worm.win32.netsky

Hey guys,

It looks like I've got similar problems as those with the worm.win32.netsky. I've tried to post on the other threads but wasn't allowed to. I've spent the day running the diagnostic programs.

I did them all but wasn't able to run the two online scanners while in safe mode. I'm not sure what effect this will have on those results. After all the scans, I'm still having issues with the virus alerts continually popping up.

Thanks in advance for any help getting this off my system.

 

And the remaining 3....

Again any help is greatly appreciated!!

 

Hi miked!
Welcome to Major Geeks!

Run this utility:

Please rerun ShowNew, GetRunKeys and HijackThis and submit the following 4 logs with your next post:

- newfiles.txt
- runkeys.txt
- hijackthis.log
- combofix log

abri

 

Thanks for the quick reply!

Here are the new logs:

 

And hijackthis log:

 

Hi mike!

What's in this folder? (don't open any files)

C:\WINDOWS\system32\LogFiles


1) Please begin by going to add/remove programs and uninstalling the following.

- J2SE Runtime Environment 5.0 Update 6
- Java(TM) SE Runtime Environment 6 Update 1
- Sunbelt Counterspy <---- we no longer need this


2) After that, check for the following folders and if found, please delete them from Windows Explorer:

3) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger


4) Scan with HijackThis and check the boxes for the following entries: (if any are missing, just go on)
( Make sure ALL browser windows are closed when you click FIX )

5) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything inside the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

6) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

7) After you have completed ALL of the above in the correct order, please attach the following logs.

• Avenger log
• ShowNew Log (newfiles.txt)
• GetRunKey Log (runkeys.txt)
• HijackThis Log

abri

 

Hi miked!
I want to add two more things to my last set of instructions.

1) When you run Avenger, please add this entry to the section called Files to delete. It will then look like this:

If you already completed those instructions, please follow the same instructions for Avenger again that are in post 6 and simply put in the following:

Next I would like for you to do the following:

2) Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

3) After you've completed the above, please run ATF Cleaner one more time as per the instructions in post #6 and then attach the Avenger log and new logs for ShowNew, GetRunKeys and HijackThis (analyse.exe).

Let me know how your computer is doing! These are the logs I'll need:

- Avenger log
- newfiles.txt
- runkeys.txt
- hijackthis.log

abri

 

In the Log Files folder, there is a file titled 'httperr1.log'

 

The computer is doing better I would say. The adawareremoval still was loading on startup before doing the steps after my last reply. Once I closed it though, there were no popups or messages about virus activity - so it seems to be helping!

Thanks so much again for all your help!

 

Hi miked!
Please run this:

Using SDFix


Let me know the results.
abri

 

Sorry for the delay but I've been out of town. I haven't experienced any problems the past week. I've attached the final log using SDfix.

If this everything, what steps should I do to restore settings back to before beginning the repairs?

 

Hi miked!

The httperr1.log entry you mentioned is legitimate.

Which settings changed and at what point did they change?

The things we tried to fix in the last posts are fixed, but I would like to see another scan by BitDefender to make sure everything is gone. I believe you can have BitDefender scan only a certain region of your computer, so please tell it to scan C. The link to those instructions is under step 6A in the READ & RUN ME FIRST

If your log for BitDefender comes up clean then I will have you follow our final clean-up instructions, which will remove all the tools we've used, set a clean restore point and give you our recommendations for "How to protect yourself from malware".

abri

 

Here's the bdscan log.