Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

My brother caught the W32-NGVCK.A virus ...

Mar 14, 2004 4:33AM PST

Lives out of state, has WinXP, Pent4, 2.6MHz, AOL, McAfee. Called me on phone, says McAfee detected and listed infected files. He started deleting last night, and then McAfee indicated it could not delete some files (he quit for the night). Today, he started PC, 1st thing is to click on user (him or wife), then MCAfee comes on and indicates they have detected the virus and recommends he use the scan feature on line. Well his PC now goes into a cycle and will not let him get to the desktop to get on line or even do anything except log out, restart and repeat the notice from McAfee.

I use Nortons and know nothing about McAfee so looked up the virus in google/McAfee & the McAfee site for the W32-NGVCK.A says the fix is DAT 4208 required. Can't find dat DAT as suggested by McAfee. Also, since it is WinXP they indicated the System Restore is probably infected and System Restore needs to be turned off. He can't get to "My Computer" >Properties>System Restore to uncheck System Restore.

What shall I tell him....take his PC to repair shop?
Wife refuses to get rid of AOL, but now that they have a virus she will finally stop opening all email attachments.

Discussion is locked

- Collapse -
Re:My brother caught the W32-NGVCK.A virus ...
Mar 14, 2004 4:45AM PST
- Collapse -
Re:Re:My brother caught the W32-NGVCK.A virus ...
Mar 14, 2004 5:11AM PST

Thanks Marianna. He can't get to the internet to download as McAfee or virus has him in a loop with the McAfee notice where he can't do anything?

- Collapse -
Re:Re:Re:My brother caught the W32-NGVCK.A virus ...
Mar 14, 2004 6:02AM PST

John,

Have him try to restart in Safe Mode (press F8 key repeatedly right after Power On Self Test and he should be presented with the option to start in Safe.
Once there he may be able to run his antivirus to remove the ofending files.

Good Luck

Richard

- Collapse -
Good suggestion ...
Mar 14, 2004 9:28AM PST

guess my old age didn't think of that. Well, the F8 did get in Safe Mode and he was able to run a on line virus scan with McAfee after disabling System Restore as it may also have the virus. Deleted 300 files that were infected, 2 couldn't be deleted and are on quarantine. Did a restart and thought everything Ok, but not. We went back into safe mode but this time would not get past the login in... ie.. shows Administrator, his name, and wife's name. Clicking on any of the three and it just goes in to a loop around...nothing. Can't get anything in Safe Mode. Back to square one. Cannot restart normally, or use Ctrl/alt/del, must use on/off switch to shut down & restart.

Brother indicates that perhaps he should take to shop and see about a reformat if that is the only way to fix and get rid of virus.

- Collapse -
Is his McAfee AV up-to-date??
Mar 14, 2004 10:03AM PST

Removal Instructions

All Users :
Script,Batch,Macro and non memory-resident:
Use current engine and DAT files for detection and removal.
PE,Trojan,Internet Worm and memory resident :
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:


SCANPM /ADL /CLEAN /ALL
Additional Windows ME/XP removal considerations



http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100368

- Collapse -
Re:Is his McAfee AV up-to-date??
Mar 14, 2004 11:51AM PST

Thanks Marianna. He has given up. Pls see my post to Grif.

- Collapse -
JR, Some More Info About That Virus
Mar 14, 2004 10:18AM PST

Here's a link to the McAfee write up about the virus. You'll note that it's a PE file infector meaning it infects executables, which could also be Windows system files:

W32/NGVCK
http://vil.nai.com/vil/content/v_100553.htm

It would sure help to know which version of McAfee Virus Scan your brother is using. In order to determine the virus definition version he has, he can RIGHT click on the McAfee shield in the lower right, choose "About Virus Scan" and it will indicate the version of Virus Scan, the Scan Engine version, plus the virus defintion number. Let me know please. The CURRENT DAT version is 4336. The 4208 version was issued years ago. In addition, it's very possible that the computer had a number of other viruses also. If your brother can get to a clean computer, you should have him download and place the "Stinger" removal tool on a floppy disk and then transfer it to his computer while in "Safe Mode". Here's the link:

Stinger
http://vil.nai.com/vil/stinger/

If your brother's version of McAfee is old, and the viruses have done a lot of damage, then there may be no recourse other than do a full Recovery. The newest DAT file will need to be installed while in regular Windows on XP. If your brother is using an HP or Compaq computer, there may be a Recovery Partition which will format and reinstall the system as it came from the factory.

Let us know what is available for the recovery.

Hope this helps.

Grif

- Collapse -
Re:JR, Some More Info About That Virus
Mar 14, 2004 11:50AM PST

Just talked to him again. Said he can't get to safe mode anymore nor see a McAfee shield in the lower right corner. Stuck in a continous loop mode after startup (see my last post above). He is going to bed and will take to shop tomorrow AM. They know very little about a PC and are up in years.

It is a 6-7 month old factory Dell model 4600. The McAfee came with the PC and has a 'firewall'.

Thanks Grif for your interest and help.

JR

- Collapse -
JR, Sorry, But It May Be The Easiest Thing For Your Brother To Do
Mar 14, 2004 1:17PM PST

A little experience with XP might allow him to run the Recovery Console at start up, maybe System File Checker from their, but with this type of situation, it may work out for the best.

They should get a machine clean of viruses.

Take care.

Grif