Results 1 to 3 of 3

Thread: Virus w32.petch (alias wowexec.exe) gets past ZA virus program and firewall

  1. #1
    harmles Guest

    Default Virus w32.petch (alias wowexec.exe) gets past ZA virus program and firewall

    Has anybody dealt with an attack by this worm/trojan? THe virus info tells me everything it does, but offers no soluitons for removal. Toshiba tech support suggested a complete reload on my PC. It appears to have inffected my boot sector but I am still able to get XP up and running. I found instances of "petch" in my registry using the find comand. Repeated scans by ZA failed to find anything!! Anybody suggest a virus program that will work with this virus?
    thanks

    Operating System:Windows XP Home Edition
    Product Name:ZoneAlarm Antivirus
    Software Version:6.5

  2. #2
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Virus w32.petch (alias wowexec.exe) gets past ZA virus program and firewall

    a standalone scanner/removal tool>

    http://download.nai.com/products/mca...rt/stng260.exe

    a tool for checking boot sector>

    http://download.nai.com/products/mca...t/SAVEINFO.ZIP

    both from>

    http://vil.nai.com/vil/averttools.aspx#stinger

    see>

    http://www3.ca.com/securityadvisor/v....aspx?ID=37468

    If a reformat/reinstall is decide, then erase the drive with a special erasing cd first>

    http://www.heidi.ie/eraser/


    when the lengthy erase is finished, pull the power out. I assume this is a laptop, so pull not just the power adaptor, but also remove the battery as well (while the laptop is still running). This has the same effect as pulling the power cord out of the desktop PC. The instant power "kill" will kill all memory and help wipe the Toshiba laptop. The eraser disk from the link should have a boot sector erase ability as well- use it. After this is all said and done, the laptop will be perfectly cleaned and will be ready for the reformat/reinstall of Windows.

    Oldsod
    Best regards.
    oldsod

  3. #3
    harmles Guest

    Default Re: Virus w32.petch (alias wowexec.exe) gets past ZA virus program and firewall

    Oldsod, sounds like great advice. I'm running stinger now, so far nothing found, but its still running. In the period between posting I restored back to an old date, which seems to have removed all registry entries (nothing found in regedit search) and just prior to using restore, I stoped the wowexec.exe process in the task menu. I'm keeping my fingers crossed. thanks again!
    harmles

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •