Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with worm.win32.netsky (+++)


  • Please log in to reply
3 replies to this topic

#1 K.Mer

K.Mer

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:upstate NY.
  • Local time:02:43 PM

Posted 30 December 2009 - 02:19 PM

Hello~
My computer is infected with several things I THINK they are all due to worm.win32.netsky.
I have been trying to get all of this out of my computer for 2 weeks.

I have scanned with:
Malwarebytes' Anti-Malware
SUPERAntispyware
And AVGfree version antivirus...

Malwarebytes got rid of the green screen, the large pop up in the middle of the screen informing me my computer is infected and some programs have been disabled, and the notification that my computer is infected click here to scan your computer.

I scanned once for this and removed the items it found, but a couple days later it came back with the same indications as the first time. I scanned again with Malwarebytes and removed it again.

Scanning with AVG antivirus.. Its finding Trojan horse vondo.jd
I have scanned ten timed and removed these all ten times and it is still detecting it at these locations:
c:\windows system32\csrss.exe(596):\memory
c:\windows\system32\csrss.exe(596)
c:\programfiles\HP\Digital Imaging\bin\backupnotify.exe(548):\memory_00250000
c:\programfiles\HPdigital Imaging\bin\backupnotify.exe (548)

While starting my computer I get these little gray pop ups runDll The specified module could not be found, These would be
c\documents`1\owner\ntloaddll
c\windows\system32\notepad.dll
c\windows\system32\msbnqdtl.dll
c\windows\system32\msilojzb.dll

one more thing , when I search by keyword my browser takes me to a totally different search results, or I get another window at a complete different page than what I was looking for. I can most of the time get what I am looking for by typing the full web address,and using internet explorer. ( example) www.myhouse.com
Thank you for any help....
KIM

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,011 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:03:43 PM

Posted 31 December 2009 - 12:24 AM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 K.Mer

K.Mer
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:upstate NY.
  • Local time:02:43 PM

Posted 08 January 2010 - 03:51 PM

Hello~
My computer is infected with several things I THINK they are all due to worm.win32.netsky.
I have been trying to get all of this out of my computer for 2 weeks.

I have scanned with:
Malwarebytes' Anti-Malware
SUPERAntispyware
And AVGfree version antivirus...

Malwarebytes got rid of the green screen, the large pop up in the middle of the screen informing me my computer is infected and some programs have been disabled, and the notification that my computer is infected click here to scan your computer.

I scanned once for this and removed the items it found, but a couple days later it came back with the same indications as the first time. I scanned again with Malwarebytes and removed it again.

Scanning with AVG antivirus.. Its finding Trojan horse vondo.jd
I have scanned ten timed and removed these all ten times and it is still detecting it at these locations:
c:\windows system32\csrss.exe(596):\memory
c:\windows\system32\csrss.exe(596)
c:\programfiles\HP\Digital Imaging\bin\backupnotify.exe(548):\memory_00250000
c:\programfiles\HPdigital Imaging\bin\backupnotify.exe (548)

While starting my computer I get these little gray pop ups runDll The specified module could not be found, These would be
c\documents`1\owner\ntloaddll
c\windows\system32\notepad.dll
c\windows\system32\msbnqdtl.dll
c\windows\system32\msilojzb.dll

one more thing , when I search by keyword my browser takes me to a totally different search results, or I get another window at a complete different page than what I was looking for. I can most of the time get what I am looking for by typing the full web address,and using internet explorer. ( example) www.myhouse.com
Thank you for any help....
KIM

It has been weeks and I am still having the same problems, Is anyone able to help me?

#4 K.Mer

K.Mer
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Location:upstate NY.
  • Local time:02:43 PM

Posted 08 January 2010 - 03:53 PM

Hi, Its been a little while, I was wondering if anyone is able to help? My scans still come up with the trojans, and there is still adware, spy bot or something that keeps redirecting to a survey panel for everything I search for...




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users