Comments on: How to remove the jwgkvsq.vmx worm virus

By: Ashish Gupta

Ashish Gupta — Mon, 11 Jan 2010 17:05:30 +0000

Well , Nice tutorial and everything…I respect all the opinions and pains people are taking to clean viruses,,,But why not just use something robust like Linux instead of sticking with Windows and dealing with viruses ? You dont normally get viruses on Linux , Google It!

By: Ryman

Ryman — Thu, 31 Dec 2009 08:05:46 +0000

@Ian

Try scanning your computer with Malwarebytes Anti-Malware and/or Spybot – Search & Destroy.

It is a worm-type virus if it is creating duplicate files that looks like your folders, and your “real” folders are set to hidden.

By: Ian

Ian — Tue, 22 Dec 2009 05:45:31 +0000

I’m getting a virus I believe is similar. It’s called dcjaw.exe Does anyone know anything about it? It seems to be infecting my USB devices and creating shortcut folders for “Documents” “Music” “New folder” “Password (which looks like a file, not a folder)” “Pictures” and “Video”. It also makes autorun.inf apear. Can anyone help me get rid of this?

Sorry to post twice, I entered the wrong email.
My email, if you can help, is alectronancy@gmail.com

By: Kanishka Dilshan

Kanishka Dilshan — Thu, 03 Dec 2009 16:15:32 +0000

We have developed a removal tool for the virus (Recycler\…jwgkvsq.vmx).
Please use following link to download the tool.
http://it.web44.net/VirusDetails/jwgkvsq.vmx.Recover.report.php

Please give your comments on our web site.
Thank you.

Imago Labs®(Sri Lanka)

By: Snake

Snake — Tue, 24 Nov 2009 11:01:22 +0000

Thank you very much!
I am a chinese. I have removed the worm successfully.

By: Esen

Esen — Thu, 12 Nov 2009 03:30:36 +0000

I encountered the same worm. Tried to scan it with Kaspersky Internet Security 2009. It said I have to restart the system and it will remove. However, all the time I restarted the same worm existed.

Then, I tried to scan it in Safe Mode. I found out that this jwgkvsq.vmx worm, which is located in my removable hard drive in H:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx, is actually a KIDO Network Worm (Detected: Net-Worm.Win32.Kido.ih), which is not removable via usual means of KIS 2009. There is a special tool on http://www.kaspersky.com called KK (you may search for KIDO in their home page search bar). You just download KK.zip, unzip it, run it (you may want to scan for specific drive like me H:, then you need to run this KK in command prompt like “kk -p H:” where “H:” is your drive). It will automatically remove the Network Worm.

I think, this will definitely help you to remove this worm.

By: Edwin

Edwin — Sat, 24 Oct 2009 04:38:09 +0000

Got the worm on Oct 22nd 2009. Able to delete it with Spyware Doctor, BUT, then I searched the registry after reading this artice (thank GOD), and there were 3 placed it had nested itself!!!!!

So my point is: erasing it with a anti-spyware does NOT do the job entirely; the worm is still left in the registry!

Now I am worried about any anti-spyware/anti-virus software….. Is this valid???

By: fedmich

fedmich — Thu, 22 Oct 2009 05:49:20 +0000

Just want to share this tool I made that can delete and remove this too
http://www.fedmich.com/tools/usb-cleaner

By: AL-AMIN

AL-AMIN — Tue, 13 Oct 2009 04:39:03 +0000

Go to Start>Run and type in – NET STOP DNSCACHE

Now you can access the websites.

By: Justin

Justin — Wed, 07 Oct 2009 04:19:58 +0000

If you want an easy way to get rid of the virus off the USB drive itself, just download a file explorer like snowbird off the internet and use it. Once again though make sure you enable the “show hidden files option” from within the program but this will override the viruses control over that option in Windows. I have also found that McAfee was the best to get it off the computer itself. Hope this helps anyone.