ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
virus found cant remove: netsvcs.exe:worm.gaobot
mabriola


Joined: 29 Aug 2006
Posts: 4
Reply with quote
i hope one you can help me figure out how i can remove netsvcs.exe:worm.gaobot.

clam coudnt quarantine the virus. i tried locating it to be deleted, but it's not being displayed. i tried several times to remove this virus using different virus removal tool aside from clam but failed. im not sure if this is a false positive, because two other antivirus softwares detected it. i dont want to format my computer right now because its part of workstations being used in a laboratory.
View user's profileSend private message
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1751
Reply with quote
please paste your scan report
View user's profileSend private message
Vanni


Joined: 12 Jul 2006
Posts: 10
Location: Italy
Reply with quote
mabriola,

don't know if this helps, but I had a similar problem with a PC having hard disk problems. The scan detected a virus, only the hard disk was about to fail (died two days later:-( ) and trying to remove it we had errors during write and the file stood still.

Obviously the virus was the lesser problem and got solved for the worse two days later... But could explain this behaviour.

Best Regards
View user's profileSend private message
mabriola


Joined: 29 Aug 2006
Posts: 4
Reply with quote
vanni,

i'm hoping that's not gonna be the case in my problem. but just in case that would be the worst scenario, im bracing
myself.

==============

alch,

here's the scan report. hope this would help.

File excluded 'C:\Documents and Settings\All Users\.clamwin\quarantine\NETSVCS.EXE'
ERROR: Can't open file C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
ERROR: Can't open file C:\pagefile.sys

C:\Documents and Settings\All Users\.clamwin\quarantine\NETSVCS.EXE: Worm.Gaobot FOUND
-- summary --
Known viruses: 66775
Engine version: 0.88.4
Scanned directories: 254646
Scanned files: 369966
Infected files: 1

Not moved: 1
Data scanned: 19323.16 MB
Time: 9399.984 sec (156 m 39 s)
--------------------------------------
Completed
--------------------------------------
View user's profileSend private message
budtse


Joined: 14 Jan 2006
Posts: 372
Location: Belgium
Reply with quote
mabriola wrote:

C:\Documents and Settings\All Users\.clamwin\quarantine\NETSVCS.EXE: Worm.Gaobot FOUND


Seems it is already moved into quarantine, so it should be safe.
View user's profileSend private message
mabriola


Joined: 29 Aug 2006
Posts: 4
Reply with quote
budtse wrote:
mabriola wrote:

C:\Documents and Settings\All Users\.clamwin\quarantine\NETSVCS.EXE: Worm.Gaobot FOUND


Seems it is already moved into quarantine, so it should be safe.


=======

that should have been the case but unfortunately it wasn't quarantined when i try to delete it there. that's my dilema, coz i cant find it either in the quarantine folder nor in its's location (as reflected in the report).
View user's profileSend private message
Vanni


Joined: 12 Jul 2006
Posts: 10
Location: Italy
Reply with quote
mabriola

try using the command prompt. I seem to remember that some executables have +H and/or +S attributes set, and this renders them invisible.
but if you use
Code:
DIR /A


you can see them right away. If clam for any reason didn't reset the file's attributes, this way you can see it.

Then, if this is the case, you can reset it's attributes with

Code:
ATTRIB -S -R -H <filename>


-S resets System attribute
-R resets Read only attribute
-H resets Hidden attribute

and then you can delete it without further hassle.

Hope this helps
Bye
View user's profileSend private message
mabriola


Joined: 29 Aug 2006
Posts: 4
Reply with quote
vanni,

Very Happy thanks! i only needed to change the attribute for it to be displayed and deleted.
and to all you guys who gave their thoughts for my problem, thanks.
View user's profileSend private message
virus found cant remove: netsvcs.exe:worm.gaobot
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic