Sober.O Worm Sobig.A Worm

Sober O is spreading quickly. My gal has both these on her machine, and have to go have a look. We both run NOD. NOD has a removal tool, but we could not get it together over the phone. I see in the worms forum below that it is mentioned. If anyone here has had luck with the NOD removal tool, please advise. Thanks.

 

Make sure you are using Blackspear's extra settings. They are explained in a sticky thread at the top of the forum.

Have you tried booting into safe mode and running NOD32 (after you change the settings)? Try running the cleaner in it as well.

 

I won't see the machine until 4 hrs from now. She downloaded the NOD cleaner, but with uncertain results.

Note: Symantec says to turn off SYSTEM RESTORE before running cleaners, for obvious reasons.
Yes?

 

Just curious...Do you know at this point if the worms are actually running on her PC or just the .zip and/or .pif files in messages in her email inbox? If they are still in the inbox, all you need to do is delete them.

If they are running, beyond the cleanup, you should re-check all of the NOD32 settings, especially the email and update ones. These are worms that have existing definitions for them...

 

First at all: Sober & Sobig are not the same type of worm. So you need actually 2 NOD cleaner tools. One for the sober, and the other one for the Sobig.A worm.

If you have any questions feel free to ask here

If the worm is only in the inbox and got not activated just delete them there and run the cleaner tools just to be on a safe side after this.

 

Thanks.. Yes, she deleted them manually. NOD did the red screen thing and asked if she wanted them deleted, she said yes, but the emails did not leave so she did it manually. Maybe NOD deletes the attachments containing the worm, and leaves the mail.

 

COOL!!!

 

Cool avatar

 

In my experience thats the normal thing for NOD to do.