I have this worm that I can't get rid of
 

I am using the AVG free anti-virus. I keep getting a popup window from the software saying

---------
Virus
Virus identified I-Worm/Dumaru.Q

is found in file
C:\WINDOWS\guid32.dll

To remove this virus, please run AVG for Windows.
----------

Now when I run the software, it identifies the virus but it can't remove it. It says something like the whole artifact has to be removed and tells me to click a button to remove the whole artifact. But then it can't remove it so in essence it can't remove the worm.

Has anybody heard of this virus? Would going out to purchase Norton be in vain?

what version of windows you running? id boot up in dos, delete the file, then reinstall windows, easies way in my opinion, but if your're running 2k or something then you may as well format because reinstalling resets everything. dont forget to back up!

I'm running windows xp home version. If I re-install windows, it will delete every file on my system won't it?

When it comes to viruses, I stick with Norton Anti-Virus, sure, it costs $30 (I prefer Norton Internet Security for $60 to get my firewall), BUT when it comes to getting rid of viruses, it's the best program around :thumbsup

Yeah I'm gonna go out and buy norton first before I go through all of that reformatting shit.

Good luck getting rid of the worm.

I dug around Norton's site and they have a tool for removing Dumaru, BUT it doesn't show the Q version that your current virus program found, it actually doesn't list it anywhere on Norton's site, so either it's ultra new or it's labeled as a wrong version or something. Maybe you could give it a try and see if it'd still help

http://securityresponse.symantec.com...oval.tool.html

manually delete guid32.dll
the whole library is a trojan


the reason avg cant delete it is that its resident in memory
go run msconfig to see if its loading on start up

adding to jimthefiend, I was going to say that as well. I don't have XP so I can't say if that's a critical file or not, but once deleted if it were critical you won't be able to boot.

I would suggest booting up via floppy or CD into command line mode, rename the file, then boot up normally and see if you system works fine. if so, then I'd run AVS again, one problem with just deleting the file while running windows is that it could be programmed to simply skip to another file and infect that