WINVNC keeps poping up?

[George-NY]

A window titled WINVNC keeps popping up on my desk to and was hoping someone
knew how to stop this window. I was told this program is for networking but
this is a stand alone computer not hooked up to any other computer. Any
help on how to get rid of this program and stop this window from popping up
is appreciated.
Thanks in advance.
--
Remove xxx from E mail address
George-NY

[Doug Knox MS-MVP]

Look in Control Panel, Add/Remove programs for a reference to it and
uninstall it. See

http://www.webattack.com/get/vnc.shtml

for more information on this program.

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"George-NY" > wrote in message
...
> A window titled WINVNC keeps popping up on my desk to and was hoping
someone
> knew how to stop this window. I was told this program is for networking
but
> this is a stand alone computer not hooked up to any other computer. Any
> help on how to get rid of this program and stop this window from popping
up
> is appreciated.
> Thanks in advance.
> --
> Remove xxx from E mail address
> George-NY
>
>

[Doug Knox MS-MVP]

Look in Control Panel, Add/Remove programs for a reference to it and
uninstall it. See

http://www.webattack.com/get/vnc.shtml

for more information on this program.

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"George-NY" > wrote in message
...
> A window titled WINVNC keeps popping up on my desk to and was hoping
someone
> knew how to stop this window. I was told this program is for networking
but
> this is a stand alone computer not hooked up to any other computer. Any
> help on how to get rid of this program and stop this window from popping
up
> is appreciated.
> Thanks in advance.
> --
> Remove xxx from E mail address
> George-NY
>
>

[Ronnie Vernon MVP]

George-NY wrote:
> A window titled WINVNC keeps popping up on my desk to and was hoping
> someone knew how to stop this window. I was told this program is for
> networking but this is a stand alone computer not hooked up to any
> other computer. Any help on how to get rid of this program and stop
> this window from popping up is appreciated.
> Thanks in advance.

George

If you don't know how WinVNC got there, then your system has most likely
been infected by a virus/trojan. WinVNC is a legitimate program (virtual
network connection) but it can also be used by hackers to connect to your
system. See the following website for details.

F-Secure Computer Virus Information Pages: Deloder:
http://www.f-secure.com/v-descs/deloader.shtml


--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

[Ronnie Vernon MVP]

George-NY wrote:
> A window titled WINVNC keeps popping up on my desk to and was hoping
> someone knew how to stop this window. I was told this program is for
> networking but this is a stand alone computer not hooked up to any
> other computer. Any help on how to get rid of this program and stop
> this window from popping up is appreciated.
> Thanks in advance.

George

If you don't know how WinVNC got there, then your system has most likely
been infected by a virus/trojan. WinVNC is a legitimate program (virtual
network connection) but it can also be used by hackers to connect to your
system. See the following website for details.

F-Secure Computer Virus Information Pages: Deloder:
http://www.f-secure.com/v-descs/deloader.shtml


--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

[George-NY]

Thanks Doug and Ronnie for the info and taking your time to reply to my
problem. I appreciate it and will look to see if it is a virus.

> George
>
> If you don't know how WinVNC got there, then your system has most likely
> been infected by a virus/trojan. WinVNC is a legitimate program (virtual
> network connection) but it can also be used by hackers to connect to your
> system. See the following website for details.
>
> F-Secure Computer Virus Information Pages: Deloder:
> http://www.f-secure.com/v-descs/deloader.shtml
>
>
> --
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>

[George-NY]

Thanks Doug and Ronnie for the info and taking your time to reply to my
problem. I appreciate it and will look to see if it is a virus.

> George
>
> If you don't know how WinVNC got there, then your system has most likely
> been infected by a virus/trojan. WinVNC is a legitimate program (virtual
> network connection) but it can also be used by hackers to connect to your
> system. See the following website for details.
>
> F-Secure Computer Virus Information Pages: Deloder:
> http://www.f-secure.com/v-descs/deloader.shtml
>
>
> --
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
>
>

[Fred]

On Fri, 4 Apr 2003 23:02:58 -0500, "George-NY"
> wrote:

>Thanks Doug and Ronnie for the info and taking your time to reply to my
>problem. I appreciate it and will look to see if it is a virus.
>
>> George

It IS NOT A VIRUS.

