Worm/virus - is it from FTF?

[Jen Red Purple]

Had a worm that Norton found but couldn't get rid of. Got a techy friend to go through the laptop and get rid of it but it came back again.

We don't go to many sites on the laptop and it came back so quickly I wondered if it is getting in through this site. It probably isn't, but just in case I thought I would mention it here.

It is something like w32Nomvar & seems to have a ravmon file and an autorun thing too.

My techy friend is going to go through the laptop again, looking at the Norton files to see if we inadvertently said yes to it at some point.

[WendyPusey]

Have you seen this?

AntiVirus Solution and Removal - W32.Nomvar

[Jen Red Purple]

I haven't, Wendy, but thanks for the link. One of the solutions Symantec offered mentioned the regedit, that's when I phoned a friend! I'll send him the link before we drop the laptop off.

[TrevorFranklin]

Also, get him to turn off 'system restore' as if you clean the PC it will have an old copy of the worm in the archived last restore point, which will just re-infect the PC.

This worm does not come from visiting a website.
It requires a direct connection to eithe a removable storage device (such as a pen drive), that has been attached to an infected PC, or if your PC is connected to another via a network connection.

[Britec]

1) I would not go editing the registry unless you know what your doing, if you do know what your doing fine, but make sure you backup registry first.

2) here is a simple option for getting rid of that file, this software does it for you I have not used this software but it is clean i have scanned it for you.

http://www.techmynd.com/ravmon-virus-killer%C2%A0patch-ravmon-virus-removal-tool/

Hope this helps you out.

[Jen Red Purple]

Thanks Trevor & Brian - I will pass on your tips to my friend.

[Guest]

nudged up