trojan/worm

I am having a problem removing a troj_porndial.bp from a friends computer. I have removed the major part of it but there is still a part remaining. On last scan the anti-virus showed a worm_nachl.bp in the system profile\ temporary internet files and another worm of the name in the system32\drivers\svhost.exe. file. Any input would be helpful.

 

Hi Eyore some more info might just help a bit like what operating system what anti-virus hes using etc etc

Anyway i would suggest running this first, as i dont know what OS i will say if he has system restore and its active please disable this before running a scan
http://www.majorgeeks.com/download4063.html

See how that goes and post back

 

Windows XP is the system, I did turn off restore for turned it back on because I thought the trojan was gone but now there is a worm. I did check it out and just unplugged the computer, I thought it was best not to give it any help. She is using V-vom's System Suite.5. Just looked at the download you suggested and it was just what I was hoping to find! Thanks will run Monday at noon and post the result as soon as I get it.

 

Looks like your pretty much on the ball there m8, sorry if i was stating the obvious but you got to cover the basics

Try running the stinger and see how that goes, in your description earlier you posted nachl worm just wondering if its possible you meant nachi

 

The anti-virus called it a NACHl so I wasn't sure but that's the only logical solution, The last time I ran into something like this I had a little program that did just what this one does and I looked for the update and there was none.

 

Yeah im thinking its definitely Nachi, or a form of goes under several names heres some info
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

 

Thanks! I've already got my sister the download also. This is trojan week here I guess you can't spam anymore so you trojan. There are 5 computers I know were infected this past 2 weeks! SUX

 

Agreed with the SUX comment, if only these guys put their skills to good use life would be so much simpler

Anyway good luck hope you get everything sorted out

 

Software didn't clean worm. Have to go in safemode. Logged on to the net to get to instructions on safemode, another worm was sucked in: Wormblaster. Figured out how though. Advertisement for spyware finder was the only thing that came up until the antivirus found the worm, nothing else was on the screen and then came a window from so called system saying it had to restart. Tried frantically for what I was looking for until it restarted. Should have pulled the plug on it though! SUX! Will go into safemode and run the programs..........

 

Today went into safemode and ran Stinger..... cleaned the files, running the other program recommended. Just to make sure.