However, a trojan horse may have infected your system and may be using
a legitimate program as a means of communicating with people outside
your system.

The original poster who used the term virus was mistaken.

[Fred]

On Fri, 4 Apr 2003 23:02:58 -0500, "George-NY"
> wrote:

>Thanks Doug and Ronnie for the info and taking your time to reply to my
>problem. I appreciate it and will look to see if it is a virus.
>
>> George

It IS NOT A VIRUS.

However, a trojan horse may have infected your system and may be using
a legitimate program as a means of communicating with people outside
your system.

The original poster who used the term virus was mistaken.

[George-NY]

Thank you Fred. I think I mistakenly called it a virus. I was told it is a
legit program but I can't stop a window from popping up when I boot the
computer. The computer I am having this problem with is running Windows
2000 and I can't seem to find were it is starting from. When I look in the
STARTUP folder I only see a few things that should be there. Even when I
shut the computer off a window pops up saying this program is not responding
and I have to click on END TASK before the computer will shut down.
Any other help is appreciated. I would just like to stop this program as I
am not on any network.
George-NY

> It IS NOT A VIRUS.
>
> However, a trojan horse may have infected your system and may be using
> a legitimate program as a means of communicating with people outside
> your system.
>
> The original poster who used the term virus was mistaken.

[George-NY]

Thank you Fred. I think I mistakenly called it a virus. I was told it is a
legit program but I can't stop a window from popping up when I boot the
computer. The computer I am having this problem with is running Windows
2000 and I can't seem to find were it is starting from. When I look in the
STARTUP folder I only see a few things that should be there. Even when I
shut the computer off a window pops up saying this program is not responding
and I have to click on END TASK before the computer will shut down.
Any other help is appreciated. I would just like to stop this program as I
am not on any network.
George-NY

> It IS NOT A VIRUS.
>
> However, a trojan horse may have infected your system and may be using
> a legitimate program as a means of communicating with people outside
> your system.
>
> The original poster who used the term virus was mistaken.

[Ronnie Vernon MVP]

George-NY wrote:
> Thank you Fred. I think I mistakenly called it a virus. I was told
> it is a legit program but I can't stop a window from popping up when
> I boot the computer. The computer I am having this problem with is
> running Windows 2000 and I can't seem to find were it is starting
> from. When I look in the STARTUP folder I only see a few things that
> should be there. Even when I shut the computer off a window pops up
> saying this program is not responding and I have to click on END TASK
> before the computer will shut down.
> Any other help is appreciated. I would just like to stop this
> program as I am not on any network.
> George-NY
>
> > It IS NOT A VIRUS.
> >
> > However, a trojan horse may have infected your system and may be
> > using
> > a legitimate program as a means of communicating with people outside
> > your system.
> >
> > The original poster who used the term virus was mistaken.

George

Fred is simply arguing semantics here which is not good when discussing
whether or not someone has been infected with a virus.

The fact is that the Deloder Worm (w32.hllw.deloder) installs a copy of
WinVNC onto your system which makes it a part of this virus package. There
has been a recent upsurge of this worm which means that it is highly likely
that you have been infected.

There is a comprehensive analysis and removal instructions here:

DeLoder Worm Analysis:
http://www.klcconsulting.net/deloder_worm.htm

I urge you to take a look.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

[Ronnie Vernon MVP]

George-NY wrote:
> Thank you Fred. I think I mistakenly called it a virus. I was told
> it is a legit program but I can't stop a window from popping up when
> I boot the computer. The computer I am having this problem with is
> running Windows 2000 and I can't seem to find were it is starting
> from. When I look in the STARTUP folder I only see a few things that
> should be there. Even when I shut the computer off a window pops up
> saying this program is not responding and I have to click on END TASK
> before the computer will shut down.
> Any other help is appreciated. I would just like to stop this
> program as I am not on any network.
> George-NY
>
> > It IS NOT A VIRUS.
> >
> > However, a trojan horse may have infected your system and may be
> > using
> > a legitimate program as a means of communicating with people outside
> > your system.
> >
> > The original poster who used the term virus was mistaken.

