|
Removing the infection
The worms often schedule themselves to be run
automatically when you start your operating
system; some of them even register themselves to
be run when any other application is started.
Removing such a worm is not as simple as deleting
it - when you just delete the worm file, your
operating system might not be able to start your
applications (such as Explorer) any more.
So, in order to properly remove the worm from
your computer, it is often necessary to make
additional fixes in your system registry, delete
the links from your Startup Folder etc. Here the
avast! Virus Cleaner comes - it will find and
remove selected worms from your computer, as well
as fix the registry and startup items to make sure
your system will work correctly after the
disinfection.
Many worms - when activated - create additional
working files on your hard disk. Even though these
files alone are harmless, they are useless and
they should not be there. When avast! Virus
Cleaner detects and removes a known worm from your
computer, its working/temporary files are removed
as well. The same applies for worm-specific
registry entries etc.
List of known worms
 avast!
Virus Cleaner is currently (in version 1.0.187)
able to identify and remove the following worm
families:
- Win32:Badtrans
[Wrm]
- Win32:Beagle
[Wrm] (aka Bagle), variants A-L, U, W-Z
- Win32:Blaster
[Wrm] (aka Lovsan), variants A-M
- Win32:BugBear
[Wrm], including B
and E variant
- Win32:Ganda
[Wrm]
- Win32:Klez
[Wrm], all variants (including variants of
Win32:Elkern)
- Win32:MiMail
[Wrm], variants A,
C,
E,
I-N,
Q, S-U
- Win32:Mydoom
[Wrm] (variants A, B, D, F-J - including
the trojan horse)
- Win32:Nachi [Wrm] (aka Welchia, variants
A-G)
- Win32:NetSky
[Wrm] (aka Moodown, variants A-Z)
- Win32:Nimda
[Wrm]
- Win32:Opas
[Wrm] (aka Opasoft, Opaserv)
- Win32:Sasser
[Wrm] (variants A-D)
- Win32:Scold [Wrm]
- Win32:Sircam
[Wrm]
- Win32:Sober
[Wrm], variants A-F
- Win32:Sobig
[Wrm], including variants B-F
- Win32:Swen
[Wrm], including UPX-packed variants
- Win32:Yaha
[Wrm] (aka Lentin), all variants
Disinfection process in detail
By default, avast! Virus Cleaner does all the work
automatically. When you start it and press the
"Start scanning" button, the following
will be done:
- The operating system memory will be scanned,
and if any known worm is found, the worm
process is terminated - thus avoiding further
spreading. If it is not possible to terminate
the worm process (it could happen e.g. with
Nimda worm that uses a fake library to run
inside other processes), the worm will be
deactivated in memory to stop its spreading.
- Your local hard disks will be scanned.
- The "startup items" (such as the
system registry, Startup Folder(s), etc.) will
be scanned. References to worms found in
memory or on disk will be removed or fixed.
- Infected files, identified in point 2, will
be removed or fixed (as needed).
- Additional working/temporary files created
by the identified worms will be removed.
- If restarting the computer is needed to
finish the disinfection process (e.g. when a
file could not be removed because it was
currently in use, or if the deactivated worm
process is still present), the user is
notified and asked whether the restart should
be done immediately.
For experienced users, various command-line
arguments can be used to customize the program
behavior. The list of command-line arguments will
be displayed when started with /? parameter. Note:
the command-line arguments are intended for
experienced users only! Changing the default
parameters may result in incomplete disinfection
that may render your operating system
nonfunctional, as noted above.
Important notes
- During the scanning process, it is highly
recommended not to start any applications.
As already pointed out, some worms will start
automatically when any other application is
started. Running worm processes are
terminated/deactivated only during the first
phase of the avast! Virus Cleaner scanning; if
you activate the worm again in the middle of
the scanning process (by starting another
application, such as Notepad, Explorer, ...),
the worm will probably not be removed from
your computer!
- Turn off any resident (on-access)
antivirus protection before running avast!
Virus Cleaner. avast! Virus Cleaner has to
access the infected files to be able to
identify and remove them. The resident
protection, however, might not permit it - and
the worm could not be removed from your
computer! Do not forget to activate the
resident protection again after avast! Virus
Cleaner has finished the disinfection.
- avast! Virus Cleaner should be used in case
you know or suspect that your computer is
infected. It is not meant as an antivirus
solution for everyday use! Use e.g. avast!
4 Home/Professional to protect your computer.
- To work correctly, the Cleaner requires
administrator privileges when running on
Windows NT/2000/XP/2003 operating systems. On
an infected computer, however, it might not be
vise to log in as a privileged user
(administrator) - it may help the worm to
spread even further. Therefore, you can start
avast! Cleaner as a restricted user and enter
the administrator login name and password
directly into an avast! Virus Cleaner dialog;
in such a case, the Cleaner will be run with
the privileged user access rights - however,
the privileged user will not be actually
logged on, and none of his/her startup files
will be processed.
Solving other problems
 If
you have deleted a virus or worm file associated
to a vital file type - and now you cannot run your
applications anymore, avast! Virus Cleaner may
help you as well. All you have to do is run avast!
Virus Cleaner "somehow". If, for
example, only the association for .EXE files has
been corrupted, you may run the avast! Virus
Cleaner by renaming it to a .COM file. The other
extensions you may try are .SCR, .BAT, .PIF (on
Windows NT/2000/XP/2003, you may try .CMD as
well). If none of these extensions works (Windows
is still reporting "Cannot find 'xyz.exe'"
when you try to start the tool), you can use avast!
Virus Cleaner itself as a replacement for the
missing file. However, you have to know the name
of the missing file to do that; if you know it,
just rename the avast! Virus Cleaner file to the
missing name (and move it to the corresponding
folder, if necessary). Now, starting any
application should bring up avast! Virus Cleaner
instead. As soon as it starts, it detects that
some of the vital file associations are corrupted,
reports the problem and allows you to fix it
immediately.
|
