Worm problem

[Seska]

Hi, I got this worm I can't get rid of. AntiVir catches this worm and delete/wipe/deny the file but it keeps coming back. It creates a file named eraseme_xxxx.exe (x=random number) in /windows/system32. (WinXP). Everytime the attack comes in, it locks up the task manager and sometimes freezes the system entirely.

Can someone help me out? Thanks

 

[deathwalker]

Make sure you try the cleaning proceedure in the safe mode..sometimes that will help...although for all that anti-virus programs are suppose to do for you ..they are not perfect. I had to reformat an reload a freinds system a while back that had a worm/virus/trogan...had the same experience as you. It kept coming back on restart no mater what i did.

 

[RelaxTheMind]

what worm is it? that would help quite a bit.

mcafee stinger (decent for mainstream worms) that can be found here http://vil.nai.com/vil/stinger/

it even gives a list and instructions on how to use it...

 

[Frodolives]

For one thing you need to disable system restore first (so obviously you'll want to backup what you are able to if you haven't already).

 

[Seska]

I tried the stinger as "RelaxTheMind" suggested and it caught the worm W32/sdbot like AntiVir but it's spotted in \system32\i instead of the exe file which seem to have stop appearing. I have also disabled system restore and scanning the rest of my drives now. I hope that worm is gone for good!

Thanks everyone, you guys are great

 

[Frodolives]

And don't forget to turn system restore back on if you rely upon it

And for good measure, I usually do a check with Kasperky's free online scanner in addition to AntiVir when there is any suspect activity.

http://www.kaspersky.com/virusscanner