worm.win32.Netsky

Hi,

Thanks for running and hosting this forum thread -there is obviously a huge problem out there, and an even bigger problem - which answer do you trust. I've spent three days on this now - definitely closer but it still spawns every now and again.

AVG 7.5 seems to catch it periodically however annoying popups tell me Missing file -can't find file .... privacy_secure....The large red danger icon and red desktop have gone but replaced by pure white desktop even though my normal images are there when you do to control panel display - so something still has control and spawns new processes periodically.

Windows malware detector finds nothing now. I've just attached three of the file produced by mgtools.
AVG Spyware picks up new infected files.

Complete user profile removal of:
Cookies,
History
Local Settimgs/temp
local/settings/tem internet files/ie5 content folders
and windows/temp folders

Still have problems.

Nelp greatly appreciated.

 

Hi,

More files. There was no report from AVG Spyware - maybe there is a bug there somewhere - there was 1 high risk file found - Downloader.Agent.dag and then 8 tracking cookies.

Thanks in advance for any and all help. Time much appreciated.

Cheers.

 

There is definetly still a virus present on my machine. AVG has isolated Trojan Horse Downloader.Zlob to the virus vault several times now. Found in my Documents and settings. Also the desktop is hijacked at startup after I see my usual desktop for a short period but before other applications are loaded.

Hope that helps.

 

http://www.majorgeeks.com/images/grenade.gif Welcome to MajorGeeks.com!

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 4: Begin here after rebooting from Step 3!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 5:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 6:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Hi bjgarrick,

Thanks for your help and time. Logs attached.

First thing - line O24 in HJT first run was absent so couldn't remove.

Everything went smoothly until execution of Avenger. An error message of some form came up on the process of re-booting which I didn't catch unfortunately.

Re-boot presented some error messages also about not being able to locate files.
Error message on Desktop still is

Windows Internet Explorer
Cannot find 'file:///C:/WINDOWS/privacy_danger/index.htm'.Make sure the path or Internet address is correct.

Machine does seem to be runnning faster. Also display order for this forum has changed from most recent first to most recent last now?????


Cheers,

Nick

 

Hi Again,

Thought I'd have a quick search via Google Desktop for Privacy_Danger and I found some references both to the original sites I was being requested to visit to no doubt buy a solution to the problem and secondly a cached thumbnail of the original image that presented on my desktop - the large red danger image.

The link for the web sites as collected from Google DT are:


Dec 02 2007
6:13:40pm Protect Your Privacy - securepccleaner.com/privacy/index.php?045a420d46164a52096a5302073d56 - 1 cached
6:13:38pm http://securepccleaner.com/privacy/index.php?045a420d46164a52096a5302073d56.. - securepccleaner.com/privacy/index.php?045a420d46164a52096a5302073d56 - 2 cached

Don't know if that is any help. The actual web pages and file that the current message refers to are all gone and not even in cached form according to Google DT. However somewhere there is a reference spawning something. Anit virus still off. and Spyware gone.

Cheers,

Nick

 

First, have HJT fix the below entry...

Next, right click on your Desktop and select Properties. Then click the Desktop tab and then the Customize Desktop button. Now in the next window that comes up click the Web tab. Make sure at the bottom that Lock desktop items is unchecked. Then in the Web pages: box delete all items but My Current Home Page and make sure it is unchecked too. Then click OK. Apply. OK.

Next, we need to run Avenger again, just like you did before.

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

 

Hi,.

When I run HJT alone there is no o24. So I checked the MGLogs.zip and there it is! Curious.

Any suggestions. HJT log attached after running it just after GetLogs.bat this morning. I've done nothing else so far!

Curious! - Baffled!

 

I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

ATTACH THE FIRST LOG NOW BEFORE CONTINUING OR YOU WILL OVERWRITE IT!!!! And then immediately continue on to the below steps.

How are things working now?

 

File attached as instructed.

Cheers

 

Hi - Yikes.

Problem. I have now logged in from another computer to make this post as I cannot start my machine in safe mode using the instructions after Step 1. When I enter Ctrl Alt Del - nothing. I am forced to shut computer down, no way in or forward. In the past I ahve used the F8 key when white lettering appears on start up but this time using different technique seem to be locked out.

Have noticed in the past that standard safe mode wouldn't work so I had to use Sake Mode with Networking. May be totally irrelevant.

 

OK,

I've got back to my home town and have re-booted from CD.

Couldn't get past password as had clicked safeboot - minimal from MSconfig.

So found bypass to logon by accident in old forum post from 2003 which was hold down ctrl alt the press delete twice with Administrator in user and blank password.

Presto - so back to end of first step.

So before moving to step 2 as per your instrucitons - here are some questions.

1. I am in Safe mode with netowrking -is that OK or do I need to get back to minimal safe mode?
2. If so can I get to safe mode from pressing f8 at startup or is the method you refer to different in some way?
3. As there may now have been other things that have changed during this process - should I go back and perform step 1 again?
That's all.

 

Completed Stage 2 from below. Has removed issue on startup and will advise if further instances of virus are found during the day. Looking good so far but the computer is running alot slower than usual now.

Thanks for your help so far. New rapport.txt file attached.

 

Download HostsXpert and then follow the below steps.

• Unzip HostsXpert.zip
  [*]It will create a folder named HostsXpert in whatever folder you extract it to.
  [*]Run HostsXpert.exe, click Restore Microsoft's Hosts File and then click OK.
  [*]Click the X to exit the program

Now, run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

 

All done. Except when I try to add avenger.txt it attempts and then fails for some reason. I have not run Avenger again - should I? The txt file I have is exactly the same as the one attached previously in post dated 12-02-07, 18:03.

 

Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger now.
8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete C:\MGlogs.zip
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Thanks a heap, outstanding help and support.

 

Your Welcome!

Surf Safely!:major