Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Wpa.exe (esbot Worm)

  • Please log in to reply
2 replies to this topic

#1 Mhairi


  • Members
  • 1 posts
  • Local time:08:21 AM

Posted 27 March 2006 - 04:00 AM

Hi, could anyone please give me advice as im sure I have a virus which norton cant remove. When i run norton it tells me i have a virus (wpa.exe - a hackers tool) that it cant delete or quarantine. I have downloaded from symantec the esbot remover tool but when i run it, it tells me theres nothing to be found. My HJ scan is clean and my adaware scan is clean but im sure i stilll have a virus. Thanks to anyone who could please please give me advice.

BC AdBot (Login to Remove)


#2 -David-


  • Members
  • 10,603 posts
  • Gender:Male
  • Location:London
  • Local time:08:21 AM

Posted 27 March 2006 - 10:57 AM

Hi Mhairi!

Here is some infomation on the file:

Have you tried running AVG in safe mode? You will get a better success rate there. You can boot into safe mode by pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode. If it does not work on the first try, reboot and try again, as you have to be quick when you press it.


#3 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,597 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:21 AM

Posted 27 March 2006 - 11:53 AM

The worm is listed in Trend Micro's database so try removing it using their online scan if David's suggestion still does not work.

Trend Micro Housecall Scan for Firefox
Trend Micro Housecall Scan for Internet Explorer
[Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Install ActiveX component]
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users