George

Fred is simply arguing semantics here which is not good when discussing
whether or not someone has been infected with a virus.

The fact is that the Deloder Worm (w32.hllw.deloder) installs a copy of
WinVNC onto your system which makes it a part of this virus package. There
has been a recent upsurge of this worm which means that it is highly likely
that you have been infected.

There is a comprehensive analysis and removal instructions here:

DeLoder Worm Analysis:
http://www.klcconsulting.net/deloder_worm.htm

I urge you to take a look.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

[Fred]

On Sat, 5 Apr 2003 15:57:10 -0500, "George-NY"
> wrote:

>
>Thank you Fred. I think I mistakenly called it a virus. I was told it is a

I believe someone who answered you used the word virus. Nobody
actually said VNC is a virus, but it could be interpreted as if they
did.

>legit program but I can't stop a window from popping up when I boot the
>computer. The computer I am having this problem with is running Windows
>2000 and I can't seem to find were it is starting from. When I look in the
>STARTUP folder I only see a few things that should be there. Even when I
>shut the computer off a window pops up saying this program is not responding
>and I have to click on END TASK before the computer will shut down.
>Any other help is appreciated. I would just like to stop this program as I
>am not on any network.
>George-NY

VNC runs as a service. It should also be located in your tray (on the
right hand side where icons are like the volume control). I would
first move your mouse over the tray and see if anything that says VNC
shows up, and if so you should either right click or double click to
modify it. If you can't figure this out, or if it isn't there, then
you need to modify the service. Click on Start, Settings, Control
Panel, Administrative Tools, Services to open the services applet.
Then scroll down until you find VNC. When you double click on a
service, a dialog appears - choose the general tab. Look for Startup
Type and select either manual or disabled. Automatic means it will
start whenever you reboot.

[Fred]

On Sat, 5 Apr 2003 15:57:10 -0500, "George-NY"
> wrote:

>
>Thank you Fred. I think I mistakenly called it a virus. I was told it is a

I believe someone who answered you used the word virus. Nobody
actually said VNC is a virus, but it could be interpreted as if they
did.

>legit program but I can't stop a window from popping up when I boot the
>computer. The computer I am having this problem with is running Windows
>2000 and I can't seem to find were it is starting from. When I look in the
>STARTUP folder I only see a few things that should be there. Even when I
>shut the computer off a window pops up saying this program is not responding
>and I have to click on END TASK before the computer will shut down.
>Any other help is appreciated. I would just like to stop this program as I
>am not on any network.
>George-NY

VNC runs as a service. It should also be located in your tray (on the
right hand side where icons are like the volume control). I would
first move your mouse over the tray and see if anything that says VNC
shows up, and if so you should either right click or double click to
modify it. If you can't figure this out, or if it isn't there, then
you need to modify the service. Click on Start, Settings, Control
Panel, Administrative Tools, Services to open the services applet.
Then scroll down until you find VNC. When you double click on a
service, a dialog appears - choose the general tab. Look for Startup
Type and select either manual or disabled. Automatic means it will
start whenever you reboot.

[Ronnie Vernon MVP]

