locked
Infected with Win32.Nuwar.f after installing Windows One Livecare...I try but Livecare says it can't remove....help! RRS feed

  • Question

  • Help!  I just purchased Windows One LiveCare with my Tax software last week.  I completed the installation successfully, activated the product on 1/12/2008 and completed all of the tasks to update the product and perform system scans and tuneups.  All was fine until last night when my first automatic tuneup was scheduled.

     

    In doing the scan, Windows Live Onecare reported that it had detected a worm, specifically named Win32.Nuwar.F@mm.  In the detection window that popped up, it offered to clean this from my system.  I chose that option.  This popped up a window with a rolling progress bar indicating it was cleaning the unwamted software from my system.  This process completed and returned me to the window that had first reported the worm with a message that it was unable to perform the removal from my system.  There were instructions to click on the the worm name entry to find out what files were affected.  Upon doing this, a new brwoser window (IE7) opened and took me to a Liveone web page that indicated no info found!  WOW....thanks.  The suggestion for removal was that some fo the infected files might be write protected and to remove the write protection and try the removal process again.  Only problem is....this software does not report what files it could not clean the infection from, so I have no idea what files to look for. 

     

    I've done as much searching as I can think of on the Windows One Livecare site to find out how to remove this worm that Livecare detected, but with no results.

     

    Can someone here please assist me with instrcutions on how to remove this from my system? Your help is apprecaited in advance....Thanks!

    Wednesday, January 16, 2008 7:07 PM

Answers

  • The first thing I suggest is opening OneCare, clicking on Change Settings, and then the logging tab. Click on create support log which will open a report in IE. Scroll to the Virus and Spyware section, where it should identify the worm's location. I suspect that it is located in a saved email message as an attachment or perhaps in your Temporary Internet Files.

    You can also contact support for help with removal.

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

     

    -steve

    Wednesday, January 16, 2008 8:11 PM
    Moderator

All replies

  • The first thing I suggest is opening OneCare, clicking on Change Settings, and then the logging tab. Click on create support log which will open a report in IE. Scroll to the Virus and Spyware section, where it should identify the worm's location. I suspect that it is located in a saved email message as an attachment or perhaps in your Temporary Internet Files.

    You can also contact support for help with removal.

    How to reach support (FAQ) - http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=2421771&SiteID=2

     

    -steve

    Wednesday, January 16, 2008 8:11 PM
    Moderator
  • Thanks for the immediate response Steve, outstanding....as I said, appreciated in advance!

     

    I went to look at the logs and sure enough, in the virus section, it pointed to multiple files it claimed as infected with this worm.  These were remnant files from the Symantec quarrantine folder.  Evidently, when a person uninstalls the Symantec Internet Security suite, that uninstall is not smart enough to delete its own quarrantine folder in the Documents and Settings user folders.

     

    I've now manually deleted these remnant Symantec folders and will perform another scan.  I will expect the scan results to show clean now!

     

    Thanks again!

     

    One suggestion for improvement to the Windows Live Onecare product and service.  Since the capability exists in the virus detection window to attempt to look up virus info on threats it can't clean, why don't you guys just add another link that can be clicked on to take you directly to the virus section of the logfile.  This could elimimate alot of customer time waste and frustration trying to dig around for information that is already readily available.  It just needs to be made more intuitively accessible!  I think most customers having these issues would really appreciate this!

     

    PS,  I preach and practice continuous improvement  Smile

     

    CXL1

    Wednesday, January 16, 2008 8:30 PM
  • Glad it helped and that all is well. :-)

    Thanks for the suggestions, too.

    -steve

     

    Thursday, January 17, 2008 2:21 AM
    Moderator