Goddamn worm!!!!

[paul.rohit]

i unwittingly had clicked on a suspicious facebook link which led to my computer being affected by a worm called the "slenfbot.gen!g".quick heal did not detect anything. this led to two things happening.

1) i got alerts from windows action centre about the worm and had the option to delete or quarantine it. I removed the worm but every time i turn on the machine/ restart it the worm cropped up again. i updated windows definitions and after a native boot scan by quick heal that no longer happens.

2)but the 2nd pop up that used to appear saying "c/windows/SysWOW64/svchost.exe" is trying to send emails and is not a trusted email client. ive always clicked no to this option. im pretty sure this is because of the worm as well.when i scan this file with quick heal it says its virus free which im sure is not true.

please help and advise me on what to do.

 

[dashing.sujay]

1) Stop using Quick Heal.

2) Use ESET, update it and get rid of all viruses/worms after scanning the PC.

 

[doomgiver]

download "Unlocker" software.
go to task manager
find the offending worm process (look under the image path name column, it will be something like "c/windows/SysWOW64/svchost.exe")
kill the process
immediately right click the program/worm in windows explorer, and select unlocker option
then, choose the "delete" option from the drop down menu, or if it shows a large screen with multiple lines and processes, choose "kill process" and "unlock all" along with delete option.

this will delete the worm 7/10 times.

do this preferrably in safe mode.

reboot and see if it remains

and yeah, **** anti-viruses. i've never used one, and im still virus-free.

 

[Anorion]

hmm. spyware doctor.

 

[topgear]

@ OP - use Avira/AVG rescue disc to scan the pc.

 

[Zangetsu]

@paul: get an anivirus which has all the features of spyware/adware etc (if need be paid one)
but remove quick heal...

update the virus definitions to the latest & scan full system

 

[paul.rohit]

ok im gonna use another antivirus before i try the safe mode thing. thanks guys. ill update you if it works

 

[nghtcrwlr]

And if it does not, use Combofix.

 

[Anorion]

try anti spyware
combofix is good
so is spybot

run 2-3 scans from 2-3 diff software one after the other

also maybe use registry mechanic after the above depending on the severity

 

[coderunknown]

1) Stop using Quick Heal.

+1. no to quick heal. total waste of money.

 

[meetdilip]

Use Malwarebytes and do a full system scan.