Fred wrote:
> On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP" >
> wrote:
>
> > Fred is simply arguing semantics here which is not good when
> > discussing whether or not someone has been infected with a virus.
>
> So accuracy is unimportant. More proof that MVP means absolutely
> nothing. Yet you then admit later it isn't a virus but a worm. Sad.
>
> > The fact is that the Deloder Worm (w32.hllw.deloder) installs a
> > copy of WinVNC onto your system which makes it a part of this virus
> > package. There has been a recent upsurge of this worm which means
> > that it is highly likely that you have been infected.
>
> No, it does not mean it is "highly likely" that he has been infected.
> It is however a possibility. English wasn't taught well in your
> school was it?
>
> > There is a comprehensive analysis and removal instructions here:
> >
> > DeLoder Worm Analysis:
> > http://www.klcconsulting.net/deloder_worm.htm
> >
> > I urge you to take a look.
>
> I urge you to view a responsible and accurate site instead.
> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deloder.html
> Symantec is a trusted source for virus, worm and trojan horse
> information. The individual who wrote the page at klcconsulting has
> factual misrepresentations all over the place. This is like
> recommending I take my bicycle to Ford instead of Schwinn for service.
> Both have tools, but one knows far more about bicycles than the other.

Fred

Your still arguing semantics here and it really isn't necessary to be rude
or insulting when you disagree with someone.

From the Symantec website:

Trojan Horse
A program that neither replicates nor copies itself, but causes damage or
compromises the security of the computer. Typically, an individual emails a
Trojan Horse to you-it does not email itself-and it may arrive in the form
of a joke program or software of some sort.

Virus
A program or code that replicates; that is, infects another program, boot
sector, partition sector, or document that supports macros, by inserting
itself or attaching itself to that medium. Most viruses only replicate,
though, many do a large amount of damage as well.

Worm
A program that makes copies of itself; for example, from one disk drive to
another, or by copying itself using email or another transport mechanism.
The worm may do damage and compromise the security of the computer. It may
arrive in the form of a joke program or software of some sort.

The common word here is "damage".

My point is that they are all the same thing, code that can damage a system.
It really makes no difference how they get on the system or how they are
packaged.

George has the VNC program on his system and has no idea how it got there.
This makes it "highly likely" (a common term in my part of the world) that
he has a Virus, Trojan, Worm (take your pick) on his system.

My goal was to get him to understand that he needed to run a complete virus
scan to identify and get rid of the malicious code before it did any
unrecoverable damage.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone

Please reply only to the newsgroup so all may benefit.
Unsolicited email is not welcome.

[Ronnie Vernon MVP]

Fred wrote:
> On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP" >
> wrote:
>
> > Fred is simply arguing semantics here which is not good when
> > discussing whether or not someone has been infected with a virus.
>
> So accuracy is unimportant. More proof that MVP means absolutely
> nothing. Yet you then admit later it isn't a virus but a worm. Sad.
>
> > The fact is that the Deloder Worm (w32.hllw.deloder) installs a
> > copy of WinVNC onto your system which makes it a part of this virus
> > package. There has been a recent upsurge of this worm which means
> > that it is highly likely that you have been infected.
>
> No, it does not mean it is "highly likely" that he has been infected.
> It is however a possibility. English wasn't taught well in your
> school was it?
>
> > There is a comprehensive analysis and removal instructions here:
> >
> > DeLoder Worm Analysis:
> > http://www.klcconsulting.net/deloder_worm.htm
> >
> > I urge you to take a look.
>
> I urge you to view a responsible and accurate site instead.
> http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deloder.html
> Symantec is a trusted source for virus, worm and trojan horse
> information. The individual who wrote the page at klcconsulting has
> factual misrepresentations all over the place. This is like
> recommending I take my bicycle to Ford instead of Schwinn for service.
> Both have tools, but one knows far more about bicycles than the other.

Fred

Your still arguing semantics here and it really isn't necessary to be rude
or insulting when you disagree with someone.

From the Symantec website:

Trojan Horse
A program that neither replicates nor copies itself, but causes damage or
compromises the security of the computer. Typically, an individual emails a
Trojan Horse to you-it does not email itself-and it may arrive in the form
of a joke program or software of some sort.

Virus
A program or code that replicates; that is, infects another program, boot
sector, partition sector, or document that supports macros, by inserting
itself or attaching itself to that medium. Most viruses only replicate,
though, many do a large amount of damage as well.

Worm
A program that makes copies of itself; for example, from one disk drive to
another, or by copying itself using email or another transport mechanism.
The worm may do damage and compromise the security of the computer. It may
arrive in the form of a joke program or software of some sort.

