worm.win32.netsky - Page 2

[Ritar]

New to this so please bear with me. Working all day trying to get rid of this problem. It has improved but I still have a blue screen on startup.
Started out I had more than one virus. Many scans later I have eliminated some of the warning screens about numerous viruses but still have the win.32netsky problem.
After running the Malware bytes program and creating a log seemed better. I still have a problem though with ccSvcHost on shutdown.
Any help would be apprecieated.

[jholland1964]

New to this so please bear with me. Working all day trying to get rid of this problem. It has improved but I still have a blue screen on startup.
Started out I had more than one virus. Many scans later I have eliminated some of the warning screens about numerous viruses but still have the win.32netsky problem.
After running the Malware bytes program and creating a log seemed better. I still have a problem though with ccSvcHost on shutdown.
Any help would be apprecieated.

Ritar, I have all ready told you that you must begin your own new thread. You will not receive answers in this thread. This is not your thread. We do not work with two posters on the same thread. Please Start a New Thread.

[smodka]

Hey Judy ,Hope your well

I have Removed hijack and i'm having a slight problem with combofix..I typed in Combofix /u and it opened it up and run the programme at no point did the disclaimer come up just the programme/scan started to run.. is there anyway of doing it if the disclaimer dont come up?

Lisa

[jholland1964]

Did the program actually run a full scan when this happened?

[guybo]

Symantec has a great free tool for removing this work. It can be downloaded at http://www.symantec.com/security_response/writeup.jsp?docid=2004-021816-1759-99

[smodka]

hi, It didnt run the full scan because I stopped it ..I remember seeing the disclaimer coming up the first time I used it but not since
Lisa

[jholland1964]

Try it once more, if it doesn't work you can delete it manually by right clicking the icon and choosing delete.

[guybo]

I understand. Thanks.

[jholland1964]

I understand. Thanks.

You understand what?

[guybo]

viruses and their extention will be part of the problem but also part of the solution and here we think it's important to identify the solutions ...unapproved link removed...

Although I understand (I think) what you are trying to say, why remove the link when it offers a clean and quick solution. What I believe you to be saying is that more is to be learned by making the problem's solution as difficult and time consumming as possible. This may be true, but I do not believe it serves the poster's interest in this case.

[jholland1964]

Although I understand (I think) what you are trying to say, why remove the link when it offers a clean and quick solution. What I believe you to be saying is that more is to be learned by making the problem's solution as difficult and time consumming as possible. This may be true, but I do not believe it serves the poster's interest in this case.

I did NOT remove YOUR link from YOUR post for the Symantec tool which is a legitmate tool and appropriate for the thread, though at this time I believe the problem is corrected but I left the link for others to see who may be having the same difficulties.

I removed mr. ashraf_amad's post because it was a link to a university website period and it offers NO information about solutions to infection problems. If links given have absolutely nothing to do with the problems in the thread then they can be considered spam and be removed.

[guybo]

You understand what?

I was replying to ashraf_amad and somehow my reply was posted here. Sorry for the confusion.

[smodka]

Hi, All done! I did have to delete the combofix manually , and then I did the restore point so thats me all done..thanks so much for your wonderful help I dont know where I would have been with out you..

Not sure if this is something to do with the netsky or something random that I have done but I dont seem to have any audio, and I dont think we where near any of the audio settings ..should I start a new thread with this?

Lisa

[r3l1c]

What anti-virus software are you using? Also what operating system?

Hi
I have been having serious problems trying to get rid of the win32.netsky virus.. My task manager is disabled and I cant use my restore function.. I keep getting warnings of the virus when I boot up and pop up windows when I try and use the internet! I cant seem to use run function and my anti virus isnt picking anything up.
I'm not the brightest tool when it comes to the computer but I reckon I can follow instructions if anybody would be kind enough to gimme some.
Please help this desperate woman!! :'(

Thanks x

[PhilliePhan]

What anti-virus software are you using? Also what operating system?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:31:46, on 29/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe. . . . . .

C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe

:)

[jholland1964]

Hi, All done! I did have to delete the combofix manually , and then I did the restore point so thats me all done..thanks so much for your wonderful help I dont know where I would have been with out you..

Not sure if this is something to do with the netsky or something random that I have done but I dont seem to have any audio, and I dont think we where near any of the audio settings ..should I start a new thread with this?

Lisa

Smodka, earlier you said you saw a file called Qoobox in "C". Can you look and see if it is still there? If so, open it and see if there is a .txt file in there. If there is, open it and copy/paste it here.

[smodka]

hi, yes the Qoobox file is still there.. in it there is Backenv, Last run , Quarantine.Test & Test C... Quarantine is the only one with txt in it ...

Its called Catchme!

-------- 2009-11-27 - 23:08:40 -------------

-------- 2009-11-27 - 23:46:03 -------------

-------- 2009-11-28 - 13:10:08 -------------

-------- 2009-11-28 - 13:12:31 -------------

-------- 2009-11-28 - 14:13:05 -------------

-------- 2009-11-28 - 23:28:08 -------------

-------- 2009-11-28 - 23:33:15 -------------

-------- 2009-12-01 - 11:15:05 -------------

-------- 2009-12-01 - 11:17:01 -------------

-------- 2009-12-01 - 11:22:18 -------------

Lisa

[jholland1964]

Well that showed nothing there. Go ahead and delete that Qoobox folder, especially since it is empty. Are you still having problems or do you feel all is ok now?
Judy

[smodka]

Hiya Judy..I just deleted the file and yes all things seem good now..I have one other wee problem but gonna start a new thread for it I think..thanks again for all your wonderful help and being so patient. i'm gonna mark this as solved now
Lisa

[jholland1964]

Hiya Judy..I just deleted the file and yes all things seem good now..I have one other wee problem but gonna start a new thread for it I think..thanks again for all your wonderful help and being so patient. i'm gonna mark this as solved now
Lisa

What is this "wee" problem, may be related to this one, if not then a new thread may be advised but what is the problem?
Judy

[smodka]

Hi Judy its all ok I had no audio but now I have and I can listen to my music again so all cool here..Not sure what i did but its working and thats all that matters
thanks again for all your help, patience, and kidness.. I dont know where I would have been without you
Lisa

[asaness]

open your RUN in start menu and
then type this...

TASKKILL /im VirusName

then OK...

after that open your cmd or command prompt...

then type this code...

DEL VirusName.ExtensionName /s

then hit enter...

then after the scanning process

open your notepad...

then type these...

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

then close your notepad and save...

after that...

rename the extension name (your notepad) into bat.

then hit enter...

then open your taskmanager...

[jholland1964]

asaness This thread is solved as noted by the poster Lisa 4 days ago in the post ahead of yours. Please do not post in solved threads. This post of yours does NOT apply.