gksok.exe

Have installed Norton Internet Security 2004. During the=20
pre-installation scan Norton found an infected file. The=20
file was C:\windows\gksok.exe and it was infected with=20
w32.swenA@mm. The installation program asked me if I=20
wanted it to repair the file to which I naturally=20
answered "yes". No other instructions were received it=20
simply carried on scanning files. It did not ask if I=20
wanted to delete the file. =20

At the end of the installation process I received a=20
Norton message that the infected file had been=20
deleted. When I tried to restart the PC I got the=20
following message:

"Windows cannot find gksok.exe. This programme is needed=20
for opening files of type 'application' " =20

It then prompts for location. I have tried to find the=20
file on my original installation desks with no success.

Can anyone help, I have spent =A350 on an anti-virus=20
product and all it has done is wrecked my PC. I cant=20
even find out what the file is - google can find no trace!

[Bert Kinney]

Hi Pete,

You can't find the file because it was deleted by NAVE.
And you don't want the file because it was the virus.
What you want to do is stop Windows from looking for it.

Run the removal tool. That should fix it.
Symantec Security Response - W32.Swen.A@mm Removal Tool:


More information:
Symantec Security Response - W32.Swen.A@mm:


You should also run Windows Update.
http://v4.windowsupdate.microsoft.com/en/default.asp

--
Regards,
Bert Kinney [MS-MVP DTS]
http://dts-l.org/
How to Configure Outlook Express for Internet News:
http://support.microsoft.com/default.aspx?kbid=171164

Pete wrote
Have installed Norton Internet Security 2004. During the
pre-installation scan Norton found an infected file. The
file was C:\windows\gksok.exe and it was infected with
w32.swenA@mm. The installation program asked me if I
wanted it to repair the file to which I naturally
answered "yes". No other instructions were received it
simply carried on scanning files. It did not ask if I
wanted to delete the file.

At the end of the installation process I received a
Norton message that the infected file had been
deleted. When I tried to restart the PC I got the
following message:

"Windows cannot find gksok.exe. This programme is needed
for opening files of type 'application' "

It then prompts for location. I have tried to find the
file on my original installation desks with no success.

Can anyone help, I have spent £50 on an anti-virus
product and all it has done is wrecked my PC. I cant
even find out what the file is - google can find no trace!

[Don Phillipson]

> wrote in message
...

Have installed Norton Internet Security 2004. During the
pre-installation scan Norton found an infected file. The
file was C:\windows\gksok.exe and it was infected with
w32.swenA@mm. The installation program asked me if I
wanted it to repair the file to which I naturally
answered "yes". No other instructions were received it
simply carried on scanning files. It did not ask if I
wanted to delete the file.

At the end of the installation process I received a
Norton message that the infected file had been
deleted. When I tried to restart the PC I got the
following message:

"Windows cannot find gksok.exe. This programme is needed
for opening files of type 'application' "

It then prompts for location. I have tried to find the
file on my original installation desks with no success.

Can anyone help, I have spent £50 on an anti-virus
product and all it has done is wrecked my PC. I cant
even find out what the file is - google can find no trace!

1. Don't panic ! Your ability to post this question
indicates your PC has not been wrecked.
2. Norton's menus may be a bit silly (few Win98
experts like or use Norton) but vaguely indicate
the basic facts. GKSOK is probably a Swen
virus file. It is definitely not a Win98 system
file and probably not an application you loaded.
3. It is not "natural" to seek to "repair" a virus-
infected file that you do not recognize as
something you loaded. The simplest solution
is to delete it, which is what Norton did for
you.
3b. If you are reluctant to delete virus files,
rename them DUD instead of EXE to ensure
they cannot run on your PC. You may need
to go to DOS to rename them (because Win98
will not let you rename something currently in
memory.)
4. Your error message "Cannot find GSOK"
is normal. It means this virus wrote into your
startup routines a file call to load it -- which the
PC now cannot do because Norton correctly
deleted the file.
4a. If the PC boots as normal, you can whenever
convenient look for this bogus file call and delete it.
4b. Some viruses write the virus name into WIN.INI
(or another startup file) as LOAD=GKSOK.EXE
or SHELL=GKSOK.EXE and thus prevent booting.
So boot DOS with a text editor and start looking
in the obvious places, SYSTEM.INI and WIN.INI
4c. GKSOK is probably a nonsense name
randomly generated differently for each infection
(which is why Google finds nothing) but correctly
spotted by Norton. This is what you paid £50 for,
and it looks as if the utility is doing its job.
5. Swen viruses are so common there is masses
of information about them on MS newsgroups.
6. Don't panic.

