vaughan
Joined: 01 Feb 2009 |
Posts: 0 |
Location: Telford |
|
 |
Posted: Sun Feb 01, 2009 8:11 pm |
|
 |
 |
 |
 |
Hi,
I have only recently downloaded and used this software - it seems very good indeed. However, I seem to have encountered a virus and when running scans receive numerous messages to the effect of:
FS758.CAB: Worm.P2P.Poom.A FOUND
I have tried the removal and quarantine options but the files remain infected.
What should I do please? How can I remove this?
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Mon Feb 02, 2009 3:54 am |
|
 |
 |
 |
 |
Welcome to ClamWin!
ClamWin comes with a detection default of Report Only, and you should probably leave it at that until/unless you are sure a detection notification is for a real virus and is not a false positive. To verify whether a detection is real or not (most detection notices are real, but you can get a false positive now and then), upload the file to Jotti at https://virusscan.jotti.org/ on the web or to VirusTotal at https://www.virustotal.com/ on the web. Either service will scan the file with multiple antivirus programs, including Clam. If more than a couple of AVs besides Clam find a file is infected, it probably is. If only a couple of them besides Clam find an infection, it is very likely a false positive. Tell Clam about false positives at https://www.clamav.net/sendvirus/ on the web--upload the file to them, tell them it is a false positive, and provide the name of the virus that ClamWin falsely identifies in the file.
If the virus is real, you can scan with ClamWin set to Remove or Quarantine--just like you already did. Some viruses are tough to remove, and you can try to remove them by booting Windows in Safe Mode (hit F8 key repeatedly during the boot. When you are confronted with several bootup choices, choose Safe Mode Without Networking and wait until Safe Mode appears on the corners of your screen). Once you are in Safe Mode, set ClamWin to Remove or Quarantine and run a scan on the file or directory where the file is located (scans in Safe Mode may take longer than normal). After the scan is finished, reboot Windows like normal and see if the file is gone.
If this doesn't work, there is some more help listed on the ClamWin Anti-Malware page, which you can access from ClamWin's home on the web. If neither Malwarebytes' Antimalware program or Dr. Web's Cureit program don't remove the virus, then seek expert help.
Regards,
|
|