PA Bear [MS MVP]

[X-post to microsoft.public.windows.vista.security newsgroup. This has
nothing to do with Windows Update.]

NAV (even if your subscription is current) will neither detect or remove
such hijackware. Allow the MSRT to delete the file.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Gan wrote:
> i too have somilar kind of the problem...
>
> At the end of the MRT log, it says that,
>
> **************************************************
> Found possible virus: PWS:Win32/Corripio.gen!C in
> file://D:\DWN\????email???????? .zip->ªAªúñ]¡nemail¿¦¦L¦ß¬¦¬F¬F¦¦ºA
> .cmd->(ZipSfx)->16.sfx.exe->(ZipSfx)->16.exe->(PECompact2
> v2.50+)->[RSRCEmb]
>
> Results Summary:
> ----------------
> Found PWS:Win32/Corripio.gen!C (detected generically)
>
> Return code: 6
> Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 08
> 05:45:03 2008 ************************************************** *
>
> This file is in my D drive, and i could able to see this file once after
> completely scanning my PC with MRT.
>
> I have Windows Vista SP1 installed also i have a purchased version of
> Norton Antivirus 2007 installed.
>
> When i scan that particular infected zip file with my NAV2007, it says
> that
> there are no security risks detected.
>
> Does my NAV2007 is not able to detect that virus? Could you guys tell me
> how do i get rid of this gamming virus?
>
> Thanks in advance for your help
>
> -Gan