FlyingS13

Hey guys, I'm at my friend's house hangin' out. He was telling me that his computer is infected by a virus called W32.Allim / W32. Spybot.Worm.

He said that he got that from clicking on some link that he got from his friend's AIM. He tried using the Norton anti-virus. Even though the Norton detected it but wouldn't able to quarantine it or delete the file. The file name that's infected is call msaccrt.exe.

He went to Symantec website & tried the method that they said but still wouldn't be able to remove the virus.

Any advice or input guys? Thanks a lot

Initial Daniel

Tell him to stop DLing ****...

...that...and if all else fails, reformat.

FlyingS13

Any way on how to remove the virus without reformating?

Initial Daniel

Do you have the latest virus scanners? What does the site say exactly on how to remove it? Are you sure you're following EVERY STEP? You might have more than one virus as well...

...make sure that you're all updated as far as virus detection/deletion. Other than that, I can't really help much more.

FlyingS13

He just updated his Norton today.

We tried to follow every step on what Symantec said but few of thew folders that it mentioned doesn't exist on his XP.

Thanks for your input though.

SHIFT_Sideways

i have removed W32.Allim / W32. Spybot.Worm.. i used to have a job at an office as a system admin part time.. I have removed those two type of virsus many many times. : )

masterfubu

ctrl-alt-del
got to processes and shutdown the process running the virus. the .exe file Then run norton. IS NORTON UP TO DATE? If you don't have a subscription it isn't.

Get AVG Free edition if norton won't update.

lrb_2000

run anti-virus in safemode... i would just reformat.. but that's me.. i do it like once a month

Sil40_Mayhem

ok, i don't know how helpful this will be, but i thought i'd just throw it out there: sometimes, an infected file will give itself attributes of a Windows system file/service. meaning, u can't kill the process in Task Manger, nor can u delete it while Windows is running. an option is to obtain a Linux boot disk (with an NTFS filesystem driver if ur using NTFS), boot the system, mount that partition, and delete the file. no Windows running = no denied access to that file. it's worked for me a few times.