Help!! I have a worm and can't get rid of the damn thing?

ps: a hint for later:

if you have a virus, just google: virus name + removal tool....

it helps!

Discovered: February 17, 2006

Updated: February 13, 2007 12:51:25 PM

Also Known As: Win32/Alcan.I [Computer Associ, P2P-Worm.Win32.VB.dw [Kaspersk, W32/Generic.m [McAfee], W32/VB-YY [Sophos], WORM_GAOBOT.DF [Trend Micro]

Type: Worm

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).

2. Update the virus definitions.

3. Run a full system scan and delete all the files detected.

4. Delete any values added to the registry.

For specific details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)

If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

* How to disable or enable Windows Me System Restore

* How to turn off or turn on Windows XP System Restore

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, reenable System Restore by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article: Antivirus Tools Cannot Clean Infected Files in the _Restore Folder (Article ID: Q263455).

2. To update the virus definitions

Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

* Running LiveUpdate, which is the easiest way to obtain virus definitions:

o If you use Norton AntiVirus 2006, Symantec AntiVirus Corporate Edition 10.0, or newer products, LiveUpdate definitions are updated daily. These products include newer technology.

o If you use Norton AntiVirus 2005, Symantec AntiVirus Corporate Edition 9.0, or earlier products, LiveUpdate definitions are updated weekly. The exception is major outbreaks, when definitions are updated more often.

* Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted daily. You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to Virus Definitions (Intelligent Updater).

The latest Intelligent Updater virus definitions can be obtained here: Intelligent Updater virus definitions. For detailed instructions read the document: How to update virus definition files using the Intelligent Updater.

3. To scan for and delete the infected files

1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.

* For Norton AntiVirus consumer products: Read the document: How to configure Norton AntiVirus to scan all files.

* For Symantec AntiVirus Enterprise products: Read the document: How to verify that a Symantec Corporate antivirus product is set to scan all files.

2. Run a full system scan.

3. If any files are detected, click Delete.

4. Click Start > Run

5. Type cmd

6. Press Enter

7. Type cd %system%

8. Press Enter

9. Type attrib -s -h netstat.com

10. Press Enter

11. Type del netstat.com

12. Press Enter

13. Type attrib -s -h cmd.com

14. Press Enter

15. Type del cmd.com

16. Press Enter

17. Type attrib -s -h ping.com

18. Press Enter

19. Type del ping.com

20. Press Enter

21. Type attrib -s -h regedit.com

22. Press Enter

23. Type del regedit.com

24. Press Enter

25. Type attrib -s -h taskkill.com

26. Press Enter

27. Type del taskkill.com

28. Press Enter

29. Type attrib -s -h tasklist.com

30. Press Enter

31. Type del tasklist.com

32. Press Enter

33. Type attrib -s -h tracert.com

34. Press Enter

35. Type del tracert.com

36. Press Enter

37. Exit the Command Prompt

Important: If you are unable to start your Symantec antivirus product or the product reports that it cannot delete a detected file, you may need to stop the risk from running in order to remove it. To do this, run the scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode. Once you have restarted in Safe mode, run the scan again.

After the files are deleted, restart the computer in Normal mode and proceed with the next section.

Warning messages may be displayed when the computer is restarted, since the threat may not be fully removed at this point. You can ignore these messages and click OK. These messages will not appear when the computer is restarted after the removal instructions have been fully completed. The messages displayed may be similar to the following:

Title: [FILE PATH]

Message body: Windows cannot find [FILE NAME]. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

4. To delete the value from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

1. Click Start > Run.

2. Type regedit

3. Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

4. Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

5. In the right pane, delete the value:

"outlook" = "%ProgramFiles%\outlook\outlook.exe /auto"

6. Exit the Registry Editor.

As the biggest of the problems seem to be associated with Spyware, for starters, download, update and run a full scan using the following product:

http://www.superantispyware.com/

SuperAntiSpyware is exceptional and will remove the majority of difficult Trojans and Worms, not just the easy ones.

If possible it is recommended that you load the application in normal mode but run it in Safe Mode. Safe Mode can be started by continually pressing F8 during the boot sequence. If you are badly infected you might need to run SuperAntiSpyware more than once to help clean your system. If the only infections now being shown are in System Restore, once you are completely satisfied that you can boot normally, you can either delete the infected restore points manually, or temporarily turn off System Restore.

Assuming you have some real awkward infections that persist even after trying all the above I suggest you download a Smitfraud removal program from:

http://www.afterdawn.com/software/desktop_software...

If possible run in Safe Mode.

Likewise try VundoFix:

http://vundofix.atribune.org/

Good luck & safe surfing.

wdw

Go to your local Staples or OfficeMax and buy the Panda Internet Security 2008. Install it and run the full computer scan. It should remove the worm. Panda has it's on uninstaller.

when you pop in the disc, it will say (in your case two or more) it found programs that were incompatible on your computer. It will give you the option of uninstalling them and then putting the panda on your computer.

Be sure to take out the disc before you restart to finalize the installation. Otherwise it will startup in the recovery mode of the panda disc. The Panda I.S. comes with an instruction booklet on how to install it also.

I hope this solves your problem!

As I stated before, LIMEWIRE is full of viruses, worms and trojan horses, I wont even touch the program. As for the worm, make sure that it is not running (check the task manager and if you know the name of the file select it and select end process) Google search "stinger" which you need to download and run and that program will scan for any worms found on your PC and deletes them. I hope you have learned a lession here.

Have you updated your protections?

W32.Alcra.F is a worm that attempts to propagate through various file-share networks accessible with BearShare, LimeWire, Morpheus and Shareaza applications. It also attempts to disable several programs on the compromised computer and drops a variant of W32.Spybot.Worm onto the compromised computer.

Try running your spyware protection ( like Spyware Doctor) to remove this worm.

I can't help you with this except to tell you next time don't download stuff.....

I'm no pro but my friend's brother downloaded music from that place and she had to go get a new hard drive. The professional told her that any place you don't have to pay for music to download is not a good thing.

I once tried to download a screen saver at work and my computer locked up cuz of our system's security. Basically anything out there that you don't know the source could potentially be harmful. So in the future I would risk it cuz you might have some valuable equipment or information.....

Best of luck with this.

First of all limewire is full of that kind of **** all you need to do is in the norton delete the worm if it cannot be fixed just delete it.

Just open the norton and you will find it in the quarintined files folder from there you should have the option to delete it but also remember if you have your system restore on you will also need to delete all of the restore points up to the time tyou delete this worm or it will still be in there. good luck and stay away from limewire or should it be called wormwire

You seem to have the answer from some of the others already but just remember next time you download something scan it first before opening,i use limewire a lot and always scan what i have just downloaded first as there are a few viruses on there but i have always got to them by scanning before opening.

Get Ad-Aware 2007 by Lava Soft it's free and run the full scan and also alot of the other virus/trojan ext. scanners are a load of crap and can posibly have a virus. So give this a try and run it more then once. I usaly run it about a max at 4 times for the scanner to find the really bad virus/trojan/cookie/worm

Here's the link just hit the green download button for the free verson :) http://www.lavasoftusa.com/single/trialpay.php

I've downloaded that worm dozens of times! Its never been a problem because Norton has always caught it! Perhaps you need to download the Norton updates?