How do I remove Infostealer.Gampass?

Question

I run Kaspersky AV regularly and all turns up with no issues. I also use Spybot and Adaware and neither has ever identified this "worm."

I was gonnna to a OS upgrade, so I ran Symantec off the net (as has been recommended) and it discovered Infostealer.Gampass. My first attempt to remove it didn't work. Rather than spend time spinning my tires, I'm coming to the forum which has always provided me with good tactical advice. Should I look to a new AV or Spyware solution.

This is the message I received from Symantec: C:\RECYCLER\S-1-5-21-4089227385-3974022255-3323921956-1007\Dc20.exe is infected with Infostealer.Gampass

Unfortunately I need to do a key word search as I couldn't see the directory just by doing a simple browse.

Thanks in advance.

I have a Dimension 8300, running XP Pro with SP1 (was gonna finally upgrade to SP2 this weekend)

Message Edited by Skor on 06-22-2008 01:04 PM

Message Edited by Skor on 06-22-2008 01:25 PM

Bugbatter · Answer

Empty your Recycle Bin.

Try running Malwarebytes' Anti-Malware.
Please download to your desktop Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
If you continue to have syptoms of malware, and/or want a review of the log, copy and paste the entire report into a New Message on the HijackThis Board. Also include a fresh HijackThis log. Instructions for downloading HijackThis are at the top of that forum.
1. Just click the New Message button in the HijackThis forum here: http://www.dellcommunity.com/supportforums/board?board.id=si_hijack
to start your own thread requesting assistance for a follow-up check to be sure the malware is gone.
2. In the Message Body window that opens, simply Right-Click and select Paste.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

Skor · Answer

Good News and Bad News. I ran the Anti-Malware it found three items which I had removed. I then ran the full scan which turned up nothing. Just because I'm the cautious person I am, I re-ran the Symantec online scan -- which had first identified the issue -- and unfortunately the affected file is still there.

The good news is that my PC seems to be running a faster since I removed the files that Anti-malware identified.

Here's the bad file that Symantec identified: C:\RECYCLER\S-1-5-21-4089227385-3974022255-3323921956-1007\Dc20.exe is infected with Infostealer.Gampass.

Shall I just remove it.

I'll do the Hijack thing, though I've fortunately not had to do that in the past. Wish me luck and thanks much for your detailed advice.

I figured it out -- I deleted the recycler bin and all is clean.

Thanks so much for the assistance Bugbatter. My old machine is back to it's normal speed.

Message Edited by Skor on 06-23-2008 09:48 AM

Bugbatter · Answer

You're welcome. I'm glad we could help. :)

Virus & Spyware

How do I remove Infostealer.Gampass?

Was this post helpful?