Re: MRT tool detected "PWS:Win32/Corripio.gen!C"   

[X-post to microsoft.public.windows.vista.security newsgroup. This has 
nothing to do with Windows Update.]

NAV (even if your subscription is current) will neither detect or remove 
such hijackware.  Allow the MSRT to delete the file.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log 
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
   http://aumha.org/a/quickfix.htm
   http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
   http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in 
conjuction with some other utilities).  HijackThis will NOT fix anything on 
its own, but it will help you to both identify and remove any 
hijackware/spyware with assistance from an expert.  **Post your log to 
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0, 
http://forums.spybot.info/forumdisplay.php?f=22, 
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review 
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this 
isn't your cup of tea - take the machine to a local, reputable and 
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
-- 
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Gan wrote:
> i too have somilar kind of the problem...
>
> At the end of the MRT log, it says that,
>
> **************************************************
> Found possible virus: PWS:Win32/Corripio.gen!C in
> file://D:\DWN\????email???????? .zip->ªAªúñ]¡nemail¿¦¦L¦ß¬¦¬F¬F¦¦ºA
> .cmd->(ZipSfx)->16.sfx.exe->(ZipSfx)->16.exe->(PECompact2
> v2.50+)->[RSRCEmb]
>
> Results Summary:
> ----------------
> Found PWS:Win32/Corripio.gen!C (detected generically)
>
> Return code: 6
> Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 08
> 05:45:03 2008 ***************************************************
>
> This file is in my D drive, and i could able to see this file once after
> completely scanning my PC with MRT.
>
> I have Windows Vista SP1 installed also i have a purchased version of
> Norton Antivirus 2007 installed.
>
> When i scan that particular infected zip file with my NAV2007, it says 
> that
> there are no security risks detected.
>
> Does my NAV2007 is not able to detect that virus? Could you guys tell me
> how do i get rid of this gamming virus?
>
> Thanks in advance for your help
>
> -Gan

date: Tue, 7 Oct 2008 23:12:18 -0400   author:   PA Bear [MS MVP]