New W32.dabble worm?

Darcie · 04-13-2009, 01:08 PM

Hi all, it's great to find a nice group like this.

I've run into a real problem, for the first time I've gotten something in one of my computers that I can't seem to get out. The system is Windows XP Home, but I don't have the disk (comp came with it installed and no disk), but I do have the reg info on a sticker on the thing. All my other comps have windows xp pro disks :P

Anyhow, I've scanned my computer with Avast, Stinger, SpybotS&D, AddAware, Spydoctor, and Nimda removal tool by symmantic(sp?). I cleared out a few bits and bobs that had found a way in, but the problems remain. After researching the heck out of everything running on the comp and the symptoms it lines up well with W32.dabbler.c worm, except I can't actually find the little bugger. And yes, one of the problems is the oh so lovely Regedit won't run ones.

So here is what is happening.

1) When I am connected to the net (via wireless, yes I reinstalled and updated it all) copies of net.exe and net1.exe processes start opening and get stuck open. They build up and up and UP slowly eating more and more ram. They do NOT close themselves and I have to end each one using the task manager before I can close windows. When I log off of the net they stop building up. If I don't ever log on, they never show up.

2) Firefox is hyjacked. It looks like it is using some of the ads on websites to auto redirect to them rather like the old doubleclick malware did.

So, anyone know if some highly evasive new bugger is out there or if a new one is out? If you think scans will help I can go and get some off of the ill comp, although they haven't helped me much. Thanks all :)

-Darcie

p.s. I think it may have come through a remote connection to a school server, unless it slept for a while or is actually a bug...plus a hyjacker.

**amateur** · 04-13-2009, 01:26 PM

Hello and welcome to TSF.

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a

Quote:

Having problems with spyware and pop-ups? First Steps

link at the top of each page.

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

04-13-2009, 01:08 PM	#1 (permalink)
Darcie Registered User Join Date: Apr 2009 Posts: 2 OS: Windows XP Home	New W32.dabble worm? Hi all, it's great to find a nice group like this. I've run into a real problem, for the first time I've gotten something in one of my computers that I can't seem to get out. The system is Windows XP Home, but I don't have the disk (comp came with it installed and no disk), but I do have the reg info on a sticker on the thing. All my other comps have windows xp pro disks :P Anyhow, I've scanned my computer with Avast, Stinger, SpybotS&D, AddAware, Spydoctor, and Nimda removal tool by symmantic(sp?). I cleared out a few bits and bobs that had found a way in, but the problems remain. After researching the heck out of everything running on the comp and the symptoms it lines up well with W32.dabbler.c worm, except I can't actually find the little bugger. And yes, one of the problems is the oh so lovely Regedit won't run ones. So here is what is happening. 1) When I am connected to the net (via wireless, yes I reinstalled and updated it all) copies of net.exe and net1.exe processes start opening and get stuck open. They build up and up and UP slowly eating more and more ram. They do NOT close themselves and I have to end each one using the task manager before I can close windows. When I log off of the net they stop building up. If I don't ever log on, they never show up. 2) Firefox is hyjacked. It looks like it is using some of the ads on websites to auto redirect to them rather like the old doubleclick malware did. So, anyone know if some highly evasive new bugger is out there or if a new one is out? If you think scans will help I can go and get some off of the ill comp, although they haven't helped me much. Thanks all :) -Darcie p.s. I think it may have come through a remote connection to a school server, unless it slept for a while or is actually a bug...plus a hyjacker.