Wor.win32.net sky virus detected

im currenty running…..System Model: HP d530 CMT(DC577AV) BIOS Version: Hewlett-Packard 786B2 v1.11 Operating System Microsoft Windows XP Professional Version: 5.1.2600 Service Pack: 3.0 Location: C:\WINDOWS PID: 76487-OEM-0050101-22406 Hot Fix: KB976098-v2 Memory (RAM) Capacity: 2 GB Processor Intel® Pentium® 4 CPU 2.66GHz Version: x86 Family 15 Model 2 Stepping 9 Speed: 2660 MHz General Computer Info System Name: PAUL-PC Domain: WORKGROUP Time Zone: Mountain Standard Time Connection: Workstation (standalone) Proxy Server: None IP Address: [removed] 0.0.0.0 0.0.0.0 [removed] IPX Address: Not Enabled i recently picked up a virus, every time i log on to the computer a popup comes up with "wor.win32.netsky detected on your machine, this virus is distributed via the internet through email and active x objects. the worm has its own smtp engine which means it gathers emails from your local computer and redistributes itself in worst cases this worm can assow attachers to access your computer, stealing passwords and personal data viruses can damage your confidental data and work on your computer. continue working in unprotected mode is very dangerous type: virus system affected: win 2000, me, vista, 7. security risk(0-5) 5 recomendations: it is nessecary to preform a full system scan" As soon as i alt f4 this message the processes c.exe and google installer end unexpectedly. at this time my wall paper turns white for a moment(restore active default background) then turns into this background……(i've uploaded a screenshot it can be found at "http://i1014.photobucket.com/albums/af266/waveydaveywaves/backgroundimage.jpg" after everything is loaded; When i try to access the task manager it comes up with a message something like "task manager has been disabled by your administrator(which is bs i am the administrator) i managed to manually overide that using the "REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f" command. once in my task manager i discovered a msa.exe process. i then ended the process tree and quickly erased the msa.exe i found in a windows search. with that out of the way my computer went back to normal speed. the virus got through to norton antivirus and completley destroyed erased it, ditto for malware antivirus. i then downloaded ad aware and did a full scan…. it found and took care of two processes 1. some gamevance ad 2. a debugx.dbb or something like that. i then restarted the computer. the same spyware alert popup still comes up and the wallpaper proceedes to exist, and my windows task manager is still locked(unless i use the run overide command) the only thing fixed is the msa.exe process, its not listed anymore I cant seem to figure out whats going on please help! am i safe to use my computer for normal activity?

Hi,

Please do the following:


Please download exeHelper to your desktop.

• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)

Note If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

did i mention that theres a big x on my norton antivirus in the taskbar so i cant disable scripts?

Hi, Please run the scans anyway. You should be OK

i just finished unzipping the scanner…. when i double click it the windows default popup blocked sound comes on, and the program wont load

Hi,

Please go into your task manager (ctrl +alt +delete) > processes tab

See if there are any running processes from the follwing list (you may not have any of them, but as I don't know at this point which particular infection you have, I'm giving you a list of the more common processes we see.)

If there is any of them there > end process on all the one's from the list that you find.

(do not reboot)

now try and run exeHelper > this will free up your system enough to get the other scans run>

Run the other scans and post the logs:

try not to reboot yourself > if exeHelper needs to reboot that's fine, but other than that, leave the computer on.


smss32.exe
winlogon32.exe
winupdate86.exe
msa.exe
a.exe
b.exe
c.exe
notepad.exe
41.exe
logon.exe
critical_warning.html
lsm32.sys
opeia.exe

sorry it took so long i had to type the "REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f" into the run command; because the taskbar was locked………. heres the log for exe helper and i also have uploaded a photobucket screenshot of my task manager it can be found at the url…………..http://i1014.photobucket.com/albums/af266/waveydaveywaves/processes.jpg at one time there was also a msa.exe process but i managed to disable that one manually through windows search Run at 15:05:17 on 01/13/10 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Killed process c.exe Checking for bad files… Deleting file C:\WINDOWS\temp\svchost.exe Deleting file C:\WINDOWS\temp\winlogon.exe Deleting file C:\WINDOWS\system32\BtwSrv.dll Deleting file C:\WINDOWS\system32\lsm32.sys Deleting file C:\WINDOWS\system32\opeia.exe Deleting file C:\WINDOWS\system32\sshnas.dll Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished– exeHelper by Raktor Build 20091220 Run at 16:41:52 on 01/13/10 Now searching… Checking for numerical processes… Checking for sysguard processes… Checking for bad processes… Killed process c.exe Checking for bad files… Checking for bad registry entries… Resetting filetype association for .exe Resetting filetype association for .com Resetting userinit and shell values… Resetting policies… –Finished–

Hi, are you now able to run the DDS and GMER scans?

i can run dds…but when the two files are supposed to pop up it plays the windows sound popup blocked sound as does nothing

yeah gmer.exe is working

the dds.txt should be on your desktop try running a search for it with your windows explorer

nope not there

umm a javasript like popup came up with "gmer has found system mofdification caused by ROOTKIT activity.

Here's the Gmer.txt