Virus.Win32.Gpcode.ak present on my desktop

[Javiier]

My anti virus Panda keeps on poping up a threat message regarding Virus.Win32.Gpcode.ak. When I try to select the delete action it does gets deleted. But again when I start my desktop it again Popup this threat message. Can any one provide a detail on this alert message. How to delete this? I am using an Intel Core 2 Duo Processor and Windows XP operating system.

[Milton.J]

The other name for malware Gpcode.ak is Virus.Win32.Gpcode.ak. This is a malicious programs that detects network security flaws. Once it locates a security hole it attacks the computers on that network and spreads the malware. This will then cause a number of pop-ups to appear on the infected machine. The reason this malware got downloaded to your desktop is due to unknown source download, opening a link in a unknown spam email, or clicking on advertisements.

[Snake08]

You can try the System Restore utility of Windows operating system to restore your desktop computer to an earlier safe state. This will not completely remove the virus but still it will most probably be deactivated. Thus you can then use your anti virus to delete the virus. To restore your desktop computer,

1. Go to the Windows Globe icon.
2. Click on All Programs.
3. Click on Accessories.
4. Go to System Tools.
5. Click on System Restore.
6. Select a restore point to restore your computer.

[Steve123]

This malware is not getting deleted from your desktop is probably because it has got a process of its own running in the task manager which creates the malware each time when you boot or re-boot your machine. I had a similar Trojan which got itself in my task manager and even after deleting it hundreds of times, it would re-appear. I then checked my task manager to find that an unknown application was running. I Terminated that process and then scanned my machine. This helped me to delete that Trojan. For the Virus.Win32.Gpcode.ak see if any Win32.Gpcode.ak files are running in the task manager. Detect them and terminate those processes. Then scan your machine.

[shalomshachne]

I had this problem too, after visiting a website which showed Simpson's videos. No idea how this installed itself, but after looking at this series of postings, and another which helpfully said that some of these viruses use 2 processes to monitor each other - I was able to track down the 2 processes, and write a simple windows batch file to fix it.

I used SysInternals Procexp.exe (free utility) to help track down the bad process. (I also ran msconfig to see what had been added to start up and noticed to strange entries to \Documents And Settings\Sam\Locals\Temp\..).

Here was the script: (I created it in notepad as killvirus.bat, and then ran it at command prompt).

taskkill /IM richtx64.exe /F
del "C:\Documents and Settings\Sam\Local Settings\Temp\richtx64.exe"
taskkill /IM wscsvc32.exe /F
del "C:\Documents and Settings\Sam\Local Settings\Temp\wscsvc32.exe"


You can see the 2 process names: richtx64.exe and wscsvc32.exe. The batch file killed each process and then deleted the exe, and that seems to have cleared up the virus.

All you need to do is track down where the 2 exes copied themselves.