Hawawi.f - AVG 6 free edition

Hello all,

One of my pc's has just been hit with the Hawawi.f worm. My free edition AVG picked up the infection and did it's bit by putting the infected files in a vault?

My question is why an online scanner (housecall.trendmicro) is still showing infected files in the Windows system folder, and shows them as uncleanable and why my anti-virus program is showing the pc as clean?

How can I safely remove these files and how can I be sure that the infection is in fact not still alive? From what I've read the AVG free version does not support the removal of the virus is just quarantines it.

VP

Hawawi is also known as Holar. See if anything here is helpful:

W32.Hawawi.Worm (Symantec)
http://securityresponse.symantec.com...wawi.worm.html

W32/Hawawi-D (Sophos)
http://www.sophos.com/virusinfo/anal...32hawawid.html

W32/Holar.d@MM (McAfee)
http://vil.nai.com/vil/content/v_100168.htm

WORM_HOLAR.D (Trend Micro)
http://www.trendmicro.com/vinfo/viru...e=WORM_HOLAR.D

it wouldn't be in your restore files too would it maybe this is why its still showing?

Thank you for your prompt replies - I will check out the links :)

I am almost sure that the files will not be stored in a restore program on that pc as there is none installed.

It is a worry when one anti-virus says your pc is clean and another detects the infected files still in the windows/system directory.

VP

Hi.. if those links don't solve the problem then things I would do would be to empty the quarantine folder, get a third and then a fourth opinion by using different but equaly reliable scan engines.

http://www.ravantivirus.com/scan/

http://security.symantec.com/ssc/hom...CVMHEHPZGAKFLY

then let us know what the results are and all of the exact messages you get regarding infected files and location.

And this online scanner will allow you to scan individual files

http://kaspersky.com/remoteviruschk.html

Just browse to one of the allegedly infected files and let them have a go.

Also worth noting is that winxp has its own restore utility enabled by default... control panel/system/system restore tab

Howdy:

First of all, what OS system is being used on the infected computer??

Secondly, if the on-line scanner is showing the system to be still infected, it is likely due to the fact the free version of AVG has not cleaned the virii simply placed it in quarantine rendering it useless.. The online scan is still finding this quarantined virii !!

Murray

Thanks for the further information :) I will be checking out all the links and following your advice.

Answers to points raised are that the pc in question is running Windows 98 first edition so there is no automatic restore utility.
The point of the other scanners finding the quarantined file - I did consider that but the files found by trend housecall were in a different location to the virus vault provided by AVG.

Housecall detected infected files;
C:\WINDOWS\SYSTEM\CUTE_ALICE(1).SYS
C:\WINDOWS\SYSTEM\A.PIF
C:\WINDOWS\SYSTEM\A.EXE
C:\WINDOWS\SYSTEM\A.SCR
C:\WINDOWS\SYSTEM\A.COM
C:\WINDOWS\SYSTEM\A.BAT

The AVG program has a vault where it stores quarantined files and I imagined that the files would not still be located within the windows system files.

It is the fact that these files are still held in the system folder that is causing me most concern...I do not understand viruses and am a little nervous of just deleting the files from their exisitng locations without consideration of the damage that may cause.

VP

When files are put into quarantine it may seem as though they've been moved but they remain where they are found. They are actually tagged by the a/v program and rendered inert in much the same way that a file is treated when it's put into the recycle bin... it goes nowhere but it's configuration is changed so it's recognized as a deleted file and will be written over at random once released from the recycle bin (where it is only referenced not actually placed).

If the quarantine marker is not recognized by another scanner then it will see the files as viruses in their original location.

Nothing to add here excapt to say that was the best explanation I've ever read here on V-Dr. :cool:

Hi again all,

I agree that finks explanation of the quarantine system was excellent :)

I followed the instructions from the various links and deleted the infected files from the virus vault and deleted the necessary registry entries. Unfortunately, housecall still found the infected files in their original location and listed them uncleanable. The online scanner also gave the option to delete the infected files so I took that option on this occassion. I have since run three independent scans from different sources and have a clean bill of health on that pc.

Thank you all for your kind assistance once again my friends at Virtual Dr have rescued me :D

VP

hey guys, thanks for all the info.

I'm currently scanning with the online Trend Micro Virus Scanner. So far it's detected 702 infected files, either uncleanable or cannot access, and all within my Kazaa downloads folder. My question is, is it safe to just click delete? Even if it finds other infected files not within that folder?

Hi and welcome to virtualdr.

Definately delete all the infected files in the downloaded folder. Any others you should make a note of what and where they are and post them here. You probably will have to delete them but we can tell you in advance if they are system or other necessary files that may need replacing afterwards.

thanks Fink :)

other than the 700+ from Kazaa, there are a handful from a temp folder, and several from c:\WINDOWS\system32 as follows:

a.bat
a.com
a.exe
a.pif
a.scr
explore.exe *C:\WINDOWS\system32\explore.exe*
Hotbar14.sys
smtp.ocx

I just tried to delete them, but apparently they are in use so it won't let me. Do you know what I should close?

Those are all safe to delete, as per the write-up at securityresponse.symantec.com

Unfortunately, I was only able to delete some of the files. The ones remaining:

explore.exe *C:\WINDOWS\system32\explore.exe* ,smtp.ocx ,
and the kazaa files are listed as CanNotAccess so it won't let me delete them.

okie dokie, just to update my progress; I've been able to successfully delete all 700+ infected files except for one, explore.exe *C:\WINDOWS\system32\explore.exe*.

After running the online virus scanner (housecall.trendmicro.com) and determining the folder in which the files were located, I was unable to delete them. Despite knowing the file name and pathway (eg. c:\my shared folder\Matchbox20 - unwell.exe), I couldn't manually locate the file in that particular folder. All that was there was the original mp3 (Matchbox20 - unwell.mp3).

So I cut and paste all files from My Shared Folder and temporarily stored it somewhere else, while deleting the empty My Shared Folder folder. When I ran the scanner again, all the 700+ infected files were gone except the one remaining "explore.exe *C:\WINDOWS\system32\explore.exe*".

I'm pretty sure I can't use the same technique, I'm afraid my comp will crash if I attempt to temporarily move system files.

The wiser will correct if I am wrong, but I am almost sure that erasing explorer.exe is not a good idea!

Have a look at this page from symantec. It describes the virus that dropped explore into your system folder and offers both a tool to remove it and the manual instructions. There are other details that you should make note of including what kind of files it may have destroyed.

http://www.symantec.com/avcenter/ven...plore.zip.html

When you're done you should probably get a second opinion with a different product's scan just to be safe..

http://www.ravantivirus.com/scan/

EDIT- The Hawawi worm also drops an explore.exe into the sys directory.. read these instructions

http://securityresponse.symantec.com...wawi.worm.html

ah, I forgot to thank you again for all your help, fink ;)

I'm pretty sure the virus is gone, but as you might have noticed a new problem has arisen to which I have started another thread lol.:eek: