not disinfecting Net-Worm.Win32.Kido.ih

We are using a 100 user license of NOD32 for few years now.

Had a peculiar problem recently in our office with Computer systems failing to browse the file server & certain websites not accessible ie; microsoft, eset (nod32), kaspersky, & even wilderssecurity

Thinking this was an issue with the Windows XP OS, we formatted few systems to no avail.

System Services are automatically stopped - mainly workstation, dhcp client etc


Since NOD32 did not detect any untowardly activity while scanning, we tried with Kaspersky AV which detected " Net-Worm.Win32.Kido.ih " worm

http://img.photobucket.com/albums/v663/eapen/tech/net-wormkidoih.jpg

Kaspersky shows this resident virus
Net-Worm.Win32.Kido.ih c:\windows\system32\istxyiks.dll


NOD32 team, please update a patch for this issue. Currently, temporarily we are using stand-alone version of Kaspersky to remove the infections from clients & file server

Regards
Joseph

 

This infection i believe is a malware called kido which blocks AV websites.

 

conficker aka kido. info & remover tool: http://www.eset.eu/encyclopaedia/conficker_anet_worm_kido_t_downadup_conficker_worm

i google

 

NOD32 Guys, you really need to pull up your socks & start working ! The tool does not even detect the infection ! Boo !

 

I suggest you take the DLL file and follow these steps http://www.eset.com/support/kb.php?option=com_kb&Itemid=29&page=articles&articleid=141

Also fill in as much information as possible and provide a link to this thread.

 

The DLL keeps changing everytime Kaspersky tries to remove the infection. As a note Kaspersky does not remove it fully - the infection still pops back !

The key to this problem is to combine removal with

Microsoft Windows Malicious Software Removal Tool (KB890830)

http://www.microsoft.com/downloads/...e0-e72d-4f54-9ab3-75b8eb148356&displaylang=en

& then run the security patch for Windows XP (KB958644)

http://www.microsoft.com/downloads/...067B73D6A03&displaylang=en#QuickInfoContainer

 

Conficker is made in a way to be hard to remove when Windows is running. It is "conflicting" the known AV programs. I am curious if somebody tried to boot some Linux Live CD, mount Windows partition via ntfs-3g and delete the file. I think Conficker is not able to prevent being deleted when another OS is running.
ESET Online Scanner Beta for Windows (the newer one, not the ActiveX one) is running in Linux when WINE is installed.

command:
wine esetsmartinstaller_enu.exe
or
wine esetsmartinstaller_sky.exe

http://beta.eset.com/eos
http://www.eset.sk/virus-info/eset-online-scanner

Anyway, I suggest you to submit the dll to the virus lab and they will investigate the problem.

 

Yes, I have send the samples via the quarantine box - Today NOD32 managed to catch the infection but not permanently remove them.

An interesting read from Microsoft on conficker\kido worm :

http://support.microsoft.com/kb/962007

 

Hello All,

For those who read this thread and are looking to protect themselves against the Conficker threat or remove it please see our Knowledgebase article here: http://kb.eset.com/esetkb/index?page=content&id=SOLN2209

For further information, you can read our various blogs here: http://www.eset.com/threat-center/blog/

Thank you,
Richard

 

As much as I advocate NOD32, and use it on my clients and servers.. I do recommend a layered approach to spyware, and viruses.. I have Symantec/Kaspersky on my mail firewalls, and NOD32 on servers/Systems.. plus I scan my network shares with different av from time to time.

 

http://www.bdtools.net/

These guys have a removal tool that worked for some.