--
Don Phillipson
Carlsbad Springs (Ottawa, Canada)

[Isaac]

> wrote in news:400001c4730c
:

> Have installed Norton Internet Security 2004. During the
> pre-installation scan Norton found an infected file. The
> file was C:\windows\gksok.exe and it was infected with
> w32.swenA@mm. The installation program asked me if I
> wanted it to repair the file to which I naturally
> answered "yes". No other instructions were received it
> simply carried on scanning files. It did not ask if I
> wanted to delete the file.
>
> At the end of the installation process I received a
> Norton message that the infected file had been
> deleted. When I tried to restart the PC I got the
> following message:
>
> "Windows cannot find gksok.exe. This programme is needed
> for opening files of type 'application' "
>
> It then prompts for location. I have tried to find the
> file on my original installation desks with no success.
>
> Can anyone help, I have spent £50 on an anti-virus
> product and all it has done is wrecked my PC. I cant
> even find out what the file is - google can find no trace!
>
>

The virus is deleted, but it registered itself as a 'application
launcher', and now windows cannot launch applications anymore.

Create a file 'exe.reg', put the following lines in it

REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"


put the file on a floppy.
Boot the infected system to dos, put in floppy, type
regedit a:\exe.reg <enter>
This would do.

[Pete]

Wow - Symantec support could learn something from you=20
guys about how to provide a service. Not sure I fully=20
understand all you have said but it has given me much=20
needed hope. Incidently, I'm not posting on the PC with=20
the problem. Thanks a million. (Think I will bin NIS if=20
I can uninstall it.)
>-----Original Message-----
> wrote in=20
news:400001c4730c
:
>
>> Have installed Norton Internet Security 2004. During=20
the=20
>> pre-installation scan Norton found an infected file. =20
The=20
>> file was C:\windows\gksok.exe and it was infected with=20
>> w32.swenA@mm. The installation program asked me if I=20
>> wanted it to repair the file to which I naturally=20
>> answered "yes". No other instructions were received=20
it=20
>> simply carried on scanning files. It did not ask if I=20
>> wanted to delete the file. =20
>>=20
>> At the end of the installation process I received a=20
>> Norton message that the infected file had been=20
>> deleted. When I tried to restart the PC I got the=20
>> following message:
>>=20
>> "Windows cannot find gksok.exe. This programme is=20
needed=20
>> for opening files of type 'application' " =20
>>=20
>> It then prompts for location. I have tried to find=20
the=20
>> file on my original installation desks with no success.
>>=20
>> Can anyone help, I have spent =A350 on an anti-virus=20
>> product and all it has done is wrecked my PC. I cant=20
>> even find out what the file is - google can find no=20
trace!
>>=20
>>=20
>
>The virus is deleted, but it registered itself as=20
a 'application=20
>launcher', and now windows cannot launch applications=20
anymore.=20
>
>Create a file 'exe.reg', put the following lines in it
>
>REGEDIT4
>
>[HKEY_CLASSES_ROOT\exefile\shell\open\command]
>@=3D"\"%1\" %*"
>
>[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
>@=3D"\"%1\" %*"
>
>
>put the file on a floppy.
>Boot the infected system to dos, put in floppy, type=20
>regedit a:\exe.reg <enter>
>This would do.
>
>.
>

[Pete]

