My internet randomly disconnects and stops functioning. Also I randomly shut down in windows without selecting shut down. When I try to install my copy of Mcafee Antivirus it is shutdown 1/2 way through installation. Looks like it is just killed out of nowhere. Looks like someone made a somewhat subtle yet annoying virus that has some good protection against it. Damn myself for not installing Mcafee when I first installed windows. Anyone know how to clear this out or what steps I should take towards nailing it?
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Im sure its a virus...
- Thread starter topslop1
- Start date
CommanderFrank
Cat Can't Scratch It
- Joined
- May 9, 2000
- Messages
- 75,399
Try Norton's online scanner
http://security.symantec.com/sscv6/home.asp?j=1&langid=ie&venid=sym&plfid=23&pkj=TLDKLHFEPGEVVSDUXLX
http://security.symantec.com/sscv6/home.asp?j=1&langid=ie&venid=sym&plfid=23&pkj=TLDKLHFEPGEVVSDUXLX
I
Ice Czar
Guest
or trend micro's online scanner
http://housecall.trendmicro.com/
also its always a good idea to install security software to non-default directories,
"Ever since the days when the very first anti-virus scanners were created, virus authors (and now authors of trojans, worms, and so on) have been looking for ways for their viruses and other creations to fight back by attacking the security software that detects them (such as scanners) or restricts them (such as firewalls). Over the last couple of years in particular a growing trend has emerged with a lot of new remote access trojans now terminating, tampering with and even destroying most security software - many even come with built-in lists of several hundred security programs to look for which they then terminate and delete before infecting a system. When a virus destroys your antivirus software you're left with very few options, but Process Guard provides a unique defensive option as it can be deployed to prevent the virus from being able to terminate the antivirus program when you re-install it, allowing you to then scan, detect, and disinfect the virus without having to worry about the virus killing the antivirus program."
http://www.diamondcs.com.au/processguard/
and then monitor them for changes with a filechecker
in addition you should get a registry monitor
http://www.diamondcs.com.au/index.php?page=regprot freeware
http://www.wilderssecurity.com/index.php?board=8 freeware
http://housecall.trendmicro.com/
also its always a good idea to install security software to non-default directories,
"Ever since the days when the very first anti-virus scanners were created, virus authors (and now authors of trojans, worms, and so on) have been looking for ways for their viruses and other creations to fight back by attacking the security software that detects them (such as scanners) or restricts them (such as firewalls). Over the last couple of years in particular a growing trend has emerged with a lot of new remote access trojans now terminating, tampering with and even destroying most security software - many even come with built-in lists of several hundred security programs to look for which they then terminate and delete before infecting a system. When a virus destroys your antivirus software you're left with very few options, but Process Guard provides a unique defensive option as it can be deployed to prevent the virus from being able to terminate the antivirus program when you re-install it, allowing you to then scan, detect, and disinfect the virus without having to worry about the virus killing the antivirus program."
http://www.diamondcs.com.au/processguard/
and then monitor them for changes with a filechecker
in addition you should get a registry monitor
http://www.diamondcs.com.au/index.php?page=regprot freeware
http://www.wilderssecurity.com/index.php?board=8 freeware
Nazo
2[H]4U
- Joined
- Apr 2, 2002
- Messages
- 3,672
Really you don't have to get Process Guard probably. Most decent AV scanners now provide a monitor that will watch programs executed so that, in theory, any virus that is executed can be stopped before damage occurs. Of course, if a virus isn't in it's database, it can still slip through. I think AVG lets you turn on the advanced heuristics in the virus monitor program and maybe the others do too, that would probably catch most of those that slip through.
I
Ice Czar
Guest
I didnt say get Process Guard 
I just grabbed that paragraph to explain whats happening
and most AV programs dont tie in tight enough to stop viruses from terminating processes if the initial detection failed and its difficult to stop code modification once infected
(Test Application, Advanced Process Termination)
Known Attacks in detail: Code Modification, Process Termination, Suspension
I use non-default directories, a Filechecker (checksum) of security files to monitor changes and a dual boot w\ installed security to parallel scan when suspicious
not as automated but effective
there is a freeware version of process guard however I havent tried it, its limited to one process
hueristic detection is really the big thing these days (without creating false positives) both my main aps NOD32 and TDS-3 employ it
I just grabbed that paragraph to explain whats happening
and most AV programs dont tie in tight enough to stop viruses from terminating processes if the initial detection failed and its difficult to stop code modification once infected
(Test Application, Advanced Process Termination)
Known Attacks in detail: Code Modification, Process Termination, Suspension
I use non-default directories, a Filechecker (checksum) of security files to monitor changes and a dual boot w\ installed security to parallel scan when suspicious
not as automated but effective
there is a freeware version of process guard however I havent tried it, its limited to one process
hueristic detection is really the big thing these days (without creating false positives) both my main aps NOD32 and TDS-3 employ it
I tried AVG and it didn't install. I'm going to try norton's online in a minute... My sister had this same virus on her computer and we took care of it with a format. I want to avoid this in all cases. Hoping that norton's online will do the trick.
