I-Worm/Ronoper detected by AVG but virus isnt there, HELP!!

[newParadigm]

I have AVG Anit Virus and it detected the

"I-Worm/Ronoper.u" Virus


It said to run AVG for Windows to remove it. So I ran a 2 complete scans and the virus wasn't found.

I was goin to install NAV2003 but it says that before installing it on Windows XP to run the online scan at http://securityresponse.symantec.com.

So I ran that scan and that didn't find any virus either.

I installed NAV2003 and ran a complete System scan (I updated virus defs before scanning). That came up with nothing.

I then went to google and searched for "i-worm/ronoper"

And went to a bunch of different pages explaining the virus and telling how to get rid of it.

They said that there should be a "WinCfg32.exe" in the windows directory and a "security.exe" in windows\temp
Neither of those files are on my computer neither is the auto run registry key.

So i am wondering 2 things:

1. How can I find out if I still have the virus

2. If I do still have it how do I get rid of it.

 

[Nohr]

Probably a false positive. It happens from time to time, sadly.

 

[JackBurton]

Here is what you do man. Right click on My Computer, go to System Restore and check "turn off system restore on all drives." Reboot, do a rescan with AVG (or Norton, whichever you'd like) for safe measures and then turn on system restore again. Problem solved.

Sometimes a virus will get stuck in a system restore point.

 

[ScottMac]

If you're running other programs, like Ad Aware or SpyBot S&D, the anti-virus program might read some of their library / signature files as a worm or virus. The READMEs for those programs mention this happening as a possibility.

FWIW

Scott

 

[newParadigm]

Thx

go to System Restore and check "turn off system restore on all drives

I just recieved another warning from AVG that i had a virus and need to scan and the file path was C:\System Volume Information\... ...\restore blahblahblah

I thin the virus got stuck in the restore point when i installed windows updates a week ago. It not that big a deal tho b/c i was going to reinstall windows anyway b/c i am getting a new mobo next week.


Good Times, and Thanks for the help,

newParadime

 

[Slickone]

There's a similar problem with a friend's PC. They said AVG detected a virus. This was either during a full scan, or they did a full scan after that. I'm not exactly sure what they've done, but AVG's test results shows me one complete scan found the virus and the two after that didn't. The last complete scan I ran. The details of the scan finding the virus shows it was the HideWindow virus in C:\windows\system32\mm\frntok.exe, and says 'healed OK' for the status. However the system is still getting pop ups from AVG showing the trojan HideWindow is found in file C:\System Volume Information\_restore{lots of characters}\RP118\A0022297.exe. I even have a screenshot of this window that popped up during or after running the full scan, with the pop up window saying there's a virus, and the complete scan window saying there are no viruses both on the screen at the same time!

This is AVG 6 free edition. Can I upgrade it to 7.0 for free (is the current free edition they offer 6 or 7?)?

Also, why was it recommended to turn off system restore before doing a scan?

 

[ScottMac]

Because System Restore could roll back the system to its infected state (depending on the files found). It's an easy way to make the virus/trojan/worm more persistant.....use a file name that Windows will auto-restore (re-infect).

FWIW

Scott

 

[Slickone]

Thanks. What about the main problem I mentioned?