Win32:Gaobot-2250 [wrm]

Viruses and worms
1

Hi all!

I know it sounds stupid, but I didn’t know that you must delete files from Chest and now it’s full. I’m not sure which files i can delete and which not. Could someone tell me that please? And then I have some folder with a lot of files in it and they are probably all infected with Win32:Gaobot-2250 [wrm], but I can’t see this folder even if I show hidden icons, so I can’t delete it. How can I fount and delete it?

I have Windows XP and avast automatic update, Ad-aware SE and Spy Sweeper

2

There is no rush to delete anything from the chest, they can’t do any harm there.
Anything that you send to the chest you should leave there for at least a week or two. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

So in your case if you have old detections in the Infected Files section of the chest you can delete them. It is also possible to increase the space allocated to the chest.

And then I have some folder with a lot of files in it and they are probably all infected with Win32:Gaobot-2250 [wrm], but I can’t see this folder
What is the file name/s (just a couple of examples) and the folder location ?

What is your OS ?

3

Welcome to the forums, xmex. :slight_smile:

To add to what David has posted, please make sure you do not delete the files listed in the System files section of the Chest. These files should not be infected and are backup system files in case they are ever needed.

Please come back often, learn more, and maybe help others. :slight_smile:

4

Thanks for replaing and welcome :slight_smile:

Here are few example from the folder and location

http://img519.imageshack.us/my.php?image=06gv.png

which files i can delete?

http://img507.imageshack.us/my.php?image=10ga2.jpg

i know that i shouldn’t delete files from C:, C:\WINDOWS, C:\windows\system32

what about the others, can i delete all?

What is your OS ?

OS is operating system right? i’m using Windows XP

5
i know that i shouldn't delete files from C:, C:\WINDOWS, C:\windows\system32
That is not entirely correct as it is a common tactic of malware to place files in the system folders, so people won't remove them and windows protects them. If they were essential system files moving them to the chest would almost certainly have an effect.

I can’t say what to delete, firstly there is nothing to indicate how long they have been in the chest (my fault I assumed you would state that), nor if you have scanned them again and they are still detected as infected. If they are older than two to three weeks it is likely that they would be ok to be deleted, but I or no one else can say for sure without more information.

Following this course of action should ensure that they are OK to delete:

Anything that you send to the chest you should leave there for at least a week or two. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

The ones that are from the System Volume Information folder are OK to remove and unless you disabled system restore (as part of the removal process), copies are almost certainly still there as it is protected by windows. A full scan would confirm that, if any are found in the System Volume Information folder you will have to disable system restore and reboot, this will cleat ALL restore points, if you are clear then enable system restore and reboot.

Win XP-ME - How to disable System Restore