the 3 viruses are
C:\WINDOWS\system32\wincrt32.exe is infected with W32.HLLW.Gaobot.gen
C:\WINDOWS\system32\wincrt32.exe.poly is infected with W32.HLLW.Gaobot.gen
C:\WINDOWS\system32\winhlpp32.exe is infected with W32.HLLW.Gaobot.gen
I can't kill wincrt32.exe in my processes as it just keeps poping back up.. norton wouldn't fix the problem for me, their online site just told me waht the problem was. Anyone know a way of removal of these bad boys?
C:\WINDOWS\system32\wincrt32.exe is infected with W32.HLLW.Gaobot.gen
C:\WINDOWS\system32\wincrt32.exe.poly is infected with W32.HLLW.Gaobot.gen
C:\WINDOWS\system32\winhlpp32.exe is infected with W32.HLLW.Gaobot.gen
I can't kill wincrt32.exe in my processes as it just keeps poping back up.. norton wouldn't fix the problem for me, their online site just told me waht the problem was. Anyone know a way of removal of these bad boys?
No, perhaps you don't understand. The virus itself kills all other virus removal programs so that it can continue to be happy and screw you over. It was a legal copy downloaded from the site.. Thx. Anyhow I found this page on google
Only deal is, I don't have norton. How do they want me to remove it without buying their god damn software?
Only deal is, I don't have norton. How do they want me to remove it without buying their god damn software?
Nazo
2[H]4U
- Joined
- Apr 2, 2002
- Messages
- 3,672
First, if it didn't install, perhaps you should say what the error was so people could help you get it to. However, it could be that, as they say, the virus just won't let you.
Here's how you can fix damage in critical windows system files, you might want to visit a website that tells you about how to work a command prompt, but the instructions are pretty simple. When booting windows and it shows the little menu at the startup where you can select to start windows or whatever, hit the F8 key. Then choose the safe mode with command prompt. When it finally finishes booting up, change to the windows system32 and rename those files to something safe that will not be executed (I usually replace the last letter of the extention with an underscore, eg .exe to .ex_) I think I can give more or less exact instructions:
Oh yes, and look to see if those files exist in the dllcache folder which is under the system32 folder. If so, just delete those.
If all goes well, typing exit should exit the console and I think will automatically reboot though I'm not sure.
Windows should automatically replace those files with protected originals HOPEFULLY when you boot back up. Hopefully those were protected anyway. Run a scan, and if the virus still shows up, you'll have to extract the files from the original CD to replace them. I'm afraid I can't quite recall the exact instructions for that and am just too lazy to track down my disc and find out.
Here's how you can fix damage in critical windows system files, you might want to visit a website that tells you about how to work a command prompt, but the instructions are pretty simple. When booting windows and it shows the little menu at the startup where you can select to start windows or whatever, hit the F8 key. Then choose the safe mode with command prompt. When it finally finishes booting up, change to the windows system32 and rename those files to something safe that will not be executed (I usually replace the last letter of the extention with an underscore, eg .exe to .ex_) I think I can give more or less exact instructions:
Oh yes, and look to see if those files exist in the dllcache folder which is under the system32 folder. If so, just delete those.
If all goes well, typing exit should exit the console and I think will automatically reboot though I'm not sure.
Windows should automatically replace those files with protected originals HOPEFULLY when you boot back up. Hopefully those were protected anyway. Run a scan, and if the virus still shows up, you'll have to extract the files from the original CD to replace them. I'm afraid I can't quite recall the exact instructions for that and am just too lazy to track down my disc and find out.
CommanderFrank
Cat Can't Scratch It
- Joined
- May 9, 2000
- Messages
- 75,399
Not sure if you went to the Symantec Threat Center, but they post the removal procedures for that exploit and it's varients...
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.fl.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.fl.html
I ran trend micro housecall on a fresh boot and it removed the 3 files successfully. Maybe the virus wasn't active yet when I had just booted? Anyways it got rid of it and I installed my Mcafee and everything is going smoothly. Thank you all for your help. I apprecaite it greatly.