Cannot Delete: Virus Description: Win32:Namedy [Wrm]

Viruses and worms
1

Please Help Me!

I do not know exactly (most probably with trusted apps or some homepage) how this baby got onto my comp, but it keeps coming back after deletion when I start the system.

I was notified by Avast runnig in background, and I didn’t find it via a deliberate scan.

I have tried to immediately delete it in the pop-up warning window; I have tried to move to chest and than deleting it, but the next time I turn on the computer it finds it immediately.

The rescan in chest gives the following report:
RESUME:
Action was completed successfully!

Virus has been detected!
File Name: A0039327.exe
FileID: 11
Virus Description: Win32:Namedy [Wrm]

DETAILED INFORMATION:

Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\ALEXAN~1\LOCALS~1\Temp_avast4_\unp97479460.tmp
FileID: 0000000011 Original file name: C:\System Volume Information_restore{F58589F8-1B81-4E89-B8A1-555B4D71214D}\RP227\A0039327.exe New folder: C:\DOCUME~1\ALEXAN~1\LOCALS~1\Temp_avast4_\unp97479460.tmp\11.exe

Scan files in the temporary folder: C:\DOCUME~1\ALEXAN~1\LOCALS~1\Temp_avast4_\unp97479460.tmp
C:\DOCUME~1\ALEXAN~1\LOCALS~1\Temp_avast4_\unp97479460.tmp\11.exe Win32:Namedy [Wrm]

Action was completed successfully!

What the **** should I do?

Any Ideas?

Anybody has come across this worm?

Thank You for Your Time and Answers.

2
  1. Files in use are protected by windows, even viruses/malware.
    To get around this you can try and schedule a boot-time scan from within avast. However this seems to be related to point 2 below, avast has to unpack files to scan them it used the folder indicated by you ‘ALEXAN~1\LOCALS~1\Temp_avast4_\unp97479460.tmp’ so the real problem is the system restore protected storage in 2 below.

I’m somewhat surprised that avast did a background scan of the system volume information folder, unless you had just deleted something that caused a restore point to be created.

  1. Infected restore points in the C:\System Volume Information folder (part of system restore) are also protected by windows.
    Disable system restore, reboot, that will clear All restore points, run a system scan, when you are clear you can enable system restore again.
3

Welcome to the forums, antares. :slight_smile:

Since David has posted help already, I will just add that Win32:Namedy was added to the virus database on 20.03.2006 - 0612-0 and thankfully that has helped you.

Please let us know the results. :slight_smile:

4

THANK YOU FOR THE INFORMATION. :wink:
DISABLING SYSTEM RESTORE DID HELP THE PROBLEM…!

“PEACE LOVE & UNITY IS THE KEY”

5

Glad we could help, welcome to the forums.