How do I remove this virus>
Please help me.  It has attacked my machine.

Raymond

---

Request for Question Clarification by tutuzdad-ga on 02 Sep 2003 09:21 PDT

Whatever you have doesn't appear to be a known virus.

SYMANTEC
http://www.symantec.com/avcenter/venc/auto/index/indexW.html

How did you come to know that you had this virus?

regards;
tutuzdad-ga

Hello, answerforce,

I just wanted to say, further to tutuzdad's request for more
information, that a search on the Mcafee site doesn't find this either
<http://us.mcafee.com/virusInfo/default.asp>.

The only reference I can find is on a page called Adlands, at
<http://www.adlandpro.com/archives/304.htm>.  It's a long file, so use
Ctrl+F to find "winkxv", there is only one reference on the page.  The
writer of the posting had suffered a number of problems which she
tracked down to a virus:

"This virus effects a windows based .exe file that
cannot be removed...the files name is Winkxv.exe and
will have to be manually removed. Switch to *Safe Mode*
and see if that helps."

This does sound a little suspect to me.  IF you can find it, you might
get further by renaming the winkxv.exe file (rather than deleting it)
and seeing what effect that has - but I do advise you to proceed with
caution.  It's usually not a good idea to play around with Windows
files if you are unsure of what you are doing.

But I had a look at two computers, one running Windows 98 and the
other on Windows XP, and neither has a winkxv*.* file.  The Adlands
information and advice could be very suspect.

That does not get you, nor us, a lot further.  Once again, how do you
know that you have a virus, and how do you know that it is called (or
affects?) winkxv.exe?  Any further information could be very useful,
and help to solve your problem.

Best, r2l

Hello Raymond,
I found a reference to the virus you mentioned, please note that
Winkxv.exe is a normal Windows executable file, it has probably been
affected by a virus and that is why you see that name on your screen
as an error report. There are a number of viruses that could infect
this particular file, including the Klez Worm Virus, however we won't
know for sure until you run a virus scan or similar. You can run a
free online scan on your system at a number of websites. Try:
http://us.mcafee.com/default.asp
http://www.pandasoftware.com/activescan/
http://www.bitdefender.com/scan/licence.php

I hope this helps,
sabrina_j6-ga

Hello all of you fellows.
Thanks for such wonderful answers.  I will try all of your
suggestions; they're great.  But how do I pay just the $2.50 to all of
you guys?
I am going to clean up my machine first by doing all of the
suggestions and then hopefully I can safely pay using the google site.
Is that OK?

By the way I could not find a spot that I can reply to; how did you
guys/gals post an answer?

Raymond

In my experience, wink*.exe is one form or another of klez.  Usually
found in c:\windows\temp or c:\windows\system.

This can be confirmed or disproven by scanning the system for klez!  I
recommend the Trend Micro System Cleaner, which is found here:
http://www.trendmicro.com/download/tsc.asp

Please note that the TSC is a two step download.  You have to download
the program, sysclean.com, and also the 'latest pattern file'.  You
should save both files to the same directory and then run the one
named sysclean.  More information about TSC is here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt

TSC is detects and removes multiple (many!) common worms and malware. 
It works on essentially all versions of windows, and is capable of
terminating the worm processes that it detects, thus circumventing
those 'unable to delete file' problems.

Hope this helps.

Dear Raymond, 

Regarding your question on how to pay the Researchers: the Researchers
gave you help in comments and in a "Request for Clarification". This
means, that they are nto paid for their answers. You could post a
question titled for these Researchers, in order to pay them for their
services, and/or let one of them answer this question before it
expires (which is very soon).

Hope that helps. If you have any questions on how to work with Google
Answers, you could also contact mailto:answers-support@google.com