Printable View
Hi,
I need some technical reference of Gaobot worm. This type of infection mostly exist in all my systems connected to a single network. I did not understand that how does the worm enter my computer. I want to delete all the files created by the virus. I am currently using a freeware version of Claimwin antivirus. But still for more safety what are files and the locations created by the virus. Thanks.
The worm creates a series of files in the computer. This files spread through network hampering your system resource. You can run a full system scan under safe mode to get rid of this. The other files which are created by the same is scvhost.exe, csrrs.exe, wincrt32.exe, dosrun32,exe, etc. This all are executable files which runs automatically.
The worm normally generates a series of files in Windows system folder. This files are associated with Registry value by which they are launch automatically when a system boots up. The files are sfc_os.dll, ftp.exe, dllcache, tftp.exe, tcpip.exe, tcpip.sys, etc. It is recommended to run a full system scan under safe mode for complete removal of the same. Do not run system restore because this will revert back the infection.
Many files created by this lies hidden. But it not only creates files in Windows directory but also it generates registry values. Click on Start > Run > Regedit. In the editor navigate to the following path - HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SFCDisable = 0xFFFFFF9D and HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ WaitToKillServiceTimeout = "7000". Delete all the last keys from here.