Computing.Net > Forums > Security and Virus > Help please!

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Help please!

Reply to Message Icon

Original Message
Name: roonaldo18
Date: June 25, 2004 at 10:35:33 Pacific
Subject: Help please!
OS: XP PRO
CPU/Ram: 128mb
Comment:

Hello all,

I've got a virus on my computer that McAfee picked up but it cannot delete it, cannot clean it and cannot quarantine it?

It's called: WUAMGRD.EXE

Which is in my System32 file

And McAfee calls it Morphine?

Help Please!!!!!!!!



Report Offensive Message For Removal


Response Number 1
Name: stillwellvj
Date: June 25, 2004 at 10:50:10 Pacific
Reply: (edit)

goto
http://www.spywareinfo.com/downloads/tools/HijackThis.exe
Download...
It will ask you to fix selected problems, and that should work!

The other option is to search your computer for WUAMGRD.EXE and delete it.

This specific trojan can get nasty so it is advised to resolve this promptly!

email me if you need more help

jOhn


Report Offensive Follow Up For Removal

Response Number 2
Name: ranchhand
Date: June 25, 2004 at 11:29:23 Pacific
Reply: (edit)

Go here and run Trend Micros free online scan, that should kill it.
http://housecall.trendmicro.com/

If for some reason it doesn't, try this:


Press CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs locate the file WORM_AGOBOT.LV

Select the file(s), then press the End Task button.

To check if it has been deleted from working memory, close Task Manager, and then open it again.
Close Task Manager.

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:

HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run

In the right panel, locate and delete the entry:
Microsoft DirectX=”wuamgrd.exe”

In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunServices;

In the right panel, locate and delete the entry:
Microsoft DirectX=”wuamgrd.exe”

In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run

In the right panel, locate and delete the entry:
Microsoft DirectX=”wuamgrd.exe”
Close Registry Editor.

Reboot and check Task Manager again to make sure the file hasn't reloaded. If it has, post back because you must have a new variation of it, but I don't think this one has any hidden .DLL files like Cool Web Search has.


Report Offensive Follow Up For Removal

Response Number 3
Name: murve
Date: June 25, 2004 at 16:23:06 Pacific
Reply: (edit)

hi mike,
disable your system restore to flush out the virus from your restore folder. get the latest virus defs. reboot to safe mode, scan your computer with your anti-virus, delete all files it picks up, while your there also scan with spybot and adaware, delete all files they pick up, clean out your cache, temp files, history and cookie folders, clean out your recycle bin.
while in safe mode it would be a good idea to follow ranchhand's advice.
reboot to normal mode, re enable system restore.
all the best,
murve


Report Offensive Follow Up For Removal







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home








Do you have your own blog?

Yes
No
I did before
I will soon


View Results

Poll Finishes In 5 Days.
Discuss in The Lounge
Poll History




Data Recovery Software