gaobot.gen

[chikakat]

Hey all,

I'm running Windows XP (service pack 2), and Norton keeps telling me I've got the w32.hllw.gaobot.gen virus. I've run Norton system scans, and it sucessfully deletes the infected files and then is clean on the next scan, but within a few hours (sometimes minutes), the warning is back. I've also run Symantec's fix tool, in safe mode and standard, and it doesn't find anything. I've tried the manual fix outlined on Symantec's site, but the hosts files and the registry are clean, although Symantec does note that not all variants of the virus change these.

The specific warning coming up tells me that c:\crss.exe is being detected as an infected object and deleted. I've emptied Norton's quarantine, disabled system restore, deleted everything that seems like the virus could be hiding in, but no luck. I'm wondering - is it possible that I'm getting warnings for some reason other than a virus? As I mentioned, I can't find any sign of the virus anywhere, and the computer is behaving perfectly well.

One sketchy bit, though: the Norton activity log occasionally lists the affected user as 'guest' - it shows my login as the active one only about half the time. Not sure why this is...

Any help or suggestions are greatly appreciated.

Thank you!

 

[SkyHi]

Have you even tried google?

 

[jcb]

Try running windows update. There might be a patch to stop this virus from keep on coming back

 

[New Age Outlaw]

Try this link.
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.gen.html

 

[Blitze105]

hmm we all knwo who is a google lover.. (i am too) any how.. for your virus scan with something else. AVG works with norton so maybe install it? (make sure u do it right) and maybe then itll fix it. might be a worm if it keeps coming back. ill look it up later and post back if i find something simple to remove it

 

[chikakat]

Thanks for all the suggestions...I did try google (that's how I found this forum) and most of what I can find just directs me to the symantec fix New Age Outlaw linked to, which, as I mentioned, doesn't seem to be doing much.

I checked if microsoft had any patches available, but I've already got them, it seems. (They were incorporated into the service pack 2 update.)

I downloaded AVG and scanned the computer a few times, but it couldn't find any infection. The warnings from Norton are still popping up, though.

Thanks again for your help.

 

[Lobos]

Can you give us the report from norton it maybe in your systems restore folder

 

[chikakat]

I'm not sure what report from norton you mean. Do you want a copy of the recent activity log?

Meanwhile, norton's quieted down, while avg's started sending up warnings, finding the same file norton had been complaining about (crss.exe). It can't heal, delete or move it, though. I ran the fix linked to earlier again (in safe mode), scanned with norton and avg (no infection), and within a few minutes was getting warnings again.