W32 Spybot Worm

Discussion in 'malware problems & news' started by Drosilla, Mar 10, 2005.

Thread Status:
Not open for further replies.
  1. Drosilla

    Drosilla Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    2
    Location:
    UK
    Does anyone know how to get rid of the 'W32 Spybot Worm' which has firmly embedded it self in 'C:\Windows\System32\ hotkeys.exe'. Norton Antivirus can't shift it, Spyware Guard did not catch it, Ad aware etc. don't seem to be able to deal with it.

    All suggestions gratefully accepted.
     
  2. nadirah

    nadirah Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    3,647
    You could try booting into safe mode to delete that file in the system32 folder.
    Read here for instructions on how to boot into safe mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam

    This spybot worm seems very common nowadays. Did you open any Junk-email with suspicious attachments?

    You may also post a HJT log somewhere: see this announcement:
    https://www.wilderssecurity.com/showthread.php?t=42148

    Please also read this link for more info about the W32.Spybot.Worm:
    http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html
     
  3. Drosilla

    Drosilla Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    2
    Location:
    UK
    Thanks for that nadirah.

    Yes, that worm sent itself as a message on MSN Messenger from one of my contacts. Unfortunately I opened it just before he 'phoned to to warn me not to.

    I'll give your suggestions a spin and see how I get on.

    Many thanks again.
    Drosilla
     
  4. nadirah

    nadirah Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    3,647
  5. GDarko

    GDarko Guest

    ive been infected with this worm also, but my antivirus software, rootkit software and Avert can't detect it not sure what to do can anybody pls pls help me. im very new to the internet. ive also tried lots of good anti- spyware products.

    thanks for any replys - to the wilders guys and girls
     
  6. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    Take a look here,

    http://www.depts.ttu.edu/helpcentral/Quick_Fixes/W32_Spybot_Worm_Fix.php

    see if it helps.

    Would be a good idea also to post a HijackThis log at one of these sites,

    http://forum.gladiator-antivirus.com/index.php?showtopic=10517

    http://castlecops.com/f67-Hijackthi..._My.html&sid=4f0408d904103da958ac48d9f3b62814


    snowbound
     
Loading...
Thread Status:
Not open for further replies.