Question about the W32.Spybot.Worm

Duckernator · 11-23-2008, 02:44 AM

Iam running on Windows Vista and just today I noticed my computer behaving very strangely. Firefox would crash for no reason and sometimes it would seem that my upload speeds where at 1 KB/S. So I started a Full System scan with Norton 360 v2, sure enough it found W32.Spybot.Worm.

At first I was surprised that I even got the worm and the Norton had not detected it using Auto Protect earlier. In any case it is removed now, or hopefully it is. I did a bit of research on it and was alarmed that it sends personal information to an IRC server.

So my question is, since Norton didn’t detect it even trying to connect to the internet, could I have lost some personal information? I've checked my daily usage and the upload amount is normal.
Also on Symantec’s website it doesn’t say the Virus is compatible with Vista. So could’ve the Virus simply installed and not done anything?

Thanks,

**jcgriff2** · 11-23-2008, 03:10 AM

Hi. . .

As you know, ANYTHING is possible. So we look at probabilities. Is it likely that someone/ thing is reading your personal info right now or will be in the future - in my opinion, probably not.

User names, account numbers, passwords for sites like banks are spread throughout the system and possibly obtainable if one knew where to look. But think of all the info that flows in & out of your system every day and the redundant checks now put into place. If you change your email at a web site - they send two in return - 1 = old account; other to new one.

I'm not very surprised that Norton 360 either let something in, out or just to vegetate for a while. Norton 360 and Internet Security packages (not just Norton) are an absolute waste of money and will cost you more in the long run when your system crashes and the infamous BSOD appears.

Look around this Vista forum and you will see Norton, McAfee, Kaspersky, COMODO, Lavasoft, etc... responsible for many, many BSODs. Think of the number of users that called the manufacturer and were told they needed RAM or other hardware when it was one or more of these products that caused them so much grief in the months prior.

But that is your call to make, of course. This is nothing more than my personal opinion. I do like Norton anti-virus - just not their or any 3rd party firewall. It plugs up local ports and causes numerous app hangs and app crashes w/ 0xc0000005 exceptions (memory access violation).

My suggestion - get rid of 360 as it is not doing much more for you than tyeing up system resources & slowing it down. Run the Norton Removal Tool.

Click on the Norton Removal Tool link - Norton RT - in my sig area, download it and SAVE it to your desktop.

Close all Windows, then RIGHT-click on the NRT icon and run as administrator. When complete - re-boot.

Now reset the Windows Firewall to its default settings -
START | type FirewallSettings.exe into the start search box | click on FirewallSettings.exe above | select the Advanced Tab | click on "Restore Defaults" | Click Apply (if hi-lighted) | Click OK

If you think the infection was more than you found or just want an expert opinion, I suggest that you proceed to to our Security Center, HiJackThis Log Help Forum, to have your HJT logs reviewed by a Security Analyst.

Please be sure to follow THESE STEPS carefully before posting your logs in the HJT Log Help Forum.

Please let me know how you make out.

Regards. . .

jcgriff2

**Glaswegian** · 11-23-2008, 03:18 AM

Hi

Just to confirm what jcgriff2 has stated - you would have noticed an increase in network traffic had this worm been activated. However, malware present on a system, even if not active, can often allow other infections to access your system. I would recommend following the link provided and let us check out your system. You could also run some online scans - most of the main vendors provide this service.

Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply - it may take a few days.

Duckernator · 11-24-2008, 09:46 PM

I tried to run the gmer program and it gave me a Blue screen?
I'll try again soon, I hope it doesnt stuff up my computer....
Edit: Iam running a Kaspersky Online scan right now.

**jcgriff2** · 11-28-2008, 08:49 PM

What was the bugcheck on the BSOD (STOP error)?

11-23-2008, 02:44 AM	#1 (permalink)
Duckernator Registered User Join Date: Nov 2008 Posts: 2 OS: Windows Vista	Question about the W32.Spybot.Worm Iam running on Windows Vista and just today I noticed my computer behaving very strangely. Firefox would crash for no reason and sometimes it would seem that my upload speeds where at 1 KB/S. So I started a Full System scan with Norton 360 v2, sure enough it found W32.Spybot.Worm. At first I was surprised that I even got the worm and the Norton had not detected it using Auto Protect earlier. In any case it is removed now, or hopefully it is. I did a bit of research on it and was alarmed that it sends personal information to an IRC server. So my question is, since Norton didn’t detect it even trying to connect to the internet, could I have lost some personal information? I've checked my daily usage and the upload amount is normal. Also on Symantec’s website it doesn’t say the Virus is compatible with Vista. So could’ve the Virus simply installed and not done anything? Thanks,

11-23-2008, 03:10 AM	#2 (permalink)
jcgriff2 Moderator, Microsoft Support Join Date: Sep 2007 Location: New Jersey / Southern California Posts: 7,882 OS: Windows 7 RC, Vista Ultimate My System	Re: Question about the W32.Spybot.Worm Hi. . . As you know, ANYTHING is possible. So we look at probabilities. Is it likely that someone/ thing is reading your personal info right now or will be in the future - in my opinion, probably not. User names, account numbers, passwords for sites like banks are spread throughout the system and possibly obtainable if one knew where to look. But think of all the info that flows in & out of your system every day and the redundant checks now put into place. If you change your email at a web site - they send two in return - 1 = old account; other to new one. I'm not very surprised that Norton 360 either let something in, out or just to vegetate for a while. Norton 360 and Internet Security packages (not just Norton) are an absolute waste of money and will cost you more in the long run when your system crashes and the infamous BSOD appears. Look around this Vista forum and you will see Norton, McAfee, Kaspersky, COMODO, Lavasoft, etc... responsible for many, many BSODs. Think of the number of users that called the manufacturer and were told they needed RAM or other hardware when it was one or more of these products that caused them so much grief in the months prior. But that is your call to make, of course. This is nothing more than my personal opinion. I do like Norton anti-virus - just not their or any 3rd party firewall. It plugs up local ports and causes numerous app hangs and app crashes w/ 0xc0000005 exceptions (memory access violation). My suggestion - get rid of 360 as it is not doing much more for you than tyeing up system resources & slowing it down. Run the Norton Removal Tool. Click on the Norton Removal Tool link - Norton RT - in my sig area, download it and SAVE it to your desktop. Close all Windows, then RIGHT-click on the NRT icon and run as administrator. When complete - re-boot. Now reset the Windows Firewall to its default settings - START \| type FirewallSettings.exe into the start search box \| click on FirewallSettings.exe above \| select the Advanced Tab \| click on "Restore Defaults" \| Click Apply (if hi-lighted) \| Click OK If you think the infection was more than you found or just want an expert opinion, I suggest that you proceed to to our Security Center, HiJackThis Log Help Forum, to have your HJT logs reviewed by a Security Analyst. Please be sure to follow THESE STEPS carefully before posting your logs in the HJT Log Help Forum. Please let me know how you make out. Regards. . . jcgriff2 __________________ Expecting a reply from me and it has been > 48 hours ? Send a PM containing a link to your thread Due to a family matter, my availability will be limited through ~ July 31, 2009 Last edited by jcgriff2; 11-23-2008 at 03:12 AM.

11-23-2008, 03:18 AM	#3 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 23,940 OS: Win XP Pro SP3 / Win 7 RC My System Blog Entries: 10	Re: Question about the W32.Spybot.Worm Hi Just to confirm what jcgriff2 has stated - you would have noticed an increase in network traffic had this worm been activated. However, malware present on a system, even if not active, can often allow other infections to access your system. I would recommend following the link provided and let us check out your system. You could also run some online scans - most of the main vendors provide this service. Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply - it may take a few days. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner

11-24-2008, 09:46 PM	#4 (permalink)
Duckernator Registered User Join Date: Nov 2008 Posts: 2 OS: Windows Vista	Re: Question about the W32.Spybot.Worm I tried to run the gmer program and it gave me a Blue screen? I'll try again soon, I hope it doesnt stuff up my computer.... Edit: Iam running a Kaspersky Online scan right now. Last edited by Duckernator; 11-24-2008 at 09:49 PM.

11-28-2008, 08:49 PM	#5 (permalink)
jcgriff2 Moderator, Microsoft Support Join Date: Sep 2007 Location: New Jersey / Southern California Posts: 7,882 OS: Windows 7 RC, Vista Ultimate My System	Re: Question about the W32.Spybot.Worm What was the bugcheck on the BSOD (STOP error)? __________________ Expecting a reply from me and it has been > 48 hours ? Send a PM containing a link to your thread Due to a family matter, my availability will be limited through ~ July 31, 2009