| Update, I guess I spoke too quickly last night my "W32HLLW.Gaobot.gen" trojan showed up again. This thing is a real bear to get rid of. It shows up first in a W2k OS in, C:\WINNT\system32\drivers\etc\hosts. If you go to this file and right click and choose open with notepad you find a long list of every help site you can imagine, Symantec, McAfee, Microsoft, etc. It denies access to these sites, you get this page cannot be displayed. You delete all but the first one 127.0.0.1 local host. This allows you to go to these sites at least until it blocks them again. I finally got to Symantec and downloaded the removal instructions and the removal tool. I ran the tool and it showed it removed it, so I did a complete system scan on both hard drives and found more infection. I ran the tool again and scanned and haven't had a warning or found anything in the scans since around noon today. I was worried about Sasser, and in fact downloaded the instructions and removal tool for it but didn't need it. If it shows up again I know now how to remove it manually, but it involves removing a lot of files, and also checking the registry and deleting all the bad files. Keeping my fingers crossed. |
