Agobt-ku, How can I remove this?

Discussion in 'malware problems & news' started by C.Morse, Apr 19, 2006.

Thread Status:
Not open for further replies.
  1. C.Morse

    C.Morse Registered Member

    Joined:
    Apr 19, 2006
    Posts:
    3
    Location:
    USA
    Hi; I found this worm during a routine exam of my startup file in SpyBot S&D. If it is a worm (it is) And the standard removal methods don't work, safe mode reboot virus scans (avastPro) Spybot do not detect it! Any suggestions?
     
  2. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
  3. C.Morse

    C.Morse Registered Member

    Joined:
    Apr 19, 2006
    Posts:
    3
    Location:
    USA
    Thanks for your prompt reply Snowbound. My cpu's been infected with spyware before, but this is only the second worm(Blaster being the first). I have always had some form of anti-virus, firewall,adaware, since'01 and Spybot S&D the last year. Regular boot scans, and safemode scans once a month. I followed the advice in the forums and downloaded and ran (in safemode of course) my Antivirus Mcafee"stinger", Ewido, Spybot, Adaware se, CWshredder, Vx2 cleaner and only Ewido found anything besides cookies. That being: HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Adware.WebSearch : Cleaned with backup. This "worm" shows up only in Spybot's startup list, so I will post my Hijackthis log over to the link you provided. AHHH! the pleasures of home computing!:cautious:
     
  4. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    I find HJT with expert help the easiest and safest way for removing infections. I always post a log if i have a suspicion of malware on my system.

    Hope u get it all sorted.

    BTW, welcome to Wilders. :)



    snowbound
     
  5. C.Morse

    C.Morse Registered Member

    Joined:
    Apr 19, 2006
    Posts:
    3
    Location:
    USA
    Thanks, I will try that. I searched the anti-virus forums first when I should have just googled it and found this link : http://forums.tomcoyote.org/lofiversion/index.php/t46592.html It seems to be a low threat worm and after deleting the entry in Spybot and removing its entry in the registry as Symantec said to. Reboot and its gone. Lots of info about this, it still very active out there. Btw I like your Avatar.
     
Loading...
Thread Status:
Not open for further replies.