Worm:Win32/Gamarue

[44surf]

Microsoft Security Security essentials indicated that my desktop was infected with worm:win32/gamarue.B. It said it was removed, but the task manager showed it as running. I ended the task and I am running a full system virus scan. It seems that the worm first infected the computer on 12/5. The history says allowed then removed. It seems to be running at start up. I shut down the computer every night. Any suggestions? I am posting from my laptop which is not infected...at least so far. Thanks in advance for your help. The full scan said it found no threats.

 

[Dark Lord of Tech]

Delete eveyrthing it finds

 

[verbalizer]

Delete eveyrthing it finds

+1

 

[aford10]

It's probably not as bad as it seems. Superantispyware often detects harmless cookies as threats. The the trojans are another story tho.

 

[44surf]

I deleted...or quarantined. I am going to have to go back in figure out hoe to delete. It found about 300 cookies on my laptop also. I also uninstalled MSE and downloaded and installed avast. When I ran the scan it said there were files that could not be scanned. What is that about? After that message I ran the antispyware app on the laptop...and it found all the adware. No trojens though.

 

[Dark Lord of Tech]

Your probably fine now but when you install Avast schedule it to do a scan on boot!

 

[44surf]

So since the antispyware is a portable app...where did it quarantine all the files to so I can delete them?

 

[44surf]

Your probably fine now but when you install Avast schedule it to do a scan on boot!

Okay...thanks. You know I shut down the computers every night and reboot in the morning. I know you are not supposed to do that...but I hate to leave them running. The desktop seems wake up off and on unless I shut it down. I come out in the middle of the night and it's running. My laptop automatically goes to sleep with so many minutes of no use. It's irritating because it just stops while i am running a scan and I have to wake it by tapping the mouse pad.

 

[Dark Lord of Tech]

Threats that have been detected can be removed but not quarantined. The program description is in this regard confusing as appears to support the quarantine when in fact it is not.

Quarantined items are only stored in memory. No items are stored in the quarantine over sessions. Users need to keep that in mind since it makes it impossible to restore a false positive after the program has been closed. But that’s how other most portable solutions and antivirus Live CDs work.

 

[44surf]

So they are all gone right? Even though it said quarantine. Just making sure.

 

[verbalizer]

yes.

 

[Dark Lord of Tech]

Yes they are never stored just deleted!

 

[44surf]

Also...in your message you said that no updates were needed? so I can use this app in the future without updating? Sorry for so many questions...but I want to make sure that I am doing all of this correctly.

 

[44surf]

You guys are so awesome! Love tomshardware!


:lol: @ mals sig pic!

 

[Dark Lord of Tech]

No, it is updated daily,so you have to download the portable version everytime you want to use it.The free non-portable version can be updated because it gets installed on your computer.

 

[Dark Lord of Tech]

The portable version doesn't include a given name to the executeable , so that smarter malware will not block it , that is why i had you use the portable version

 

[44surf]

Okay thanks. So I would just go to the site download and burn to a cd and run. How often do you recommend? Because obviously my virus protection is not working! LOL!

 

[Dark Lord of Tech]

http/www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
^^^^^^^^
Now that your system seems to be clean,just download and install the free version and run it once a week or if you suspect and issue

 

[44surf]

The portable version doesn't include a given name to the executeable , so that smarter malware will not block it , that is why i had you use the portable version

I wasn't sure I was burning the right file. It was called some random thing. I had to go by the date and time of the download. But when I opened it voila! There it was!

 

[Dark Lord of Tech]

Use the portable version for bigger issues or stubborn malware.

 

[Dark Lord of Tech]

It is always randomly named so malware won't block the running or installation.