Help with [Wrm], Win32:SpyBot-A106

[Glicoboy]

Hi everybody ....these days i noticed that my pc was going very slow,so i decided to do a virus scan with avast!.....finally i found (at least,my brother told me ) a Worm,called Spybot-A106....is there a fix?How could i solve this problem without formatting the HD?

[whocares]

Hi,

where was the virus found (path/folder/filename) ?

please read "VirusRemoval" below and come back with more info..

Virus descriptions & removal instructions.:
Spybot-A106

 

[Glicoboy]

my brother said that the file infected was explorer.exe  

[igor]

What was the full path of the file? (i.e. what folder was this explorer.exe in?)

[Glicoboy]

it's C:/WINNT/explorer.exe

[whocares]

it's C:/WINNT/explorer.exe

how did you find out ? via a filesearch or from avast's report ?

- please post the relevant parts of avast's log/report (on the worm & infected file)

- set your WindowsExplorer to show all files/folders, even system & hidden ones (via extras/View -> folder options),
then search again for all occurences of explorer.exe

- please test the file(s) with onlinescanners KAV, Trend & RAV (see below "VirusRemoval")
and submit any viruses not detected by avast to virus@avast.com
 

[Glicoboy]

i found out by scanning the hd with avast!,but it couldn't repair the file...well...i'll do what you tell me to do  

[DavidR]

it's C:/WINNT/explorer.exe

Edit: removed comments probably wrong (and as such possibly harmful), based on assumed OS

[whocares]

Hi DavidR,

huh ?  

you ever heard of Windows 2000 ?

I have a
C:\WINNT\explorer.exe (240 kb) and that's quite certainly not infected/malicious

maybe you confused this with iexplore.exe versus iexplorer.exe ?

could be
- infected Explorer.exe
- replaced explorer.exe
- false alarm

Glicoboy didn't say if he TRIED repairing..
but repair not working don't mean much, since explorer (good or bad) will be locked even in safe Mode

he should:
- copy the file to a new, empty folder and then test it there and/or at the original location with a couple of Onlinescanners

- send the file to avast for inspection

- boot to safeMode, open a DOS-Box & avast scanner, kill (all) explorer processes, change with ALT+TAB to avast and try scanning&repairing it then
(NO WARRANTY!! But hey: no risk no fun   )
if successful: ALT+TAB to DOS-Box and enter explorer & reboot

*

btw: Glicoboy, what win-version DO you use ? 2000 or XP ?
if XP, I  revoke the above and claim the opposite...

are/were all windowsupdates applied ?

[DavidR]

Obviously not, I didn't twig with the path that he was using win2K as he didn't say and assumed XP, incorrectly it would appear.

[Glicoboy]

my os is windows 2000 and i tried repairing the file(no,it isn't iexplorer.exe ),but avast didn't succeed  

[whocares]

Please tell exactly WHAT you did, with what results/error messages etc etc etc..
otherwise no real help is possible


What are the results of onlinescans ?