help, maybe my computer is infected. what should i do?

akey307 · 04-08-2005, 10:56 PM

i have an unknow winfile under C: partition.
the original file name is wukill.exe.
the product name is Xgtray.
and the product version and the file version are both 1.00.

what should do? thanks

**jancz3rt** · 04-08-2005, 11:42 PM

first of all install an antivirus (avast, avg, norton, mcafee etc.), and update all your definition files. Then scan for the worm (the files are parts of the WUKILL worm). It should be able to detect it and then delete it.

JAN

Hellbreather · 04-09-2005, 01:36 PM

If it cannot find it. Try this to manually delete the worm. I hope this is the same worm here

1. Disable System Restore
If you are using Windows XP/ME disable system restore using the following
Start->Programs->Accessories->Windows Explorer
Right click on my computer and click Properties
Click the System Restore tab
Click the "Turn off System Restore" box te click apply. Then click yes on the following box that comes up.

2. Now you need to remove certain values from your Registry Editor
Start->Run-> Type in "regedit"
Now delete these values
HKEY_LOCAL_MACHINE\SOFTWARE\Windows\Current Version\Run
These 2 values will be here and delete them:
RavTimeXP
RavTimXP

After deleteing them go to this directory
HKEY_LOCAL_MACHINE\SOFTWARE\Windows\Current Version\Setup
RavTimXP
After that the virus should be removed run a full system scan and check
Then turn on system restore to do this follow the instructions to turn it off just un-check the "Turn off System Restore"

softwarewiz · 04-10-2005, 08:55 AM

get mcafee bvirus it is very good and easy to use and ive never had a virus with it.It does monthly check-ups and stufff like that though

Hellbreather · 04-10-2005, 10:29 AM

I would suggest an anti-virus program if you haven't already got one. Can you let us know if you have got rid of the virus so we dont keep giving you advice when you have already solved the problem

Blue · 05-04-2005, 03:51 AM

Quote:

I am going to say go with jancz3rt's idea!

It was pretty good eh?

cthomas10uk · 05-04-2005, 07:09 PM

put a firewall on aswell this will monitor your computer... something like zone alarm, or if you hav got xp get the service patch it will giv you a FREE firewall lol

ow kind of mircrosft to do that 4 you

04-08-2005, 10:56 PM	#1 (permalink)
akey307 New Member Join Date: Apr 2005 Posts: 8	help, maybe my computer is infected. what should i do? i have an unknow winfile under C: partition. the original file name is wukill.exe. the product name is Xgtray. and the product version and the file version are both 1.00. what should do? thanks

04-08-2005, 11:42 PM	#2 (permalink)
jancz3rt Moderator - F@H Guru Join Date: Sep 2004 Location: Czech Republic Age: 23 Posts: 4,009	Hey first of all install an antivirus (avast, avg, norton, mcafee etc.), and update all your definition files. Then scan for the worm (the files are parts of the WUKILL worm). It should be able to detect it and then delete it. JAN __________________ A64 3700+ @ 2.65Ghz ::: 7300GT @ 600/1500 ::: 2GB RAM @ 440Mhz www.CZ3RT.com ::: FOLDING FOR THE GOOD OF MANKIND ::: F@H Team 44358

04-09-2005, 01:36 PM	#3 (permalink)
Hellbreather Platinum Member Join Date: Mar 2005 Location: United Kingdom Age: 20 Posts: 736	If it cannot find it. Try this to manually delete the worm. I hope this is the same worm here 1. Disable System Restore If you are using Windows XP/ME disable system restore using the following Start->Programs->Accessories->Windows Explorer Right click on my computer and click Properties Click the System Restore tab Click the "Turn off System Restore" box te click apply. Then click yes on the following box that comes up. 2. Now you need to remove certain values from your Registry Editor Start->Run-> Type in "regedit" Now delete these values HKEY_LOCAL_MACHINE\SOFTWARE\Windows\Current Version\Run These 2 values will be here and delete them: RavTimeXP RavTimXP After deleteing them go to this directory HKEY_LOCAL_MACHINE\SOFTWARE\Windows\Current Version\Setup RavTimXP After that the virus should be removed run a full system scan and check Then turn on system restore to do this follow the instructions to turn it off just un-check the "Turn off System Restore" __________________ There are 10 types of people in the world, those who understand binary code, and those who don't Windows XP Pro Setup Intel Pentium 4 Processor - 3.2Ghz With HT Technology, 1024MB DDR RAM, 200GB SATA HDD, 40GB SATA HDD, Sound Blaster Live! 24 BIT!, Radeon 9800 PRO 256MB, Gigabit Ethernet Card

04-10-2005, 10:29 AM	#5 (permalink)
Hellbreather Platinum Member Join Date: Mar 2005 Location: United Kingdom Age: 20 Posts: 736	I would suggest an anti-virus program if you haven't already got one. Can you let us know if you have got rid of the virus so we dont keep giving you advice when you have already solved the problem __________________ There are 10 types of people in the world, those who understand binary code, and those who don't Windows XP Pro Setup Intel Pentium 4 Processor - 3.2Ghz With HT Technology, 1024MB DDR RAM, 200GB SATA HDD, 40GB SATA HDD, Sound Blaster Live! 24 BIT!, Radeon 9800 PRO 256MB, Gigabit Ethernet Card

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

04-10-2005, 08:55 AM	#4 (permalink)
softwarewiz New Member Join Date: Apr 2005 Location: im not telling Age: 14 Posts: 5	get mcafee bvirus it is very good and easy to use and ive never had a virus with it.It does monthly check-ups and stufff like that though

05-04-2005, 07:09 PM	#7 (permalink)
cthomas10uk Bronze Member Join Date: Apr 2005 Age: 20 Posts: 32	put a firewall on aswell this will monitor your computer... something like zone alarm, or if you hav got xp get the service patch it will giv you a FREE firewall lol ow kind of mircrosft to do that 4 you