Worm.win32.netsky. Help Plz!

Hi guys,

a few days ago I got infected by that netsky thing. I took some action but it proved very persistant. Can anyone help plz?
This is my HijackThis logfile.


Edit by chaslang: Inline HJT log removed. READ & RUN ME sticky not followed.

 

Hi ase147!

Welcome to Major Geeks!

You will need to complete our READ & RUN ME FIRST instructions before we can get rid of this infection completely. Your hijackthis file is not installed correctly so it doesn't provide adequate information. Please do the following first and then continue as per the link at the bottom of this post. If you are unsure about anything, ask.


1) Scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
O2 - BHO: MSVPS System - {88418AA3-16F5-4FC2-A9D8-90B1266DF841} - C:\WINDOWS\nsduo.dll
O21 - SSODL: msmhost - {8706883F-0206-4131-A71E-0623007D6DA8} - C:\WINDOWS\msmhost.dll
O21 - SSODL: msmdev - {58CA539E-3595-4DC4-8EC0-BE9AD18CA510} - C:\WINDOWS\msmdev.dll


Also, if you did not add the following to your trusted zone, please fix it as well:
O15 - Trusted Zone: *.emea-patchlink.insideidc.com (HKLM)

In addition, if you do not know the ip or domain for the following, please fix them as well.
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFAFE130-2F68-4005-8048-1DA61FAC8D3F}: NameServer = 85.255.115.107,85.255.112.217
O17 - HKLM\System\CCS\Services\Tcpip\..\{FBD36EC2-FE06-406F-A72C-09A8D9243E1E}: NameServer = 85.255.115.107,85.255.112.217


2) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

3) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


4) After you've completed the above, please follow the instructions and links in the READ & RUN ME FIRST and post the requested logs so we can help you get rid of this infection completely.

Thanks.
abri

 

Hi abri,

I think I am fine now!It seems I got rid of it!
If I see anything suspicious I come back.

Thanks a lot for your help. I appreciate it.

Guys, be careful what you click on!!

 

Hi ase147,
I'm glad things are doing better, however, the particular infection you have isn't usually taken care of with one step. If you'd like further help, please follow the instructions in the READ & RUN ME FIRST which I gave you the link for in the second post of this thread. We can only help you if we can look at your logs.

Please download FixWareout by LonnyRJones from one of the two below links and save it to your desktop.

http://downloads.subratam.org/Fixwareout.exe

http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

* Run Fixwareout.
* Click Next,
* then Install,
* make sure Run fixit is checked
* and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.

When you run fixwareout, just follow the prompts, you will need to restart when prompted.

After rebooting (restart) back into normal boot mode, make sure you have all web browsers closed.

* Go into Control Panel -->Network Connections.
* Right click on your connection
* and click Properties.
* On the Properties page, highlight Internet Protocol(TCP/IP)
* Click Properties. This will bring up another page.
* Select Obtain DNS Server Automatically.
* Click the ok button. The page will close.
* Press ok on the page in front of you.
* Restart the computer.
* Reconnect to the Internet using Internet Explorer.
* Now come back here and attach the log from fixwareout. It is located at c:\fixwareout\report.txt


Thanks.
abri

 

Hi abri,

I followed all your instructions. I attach the Fixwareout report

Cheers

 

Hi ase147!
We have been able to remove a couple of things from your computer but in the blind. In order to check your computer we need to see the complete set of logs which are produced by following the instructions in the READ & RUN ME FIRST. Malware Removal Guide

Without this information, we can't tell you your computer is clean. We can only tell you we fixed a couple of things and we don't know if there are other things which need fixing.
If you want further help, please post the requested logs to us.

Thanks.
abri

 

Hi abri,

here are all the logs

Cheers

 

more logs.....

 

oops, forgot the attachments!

 

last ones

 

Hi,

I have no more problems.

I think I am cured!

thanks, guys