical, Spybot about
| 70 inc negligible threat items. On startup later there were lots of IE script
| error boxes which continue to appear on startup (40 today). The url says
| file://C:\Doc+Settings\All users\Start
| menu\Programs\Startup\WindowsUpdate.hta. Full system scans with Norton,
| AdAware and Spybot found nothing today.

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"Monsal" <Monsal@discussions.microsoft.com> wrote in message
news4639729-B0F5-4343-996D-CBA120BABD27@microsoft.com...
> Please could someone help? I'm using XP Home Edition with SP2 and Norton
> AV
> alerts to a virus attack by W32.Gaobot.SN the first time I go online each
> day. Six messages - unable to repair, access denied, auto deleted, unable
> to
> repair, access denied, auto deleted. Followed removal info but the values
> mentioned were not in the registry and nothing found in the scan. A few
> days
> later Norton found 3 infected files of trojan languard.exe. It's in the
> registry but I don't dare delete it from there as XP came installed on my
> pc
> and doesn't seem to have backup utility. I downloaded AdAware SE, Spybot
> S+D
> and SpywareBlaster, updated them and AdAware found 10 critical, Spybot
> about
> 70 inc negligible threat items. On startup later there were lots of IE
> script
> error boxes which continue to appear on startup (40 today). The url says
> file://C:\Doc+Settings\All users\Start
> menu\Programs\Startup\WindowsUpdate.hta. Full system scans with Norton,
> AdAware and Spybot found nothing today.

Gaobot is a nasty that can spread over the Internet or a local network. If
you have more than one computer networked together you must clean each one
in turn. Turn off all computers except one. Clean that computer. Turn it
off. Turn on the next computer and clean it. Turn it off. Repeat until all
computers are clean. Different variations of Gaobot will turn off firewalls,
corrupt antivirus programs etc. Once a computer is clean, reinstall your
antivirus software and make sure either the Windows firewall is functioning
or you have a third party firewall installed. While doing the cleaning make
sure your internet connection is physically disconnected or you are behind a
hardware firewall.

One cleaner program is here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.gaobot.removal.tool.html

As there are many variations of Gaobot this particular cleaner may not work.
A google search for W32.Gaobot will come up with many downloadable cleaner
programs. Hopefully one of them will be able to clean the variation you have
contracted.

Kerry