Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Security Center Alert: Win32.Netsky.Q


  • Please log in to reply
21 replies to this topic

#1 capecodlynne

capecodlynne

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 15 December 2008 - 06:48 PM

Hi.

I got home from work and my husband informed me that his PC (with XP Pro) has another bug. (This from the man who swears he doesn't need anti-virus or any other kind of protection because his PC never gets infected -- this is the second time in two months. =P) He does not know if Windows Firewall was enabled before he noticed the problem.

Booting his PC up, Windows XP Pro loads normally, but then there is an error message stating:

ViewMgr has encountered a problem and needs to close.  
Error signature: 
szAppName: Viewpoint Service.exe   szAppVer: 2.0.0.54
szModName: Viewpoint Service.exe   szModVer: 2.0.0.54   offset: 00002250
Then shortly after that appeared, a "Security Center Alert" popped up saying:
To help protect your computer, Windows Firewall has blocked activity of harmful software.

Do you want to block this suspicious software?
Name: Win32.Netsky.Q
Risk level: High
Description: Netsky.Q is a worm trojan program that records keystrokes and takes screen shots of the computer, stealing personal financial information.

Keep Blocking [was grayed out]	 Unblock [also grayed out]	Enable Protection [not grayed out]

Windows Firewall has detected unauthorized activity, but unfortunately it cannot help you to remove viruses, keyloggers and other spyware threats that steal your personal information from your computer.  [link-->]Click to download and activate protection.
My husband says that he did click on the link that said "Click to download and activate protection". He said that when he did so, a window popped up to download some sort of antivirus software. He did not go further than that.

Opening an Internet Explorer window shows the following:
Insecure Browsing Navigation on hold

Insecure internet activity. Threat of virus attack 

Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, and that can lead to system slowdown, freezes and crashes.  Also insecure internet activity can result in revealing your personal information.  To get full advanced real-time protection for PC and internet activity, register your antivirus software.  

We recommend you to protect your PC now and continue safe internet browsing.

[link]Click here to get full advanced real-time protection and continue browsing.
[link]Continue to this website unprotected (not recommended).
When he chose "Continue to this website unprotected", put www.google.com in the address bar, and did a search web search, a new window popped up saying something about "Monster..." something or other. (I didn't want to repeat them myself.) No other addresses he tried in the address bar worked.

He did already have AdAware installed on his computer (left over from the last time I had to bail him out of such trouble), but it would not update.

I downloaded the latest version of AVG free antivirus on my own PC, burned it to a CD, and installed it on his PC. It also would not update. I was able to run AVG in safe mode (it ran command line). There were many, many files that were "file locked not scanned".

The report only showed that one PUPs was found and cleaned.

Spybot would not updated either.

What should I try next?

Thanks a bunch!


------------------------------EDIT---------------------
I should add that the only reason I did not include any screen shots or copy of the AVG scan report is I'm not sure if it would be risky to plug my USB drive into his PC (I don't want to lose or infect anything on that drive), or to then plug that USB drive into my (so far) healthy PC. Would this be safe to do?

Incidentally, my mother and daughter both described some similar windows (but possibly different names) on their work/school PCs in the past week. In their cases, the infection affected both IE and Firefox, but their McAfee got rid of the trojan (as far as they can tell).

Edited by capecodlynne, 15 December 2008 - 07:02 PM.


BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:01:58 AM

Posted 15 December 2008 - 08:04 PM

I trust that you are not letting him use your computer, I hope?
Try downloading Mbam You can download to a thumb drive if need be.
If it won't open, try changing Mbam.exe to somethingelse.exe
------------------------------------------------

Please download Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 16 December 2008 - 07:59 PM

I downloaded mbam and the updates onto my thumb drive. It would not install intill I renamed Mbam.exe. It would not update, so I ran the update file which said it finished surprisingly quickly. Mbam would not open. I tried uninstalling and reinstalling (took ages and ages) with the same result.

This morning my husband decided to use Norton Ghost and reimage his hard drive. Now we've got an entirely different problem that I don't know will be appropriate for this board. When Ghost was done and he booted from his hard drive, Windows hung on the Windows XP startup screen. We thought to try using Repair on his XP Pro CD, but BIOS doesn't list CD-ROM as a boot option.

Should I move this to a different board? Is it possible that whatever bug this was could have messed with his BIOS too?

#4 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:01:58 AM

Posted 16 December 2008 - 08:30 PM

I'll move you to th XP forum
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,866 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:58 AM

Posted 16 December 2008 - 08:54 PM

Assuming that there is no malware responsible...I'd suggest trying a repair install of XP as a cure for these various ails.

Making an image of a system with problems...is not necessarily something that I would bother with. I would try to move any data files which I deemed worthy of such attention.

At this point in time...it could be a hardware problem.

I've never seen a BIOS that does not reflect an optical drive boot option...unless such was not installed and recognized by the BIOS.

System manufacturer and model?

Detail of any error messages?

Louis

#6 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 16 December 2008 - 09:11 PM

Hi, Louis.

My husband has already reimaged his hard drive. The hard drive he copied from worked fine in this same PC (a Dell Dimension 2350). There are no error messages. He turns on the PC, we can see the boot screen then Windows starts up with the pretty blue screen and the Windows XP logo. We thought we should run Repair, but we can't set BIOS to boot from CD. In BIOS, on the page where it says 1st Boot Device, 2nd Boot Device, etc., it only gives Floppy, Hard Disk, LAN, or Disabled as options.

I looked through his BIOS and couldn't see where the CD ROM should be recognized (I don't remember from the PC hardware class I took a while back, heh).

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,866 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:58 AM

Posted 16 December 2008 - 09:24 PM

OK, thanks :thumbsup:.

What's reflected on the blue screen as a message?

Does the system boot into Safe Mode?

If so...does Device Manager reflect the optical drive? Does My Computer/Explorer reflect said drive?

Louis

#8 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 16 December 2008 - 09:58 PM

The blue screen is not the BSOD or anything. It's just the Windows XP loading screen, the one that says "Microsoft Windows XP" with the XP logo that you would normally see while Windows is starting up, but it never leaves that screen.

We cannot boot into safe mode.

We created some Windows XP boot utility floppies, hoping that would help, and it added a new option in the F5 menu, "Directory Services Restore Mode (Windows Domain Controllers Only)", but that didn't do much for us, heh. It only wound up back at the perpetual Windows loading screen again.

Edited by capecodlynne, 16 December 2008 - 10:02 PM.


#9 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 16 December 2008 - 11:17 PM

My husband is trying to get enough of our old floppies to work without errors to use the floppy boot utility hoping that might make it so he can boot from the XP CD... Poor guy's being incredibly patient with them, considering he's an instant gratification kinda guy. lol

#10 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 17 December 2008 - 12:14 AM

He's now reimaging the MBR from the good drive.

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 55,866 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:58 AM

Posted 17 December 2008 - 05:32 AM

Well...the central problem that I see now is that your optical drive (which could be used to do repairs) doesn't appear to be working properly.

Is it possible to try a different drive on that system? A working optical drive is necessary to either repair or install XP.

I guess that I'm having a hard time following your comments. You say that the system won't boot, yet you refer to the system being used.

FWIW: http://en.wikipedia.org/wiki/Directory_Services_Restore_Mode

Louis

Edited by hamluis, 17 December 2008 - 05:37 AM.


#12 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 17 December 2008 - 05:52 PM

My husband has been swapping the hard drives -- his old hard drive with the original image (functions fine) and his newer, bigger hard drive (boots only as far as the screen I've described several times).

The newer hard drive was working fine until it got some sort of virus. He re-imaged it using Ghost and his old hard drive, but now the newly re-imaged, newer, bigger hard drive hangs. I hope that clears up the confusion.

(Thanks for the link. =) )

#13 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:58 AM

Posted 17 December 2008 - 06:39 PM

The hard drive and Windows is one problem - the CD drive is another problem.
You'll need to either fix the CD drive or find a workaround (such as the XP boot floppies) in order to run the fixes.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#14 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 17 December 2008 - 06:41 PM

He just got home with some brand new floppies to see if they work to get the CD drive to work. *fingers crossed*

#15 capecodlynne

capecodlynne
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:58 AM

Posted 17 December 2008 - 07:25 PM

He's managed to get to the Recovery Console on the bad hard drive. I'm looking for info now for how to use the recovery console. =)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users