-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Klerman Gutierrez wrote: > Hello, > Recently CLAMWIN detected that this machine has a program named > SCardCint.exe, which is recognized as a worm. > It is in the .clamwin/quarantine folder yet, but I can't remove it > from the system. > Neither stopping the process, nor deleting the file works. Where can I > find information about removing this worm ?. > TVMIA, > Klerman > _______________________________________________ > http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32 > >
Just a guess : W32/Codbot-K [Sophos] if this is NT/XP OS : search for SCardClnt service and disable it remove registry keys: HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\ SCardClnt and bear in mind that this list is related to ClamAV and not worms ;-) In future look into alt.comp.anti-virus group. Regards Boguslaw Brandys -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFCfIz6tuGICzHOh+YRAsUzAJ4uteWOKyZX/cLJVi4S+M1ILeW3bgCgij6/ 6T3NUH8fQt+60/nCo3p2w/g= =iFZu -----END PGP SIGNATURE----- _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-win32