Many thanks Don. I was also getting a WIN.INI message so=20
I'll look at that tonight when I get home.
Pete
>-----Original Message-----
> wrote in=20
message
...
>
>Have installed Norton Internet Security 2004. During the
>pre-installation scan Norton found an infected file. The
>file was C:\windows\gksok.exe and it was infected with
>w32.swenA@mm. The installation program asked me if I
>wanted it to repair the file to which I naturally
>answered "yes". No other instructions were received it
>simply carried on scanning files. It did not ask if I
>wanted to delete the file.
>
>At the end of the installation process I received a
>Norton message that the infected file had been
>deleted. When I tried to restart the PC I got the
>following message:
>
>"Windows cannot find gksok.exe. This programme is needed
>for opening files of type 'application' "
>
>It then prompts for location. I have tried to find the
>file on my original installation desks with no success.
>
>Can anyone help, I have spent =A350 on an anti-virus
>product and all it has done is wrecked my PC. I cant
>even find out what the file is - google can find no=20
trace!
>
>1. Don't panic ! Your ability to post this question
>indicates your PC has not been wrecked.
>2. Norton's menus may be a bit silly (few Win98
>experts like or use Norton) but vaguely indicate
>the basic facts. GKSOK is probably a Swen
>virus file. It is definitely not a Win98 system
>file and probably not an application you loaded.
>3. It is not "natural" to seek to "repair" a virus-
>infected file that you do not recognize as
>something you loaded. The simplest solution
>is to delete it, which is what Norton did for
>you.
>3b. If you are reluctant to delete virus files,
>rename them DUD instead of EXE to ensure
>they cannot run on your PC. You may need
>to go to DOS to rename them (because Win98
>will not let you rename something currently in
>memory.)
>4. Your error message "Cannot find GSOK"
>is normal. It means this virus wrote into your
>startup routines a file call to load it -- which the
>PC now cannot do because Norton correctly
>deleted the file.
>4a. If the PC boots as normal, you can whenever
>convenient look for this bogus file call and delete it.
>4b. Some viruses write the virus name into WIN.INI
>(or another startup file) as LOAD=3DGKSOK.EXE
>or SHELL=3DGKSOK.EXE and thus prevent booting.
>So boot DOS with a text editor and start looking
>in the obvious places, SYSTEM.INI and WIN.INI
>4c. GKSOK is probably a nonsense name
>randomly generated differently for each infection
>(which is why Google finds nothing) but correctly
>spotted by Norton. This is what you paid =A350 for,
>and it looks as if the utility is doing its job.
>5. Swen viruses are so common there is masses
>of information about them on MS newsgroups.
>6. Don't panic.
>
>--=20
>Don Phillipson
>Carlsbad Springs (Ottawa, Canada)
>
>
>
>.
>

[Gary S. Terhune]

One thing Symantec *does* provide is a decent set of instructions for =
removing NAV 2004 and related software. The uninstaller should work OK, =
but in case it doesn't (and, especially, if v. 2004 was an upgrade over =
earlier editions), or just to be sure...
http://service1.symantec.com/SUPPORT/nav.nsf/docid/2004020915570606

--=20
Gary S. Terhune
MS MVP for Win9x
=20
"Pete" > wrote in message =
...
Wow - Symantec support could learn something from you=20
guys about how to provide a service. Not sure I fully=20
understand all you have said but it has given me much=20
needed hope. Incidently, I'm not posting on the PC with=20
the problem. Thanks a million. (Think I will bin NIS if=20
I can uninstall it.)
>-----Original Message-----
> wrote in=20
news:400001c4730c
:
>
>> Have installed Norton Internet Security 2004. During=20
the=20
>> pre-installation scan Norton found an infected file. =20
The=20
>> file was C:\windows\gksok.exe and it was infected with=20
>> w32.swenA@mm. The installation program asked me if I=20
>> wanted it to repair the file to which I naturally=20
>> answered "yes". No other instructions were received=20
it=20
>> simply carried on scanning files. It did not ask if I=20
>> wanted to delete the file. =20
>>=20
>> At the end of the installation process I received a=20
>> Norton message that the infected file had been=20
>> deleted. When I tried to restart the PC I got the=20
>> following message:
>>=20
>> "Windows cannot find gksok.exe. This programme is=20
needed=20
>> for opening files of type 'application' " =20
>>=20
>> It then prompts for location. I have tried to find=20
the=20
>> file on my original installation desks with no success.
>>=20
>> Can anyone help, I have spent =A350 on an anti-virus=20
>> product and all it has done is wrecked my PC. I cant=20
>> even find out what the file is - google can find no=20
trace!
>>=20
>>=20
>
>The virus is deleted, but it registered itself as=20
a 'application=20
>launcher', and now windows cannot launch applications=20
anymore.=20
>
>Create a file 'exe.reg', put the following lines in it
>
>REGEDIT4
>
>[HKEY_CLASSES_ROOT\exefile\shell\open\command]
>@=3D"\"%1\" %*"
>
>[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
>@=3D"\"%1\" %*"
>
>
>put the file on a floppy.
>Boot the infected system to dos, put in floppy, type=20
>regedit a:\exe.reg <enter>
>This would do.
>
>.
>

