Windows defender has detected the following worms on my system and I was wondering how dangerous are they and what is it that they do? Detected Items


Worm:Win32/Goldrv!rfn is a trojan that installs Win32/Rootkit.Agent.HU malware.

Installation: The trojan does not create any copies of itself.

The trojan creates the following files: %windir%\­system32\­drivers\­symavc32.sys                       (167936 B, Win32/Rootkit.Agent.HU) %temp%\­_it.bat

Installs the following system drivers (path, name): %windir%\­system32\­drivers\­symavc32.sys, symavc32

The trojan executes the following files: %temp%\­_it.bat

The trojan deletes the original file.

The trojan may delete the following folders: %currentfolder%


Worms will often give themselves randomized names to avoid user detection, you won't find many worms that will names themselves "IAMAVIRUS.worm". It's impossible for us to tell what the worms would do without seeing their inner workings, but to be honest you should probably just remove them from your machine if Windows Defender flags them.

  • I found some info on the first one from Microsoft's Malware Protection Center but I was looking for a little bit of more details. microsoft.com/security/portal/threat/encyclopedia/… – Django Jan 26 '16 at 18:23
  • 1
    I think that the more secure option is to wipe the computer and reinstall. – Neil Smithline Jan 26 '16 at 18:29
  • In fairness to the guy asking, if Windows Defender flagged the thing, that means Windows Defender recognized it. Or, at least, recognized something about it that was suspicious. If it's a known type of malware, we probably can say specifically what it's doing because someone already went to the trouble to analyze it. Of course, the larger question "how did it get on the system?" is murkier. – Parthian Shot Jan 26 '16 at 18:31
  • @NeilSmithline I want that to be my last option. – Django Jan 26 '16 at 18:36
  • 1
    You didn't mention problems with a flash drive. Destroy it and throw it out. Never plug it into another computer. If you must, use a junker computer to extract the critical information and then reformat that computer. – Neil Smithline Jan 26 '16 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.