How to remove this virus.?

rakesh-the gilli · 28-04-2011, 12:14 PM

Whenever i copy files from my friend system using my pendrive, i find a folder named "gaxee" inside which a file named "pobronas.exe" resides. I think its a virus, if not please correct me so. I tried removing it by scanning with norton antivirus 2011 but it is unable to detect. My friend uses Mcafee and it too doesn't detect it.. Can someone help me to get rid of this virus. Is there any removal tool available.?

Niilesh · 28-04-2011, 01:22 PM

First check if this is a virus by uploading it to VirusTotal - Free Online Virus, Malware and URL Scanner
it will scan the file with 13 or so antivirus

**asingh** · 28-04-2011, 01:46 PM

Just shift+delete it.

Zangetsu · 28-04-2011, 02:45 PM

Quote:

Originally Posted by asingh

Just shift+delete it.

No use if the system has the virus..will keep popping up again....

@OP: u have to use updated antivirus.Norton & Mcafee are good antiviruses just update them & scan....

thetechfreak · 28-04-2011, 03:09 PM

Do any of the following-

1) Do scan using this online antivirus.
Link- HouseCall - Free Online Virus Scan - Trend Micro USA
2) Download and install Malwarebytes Anti Malware.
Update it and do full scan.

**asingh** · 28-04-2011, 03:36 PM

Oh, thought it was on his pendrive.

rakesh-the gilli · 03-05-2011, 08:45 AM

I got rid of it. I was sure that it was the only virus in my system as whenever i formatted my pendrive there was no sign of it, but as soon as i replugged it the folder was created. Tried googling and found that Avira removes it (as updated Norton & Mcafee failed to remove). So i uninstalled McAfee, installed Avira, scanned the system and thankfully it did remove the virus. I manually deleted it from my system using safe mode. The virus resides in

C:\Documents & settings\<user name>\fhwagz.exe

It makes those copies of gaxee folder with pobronas.exe in it. Some registry entries were also removed.
HKEY_LOCAL MACHINE\CURRENT_VERSION\MICROSOFT\WINDOWS NT\WIN_LOGON\TASKMAN.. If this TaskMan dword is present then we have to remove it..

thetechfreak · 03-05-2011, 09:38 AM

Good. You may try a software called Spybot search and destroy to do scans once a week
although a little slow,its a very good piece of software. you also get an option to 'immunise the browser' that actually is very helpful

arpanmukherjee1 · 03-05-2011, 09:55 AM

@rakesh-the gilli
good... thanx for sharing the info.

does trial ver of Kaspersky removes it too ??

Zangetsu · 03-05-2011, 11:29 AM

Quote:

Originally Posted by rakesh-the gilli

I got rid of it. I was sure that it was the only virus in my system as whenever i formatted my pendrive there was no sign of it, but as soon as i replugged it the folder was created. Tried googling and found that Avira removes it (as updated Norton & Mcafee failed to remove). So i uninstalled McAfee, installed Avira, scanned the system and thankfully it did remove the virus. I manually deleted it from my system using safe mode. The virus resides in

C:\Documents & settings\<user name>\fhwagz.exe

It makes those copies of gaxee folder with pobronas.exe in it. Some registry entries were also removed.
HKEY_LOCAL MACHINE\CURRENT_VERSION\MICROSOFT\WINDOWS NT\WIN_LOGON\TASKMAN.. If this TaskMan dword is present then we have to remove it..

Norton & Mcafee shud remove the virus dnt knw wats the problem with them