Freaking worms... please help

Crombie · 08-07-2005, 03:31 PM

My Anti Vir keeps popping up with this message..

C:\WINDOWS\SYSTEM32\WINMON.SYS

Contains signature of the worm WORM/SdBot.ZO

Ive run Ad Ware / Search and Destroy and even Anti Vir but every time I start up my PC it keeps coming back... any thoughts?

08-07-2005, 04:57 PM

Hello,
First of all if worms are the only thread right now I would say check www.symantec.com for removal tools for the type of worms you have. But I wouldnt think those would be the only problem and would solve your problem to remove them only.
Pls refer to http://www.greyknight17.com/spyware.htm and follow the steps. Get the latest version of hjt and post your log under hjt log help forum here to get assistance with the infections you have.

Regards and goodluck

Geekgirl · 08-08-2005, 09:42 PM

Purplesky is correct, you may have other issues. Post your Log for an analyst to look over.

Download and install: HiJackThis.

(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders or Desktop. A good place to make a folder would be in My Documents, as this is where it will save the backup files needed if there's a problem.)

Then doubleclick HijackThis.exe, and hit "Do A System Scan And Save Log". Make sure all Windows and Browsers are closed.
When the scan is finished, best to save your text file in the same folder as where you put HiJackthis.

Create a New Topic and include a fresh HJT log in the HiJackThisLog Help Forum and Copy/Paste the info from your saved Hijackthis log file into your new topic.

A Moderator/ Security Team Analyst will give you instructions.

***DO NOT TRY TO FIX ANYTHING, MAJOR DAMAGE CAN BE DONE TO YOUR SYSTEM IF THIS TOOL IS USED INCORRECTLY, PLEASE WAIT FOR AN ANALYST/MODERATOR TO GIVE YOU INSTRUCTIONS***

Always describe your problem and any programs you have used to try to resolve your issue. Your description can go a long way to solving/repairing your particular issue.

08-07-2005, 03:31 PM	#1 (permalink)
Crombie Registered User Join Date: Aug 2005 Posts: 4 OS: XP	Freaking worms... please help My Anti Vir keeps popping up with this message.. C:\WINDOWS\SYSTEM32\WINMON.SYS Contains signature of the worm WORM/SdBot.ZO Ive run Ad Ware / Search and Destroy and even Anti Vir but every time I start up my PC it keeps coming back... any thoughts?

08-08-2005, 09:42 PM	#3 (permalink)
Geekgirl Assistant Manager, Microsoft Support Join Date: Jan 2005 Location: Six-burgh, Pennsylvania Posts: 14,171 OS: XP Home SP3/XP Pro SP3/Vista Ultimate SP2/Windows 7 Professional	Purplesky is correct, you may have other issues. Post your Log for an analyst to look over. Download and install: HiJackThis. (Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders or Desktop. A good place to make a folder would be in My Documents, as this is where it will save the backup files needed if there's a problem.) Then doubleclick HijackThis.exe, and hit "Do A System Scan And Save Log". Make sure all Windows and Browsers are closed. When the scan is finished, best to save your text file in the same folder as where you put HiJackthis. Create a New Topic and include a fresh HJT log in the HiJackThisLog Help Forum and Copy/Paste the info from your saved Hijackthis log file into your new topic. A Moderator/ Security Team Analyst will give you instructions. *DO NOT TRY TO FIX ANYTHING, MAJOR DAMAGE CAN BE DONE TO YOUR SYSTEM IF THIS TOOL IS USED INCORRECTLY, PLEASE WAIT FOR AN ANALYST/MODERATOR TO GIVE YOU INSTRUCTIONS* Always describe your problem and any programs you have used to try to resolve your issue. Your description can go a long way to solving/repairing your particular issue. __________________ Compare NOD32 to your current antivirus and anti-spyware solution, HERE How to back up and restore the registry in Windows XP and Windows Vista Or Windows 7 How to back up and restore the registry in Windows 98/ ME / NT 4.0 / 2000 I DO NOT ACCEPT EMAILS AND WILL NOT REPLY TO THEM !!!!! TSF DOES NOT SUPPORT ASSISTANCE THROUGH EMAIL OR PRIVATE MESSAGES, PLEASE KEEP ALL QUESTIONS IN THE OPEN FORUM *The Pittsburgh Steelers - 6 X Superbowl Champions !!!!!!!* *The Pittsburgh Penguins - 2009 Stanley Cup Champions !!!!!!!*

08-07-2005, 04:57 PM	#2 (permalink)
PurpleSky Guest Posts: n/a OS:	Hello, First of all if worms are the only thread right now I would say check www.symantec.com for removal tools for the type of worms you have. But I wouldnt think those would be the only problem and would solve your problem to remove them only. Pls refer to http://www.greyknight17.com/spyware.htm and follow the steps. Get the latest version of hjt and post your log under hjt log help forum here to get assistance with the infections you have. Regards and goodluck