i hope one you can help me figure out how i can remove netsvcs.exe:worm.gaobot.

clam coudnt quarantine the virus. i tried locating it to be deleted, but it's not being displayed. i tried several times to remove this virus using different virus removal tool aside from clam but failed. im not sure if this is a false positive, because two other antivirus softwares detected it. i dont want to format my computer right now because its part of workstations being used in a laboratory.

please paste your scan report

mabriola,

don't know if this helps, but I had a similar problem with a PC having hard disk problems. The scan detected a virus, only the hard disk was about to fail (died two days later:-( ) and trying to remove it we had errors during write and the file stood still.

Obviously the virus was the lesser problem and got solved for the worse two days later... But could explain this behaviour.

Best Regards

vanni,

i'm hoping that's not gonna be the case in my problem. but just in case that would be the worst scenario, im bracing
myself.

==============

alch,

here's the scan report. hope this would help.

File excluded 'C:\Documents and Settings\All Users\.clamwin\quarantine\NETSVCS.EXE'
ERROR: Can't open file C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp
ERROR: Can't open file C:\pagefile.sys

C:\Documents and Settings\All Users\.clamwin\quarantine\NETSVCS.EXE: Worm.Gaobot FOUND
-- summary --
Known viruses: 66775
Engine version: 0.88.4
Scanned directories: 254646
Scanned files: 369966
Infected files: 1

Not moved: 1
Data scanned: 19323.16 MB
Time: 9399.984 sec (156 m 39 s)
--------------------------------------
Completed
--------------------------------------

Seems it is already moved into quarantine, so it should be safe.

=======

that should have been the case but unfortunately it wasn't quarantined when i try to delete it there. that's my dilema, coz i cant find it either in the quarantine folder nor in its's location (as reflected in the report).

mabriola

try using the command prompt. I seem to remember that some executables have +H and/or +S attributes set, and this renders them invisible.
but if you use


you can see them right away. If clam for any reason didn't reset the file's attributes, this way you can see it.

Then, if this is the case, you can reset it's attributes with



-S resets System attribute
-R resets Read only attribute
-H resets Hidden attribute

and then you can delete it without further hassle.

Hope this helps
Bye

vanni,

thanks! i only needed to change the attribute for it to be displayed and deleted.
and to all you guys who gave their thoughts for my problem, thanks.