Member Avatar for gmurphy

New to this.

Problem, cpu chewed up by the above. Before I found the file it was killing all spyware and antivirus software. After stopping the task, Norton comes up clean, every spyware, adware, trogen killer comes up clean. I have run norton on the network comes up clean.

Symantec had instructions to remove (w32hllw.gaobot.ca), wstart32 from reg, and stop the task. Which I did. I found these two files hidden in sys32. I saved a copy to disk and deleted them. Machine seems to run fine now. My concern is, is the infecting file is still hiding? Also, running netstat, there seems to be some ports that are listening ie. 42555, 34012, microsoft-ds, 1029. Anyone have any suggestions?

  • 2 Contributors
  • 2 Replies
  • 109 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gmurphy
Member Avatar for TallCool1

Some of those are suspicious. I Googled each one using "port xxx" (in quotes), where xxx was the port number. I'll leave this as an exercise for you, but do it soon (hint).

I would also run something like PrcView or CodeStuff Starter to see what threads and processes are running.

Member Avatar for gmurphy

Thanks,
googled the ports, one was suspicious. after i stop the wstart32.exe, the suspicious activity is stopped. I also installed PrcView. Same tasks running in taskmgr. I was hoping to get an answer regarding spyware or a virus hidden and if deleting the key in the reg and the file itself will keep it from comming back?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.