The common word here is "damage".

My point is that they are all the same thing, code that can damage a system.
It really makes no difference how they get on the system or how they are
packaged.

George has the VNC program on his system and has no idea how it got there.
This makes it "highly likely" (a common term in my part of the world) that
he has a Virus, Trojan, Worm (take your pick) on his system.

My goal was to get him to understand that he needed to run a complete virus
scan to identify and get rid of the malicious code before it did any
unrecoverable damage.

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone

Please reply only to the newsgroup so all may benefit.
Unsolicited email is not welcome.

[George-NY]

Thank you Fred and Ronnie for all the help. I feel bad that because of my
post and I guess not being very clear that you both are arguing. I was just
seeking help and not meaning to make anyone mad.
I went to the web site you posted for me and found the Artical called
DeLoder Worm/Trojen Analysis. I followed the removal instructions finding
the files on my computer that they said should be removed and removed them.
My computer now seems free of the problem and working like it had been
before seeing that window I complained about. Most of the files was in
C:\winnt\fonts folder.
In the article it said that it was discovered on March 8, 2003 and most of
the files I found had a date of March 8, 2003 on them.
Thanks again for all the help. I appreciated you both taking the time to
reply to me.
George-NY

[George-NY]

Thank you Fred and Ronnie for all the help. I feel bad that because of my
post and I guess not being very clear that you both are arguing. I was just
seeking help and not meaning to make anyone mad.
I went to the web site you posted for me and found the Artical called
DeLoder Worm/Trojen Analysis. I followed the removal instructions finding
the files on my computer that they said should be removed and removed them.
My computer now seems free of the problem and working like it had been
before seeing that window I complained about. Most of the files was in
C:\winnt\fonts folder.
In the article it said that it was discovered on March 8, 2003 and most of
the files I found had a date of March 8, 2003 on them.
Thanks again for all the help. I appreciated you both taking the time to
reply to me.
George-NY

[Ronnie Vernon MVP]

George-NY wrote:
> Thank you Fred and Ronnie for all the help. I feel bad that because
> of my post and I guess not being very clear that you both are
> arguing. I was just seeking help and not meaning to make anyone mad.
> I went to the web site you posted for me and found the Artical called
> DeLoder Worm/Trojen Analysis. I followed the removal instructions
> finding the files on my computer that they said should be removed and
> removed them. My computer now seems free of the problem and working
> like it had been before seeing that window I complained about. Most
> of the files was in C:\winnt\fonts folder.
> In the article it said that it was discovered on March 8, 2003 and
> most of the files I found had a date of March 8, 2003 on them.
> Thanks again for all the help. I appreciated you both taking the
> time to reply to me.
> George-NY

George

Very glad you got rid of this malware. Don't worry about it, there really is
no argument, I think Fred and myself both had the same goal in mind, which
was to see you come out of this without any damage to your system.

Take care and let us know if you need anything else.
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

[Ronnie Vernon MVP]

George-NY wrote:
> Thank you Fred and Ronnie for all the help. I feel bad that because
> of my post and I guess not being very clear that you both are
> arguing. I was just seeking help and not meaning to make anyone mad.
> I went to the web site you posted for me and found the Artical called
> DeLoder Worm/Trojen Analysis. I followed the removal instructions
> finding the files on my computer that they said should be removed and
> removed them. My computer now seems free of the problem and working
> like it had been before seeing that window I complained about. Most
> of the files was in C:\winnt\fonts folder.
> In the article it said that it was discovered on March 8, 2003 and
> most of the files I found had a date of March 8, 2003 on them.
> Thanks again for all the help. I appreciated you both taking the
> time to reply to me.
> George-NY

George

Very glad you got rid of this malware. Don't worry about it, there really is
no argument, I think Fred and myself both had the same goal in mind, which
was to see you come out of this without any damage to your system.