[Eric]

If you computer works then just download and install=20
TweakUI for Windows 98 and run its Repair options.

TweakUI 1.33 - The latest version for all versions of=20
Windows from 95 to Me and 2000 -

http://www.microsoft.com/ntworkstation/downloads/PowerToys/
Networking/NTTweakUI.asp

Eric,
http://www.pcbuyerbeware.co.uk/
http://www.sharedbirthday.co.uk/


>-----Original Message-----
>Have installed Norton Internet Security 2004. During the=20
>pre-installation scan Norton found an infected file. The=20
>file was C:\windows\gksok.exe and it was infected with=20
>w32.swenA@mm. The installation program asked me if I=20
>wanted it to repair the file to which I naturally=20
>answered "yes". No other instructions were received it=20
>simply carried on scanning files. It did not ask if I=20
>wanted to delete the file. =20
>
>At the end of the installation process I received a=20
>Norton message that the infected file had been=20
>deleted. When I tried to restart the PC I got the=20
>following message:
>
>"Windows cannot find gksok.exe. This programme is needed=20
>for opening files of type 'application' " =20
>
>It then prompts for location. I have tried to find the=20
>file on my original installation desks with no success.
>
>Can anyone help, I have spent =A350 on an anti-virus=20
>product and all it has done is wrecked my PC. I cant=20
>even find out what the file is - google can find no trace!
>
>.
>

Thanks Eric but I cant get on to the net.
>-----Original Message-----
>If you computer works then just download and install=20
>TweakUI for Windows 98 and run its Repair options.
>
>TweakUI 1.33 - The latest version for all versions of=20
>Windows from 95 to Me and 2000 -
>
>http://www.microsoft.com/ntworkstation/downloads/PowerToy
s/
>Networking/NTTweakUI.asp
>
>Eric,
>http://www.pcbuyerbeware.co.uk/
>http://www.sharedbirthday.co.uk/
>
>
>>-----Original Message-----
>>Have installed Norton Internet Security 2004. During=20
the=20
>>pre-installation scan Norton found an infected file. =20
The=20
>>file was C:\windows\gksok.exe and it was infected with=20
>>w32.swenA@mm. The installation program asked me if I=20
>>wanted it to repair the file to which I naturally=20
>>answered "yes". No other instructions were received=20
it=20
>>simply carried on scanning files. It did not ask if I=20
>>wanted to delete the file. =20
>>
>>At the end of the installation process I received a=20
>>Norton message that the infected file had been=20
>>deleted. When I tried to restart the PC I got the=20
>>following message:
>>
>>"Windows cannot find gksok.exe. This programme is=20
needed=20
>>for opening files of type 'application' " =20
>>
>>It then prompts for location. I have tried to find=20
the=20
>>file on my original installation desks with no success.
>>
>>Can anyone help, I have spent =A350 on an anti-virus=20
>>product and all it has done is wrecked my PC. I cant=20
>>even find out what the file is - google can find no=20
trace!
>>
>>.
>>
>.
>