Democratic Underground Latest Greatest Lobby Journals Search Options Help Login
Google

Worm.NetSky info needed. How do I recover?

Printer-friendly format Printer-friendly format
Printer-friendly format Email this thread to a friend
Printer-friendly format Bookmark this thread
This topic is archived.
Home » Discuss » The DU Lounge Donate to DU
 
L. Coyote Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Jan-17-10 10:16 AM
Original message
Worm.NetSky info needed. How do I recover?
I've got this worm. What to do?
Printer Friendly | Permalink |  | Top
Sky Masterson Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Jan-17-10 10:21 AM
Response to Original message
1. This is supposed to fix it
Printer Friendly | Permalink |  | Top
 
Dystopian Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Jan-17-10 11:34 AM
Response to Reply #1
2. I wish I would have asked a week ago....
I'm now at a new computer...it took a few days of additional worms and trojans before it finally crashed last night.
I have too much stuff saved on the old one, and email was infected...
My emails must be all over cyberland....
Virus...the end to it all.

Thanks for saving someone else :hug:
peace~
Printer Friendly | Permalink |  | Top
 
Sky Masterson Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Jan-17-10 11:46 AM
Response to Reply #2
3. There are some pretty mean ones out there.
Specially the ones that download other viruses.
That sucks about your computer. :( :hug:
I hope this fix helps the OP.
Printer Friendly | Permalink |  | Top
 
L. Coyote Donating Member (1000+ posts) Send PM | Profile | Ignore Tue Jan-19-10 04:20 PM
Response to Reply #1
5. That first link is for downloading an application.
W32.Netsky@mm Removal Tool could not detect this. Likewise for McAfee's tools.

Malwarebytes' Anti-Malware tool worked in safe mode start-up using Administrator. It takes a while to find all the files thereafter, by using date-sorted searches of My Computer.


Worm.Win32.NetSky is what the warning prompt said. The enemy is a set of files

..\Windows\system\smss32.exe. Identify when that was written and
..\system32\41exe The user of moment may have a file
..\LocalSettings\Temp\dqtphx.exe. I would also search for and delete other files with the same time stamp, like
..\IS15.exe and
..18467.exe

This thing turns off the Windows Firewall. McAfee had to "block future changes." Stay offline and in Safe Mode until you recover.

Finally, to make it work after restart out of Safe Mode, I had to delete prefetch files written by the above .exe files. They have the same names as prefixes and matching time stamps. Sort My Documents by date and find any other changes that match the date.

Finally, empty the trash and restart in Safe Mode. Watch the tray to see if the worm loads before your security program.

So now FireFox says Facebook is a restricted site by my security settings.
Printer Friendly | Permalink |  | Top
 
astral Donating Member (1000+ posts) Send PM | Profile | Ignore Sun Jan-17-10 01:07 PM
Response to Original message
4. Make sure you get a good antivirus and fire wall up . . .
first thing to do. I got AVG antivirus and Comodo Firewall (both free versions) and I may just go all the way Comodo in the future but the AVG Free seems to do the trick pretty good. People tend to go with the free-trial time on McAfee or Norton when they get a new computer and I don't know about McAfee but Norton was a major pain in the @$$ and not completely reliable when I last had it.
Printer Friendly | Permalink |  | Top
 
L. Coyote Donating Member (1000+ posts) Send PM | Profile | Ignore Wed Jan-20-10 09:51 AM
Response to Reply #4
6. My McAfee protection stopped this thing from doing more harm when it turned my firewall off.
Somehow, this got past the protection, but it was stopped from using its own STMP engine to propagate.
Printer Friendly | Permalink |  | Top
 
L. Coyote Donating Member (1000+ posts) Send PM | Profile | Ignore Wed Jan-20-10 03:39 PM
Response to Original message
7. More to add for those who find this via search later
I went back into my system as Administrator and seriously clamped down on Internet Explorer Options there, basically not letting that browser do anything unless required to open.

If anyone has advice on this thing, add it here to be found by anyone who has the same thing hit them.
Printer Friendly | Permalink |  | Top
 
PfcHammer Donating Member (1000+ posts) Send PM | Profile | Ignore Wed Jan-20-10 07:54 PM
Response to Original message
8. I use ComboFix for infections
use avast!, malware bytes, and install the hosts file from http://hostsfile.mine.nu /
Printer Friendly | Permalink |  | Top
 
DU AdBot (1000+ posts) Click to send private message to this author Click to view 
this author's profile Click to add 
this author to your buddy list Click to add 
this author to your Ignore list Mon Sep 22nd 2014, 08:13 PM
Response to Original message
Advertisements [?]
 Top

Home » Discuss » The DU Lounge Donate to DU

Powered by DCForum+ Version 1.1 Copyright 1997-2002 DCScripts.com
Software has been extensively modified by the DU administrators


Important Notices: By participating on this discussion board, visitors agree to abide by the rules outlined on our Rules page. Messages posted on the Democratic Underground Discussion Forums are the opinions of the individuals who post them, and do not necessarily represent the opinions of Democratic Underground, LLC.

Home  |  Discussion Forums  |  Journals |  Store  |  Donate

About DU  |  Contact Us  |  Privacy Policy

Got a message for Democratic Underground? Click here to send us a message.

© 2001 - 2011 Democratic Underground, LLC