Take care and let us know if you need anything else.
--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

[Fred]

X-Newsreader: Forte Agent 1.91/32.564
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 32
NNTP-Posting-Host: 12.251.175.13
X-Complaints-To:
X-Trace: rwcrnsc54 1049657674 12.251.175.13 (Sun, 06 Apr 2003 19:34:34 GMT)
NNTP-Posting-Date: Sun, 06 Apr 2003 19:34:34 GMT
Organization: AT&T Broadband
Date: Sun, 06 Apr 2003 19:34:34 GMT
Path: news.ultrafeed.com!news.ultrafeed.com!newsfeed-east.nntpserver.com!nntpserver.com!news-west.rr.com!news-east.rr.com!wn12feed!worldnet.att.net!204.127.198. 203!attbi_feed3!attbi.com!rwcrnsc54.POSTED!not-for-mail
Xref: 127.0.0.1 microsoft.public.windowsxp.basics:99203

On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP" >
wrote:

>Fred is simply arguing semantics here which is not good when discussing
>whether or not someone has been infected with a virus.

So accuracy is unimportant. More proof that MVP means absolutely
nothing. Yet you then admit later it isn't a virus but a worm. Sad.

>The fact is that the Deloder Worm (w32.hllw.deloder) installs a copy of
>WinVNC onto your system which makes it a part of this virus package. There
>has been a recent upsurge of this worm which means that it is highly likely
>that you have been infected.

No, it does not mean it is "highly likely" that he has been infected.
It is however a possibility. English wasn't taught well in your
school was it?

>There is a comprehensive analysis and removal instructions here:
>
>DeLoder Worm Analysis:
>http://www.klcconsulting.net/deloder_worm.htm
>
>I urge you to take a look.

I urge you to view a responsible and accurate site instead.
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deloder.html
Symantec is a trusted source for virus, worm and trojan horse
information. The individual who wrote the page at klcconsulting has
factual misrepresentations all over the place. This is like
recommending I take my bicycle to Ford instead of Schwinn for service.
Both have tools, but one knows far more about bicycles than the other.

[Fred]

X-Newsreader: Forte Agent 1.91/32.564
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 32
NNTP-Posting-Host: 12.251.175.13
X-Complaints-To:
X-Trace: rwcrnsc54 1049657674 12.251.175.13 (Sun, 06 Apr 2003 19:34:34 GMT)
NNTP-Posting-Date: Sun, 06 Apr 2003 19:34:34 GMT
Organization: AT&T Broadband
Date: Sun, 06 Apr 2003 19:34:34 GMT
Path: news.ultrafeed.com!news.ultrafeed.com!newsfeed-east.nntpserver.com!nntpserver.com!news-west.rr.com!news-east.rr.com!wn12feed!worldnet.att.net!204.127.198. 203!attbi_feed3!attbi.com!rwcrnsc54.POSTED!not-for-mail
Xref: 127.0.0.1 microsoft.public.windowsxp.basics:99203

On Sat, 5 Apr 2003 14:19:47 -0800, "Ronnie Vernon MVP" >
wrote:

>Fred is simply arguing semantics here which is not good when discussing
>whether or not someone has been infected with a virus.

So accuracy is unimportant. More proof that MVP means absolutely
nothing. Yet you then admit later it isn't a virus but a worm. Sad.

>The fact is that the Deloder Worm (w32.hllw.deloder) installs a copy of
>WinVNC onto your system which makes it a part of this virus package. There
>has been a recent upsurge of this worm which means that it is highly likely
>that you have been infected.

No, it does not mean it is "highly likely" that he has been infected.
It is however a possibility. English wasn't taught well in your
school was it?

>There is a comprehensive analysis and removal instructions here:
>
>DeLoder Worm Analysis:
>http://www.klcconsulting.net/deloder_worm.htm
>
>I urge you to take a look.

I urge you to view a responsible and accurate site instead.
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.deloder.html
Symantec is a trusted source for virus, worm and trojan horse
information. The individual who wrote the page at klcconsulting has
factual misrepresentations all over the place. This is like
recommending I take my bicycle to Ford instead of Schwinn for service.
Both have tools, but one knows far more about bicycles than the other.