w32.spybot.worm Virus Keeps Coming Back!?!? Help!

[Paula]

I have been fighting to rid my PC of the dreaded w32.spybot.worm for
almost two months now. I had to re-format my PC - and boot sector -
as this virus was on my PC, but every once in a while (after
start-up), my Norton Antivirus tells me it found a w32.spybot.worm
file and it deletes it (usually the TFTP files). This keeps happening
after I visit websites that have pop-up ads (Since my re-format, I
have not downloaded ANYTHING from any website besides Norton and I am
not a Kazza user).

My firewall is enabled, I have all Windows security patches and Norton
running. What else should I do to prevent this spybot.worm from
re-infecting my PC? Should I use the Google Toolbar to prevent
pop-ups and see if that works?

Is it possible that the w32.spybot.worm is still on my PC (and that's
why it keeps re-appearing sometimes?)? How can I tell?

Any advice you can give would be much appreciated!

Thanks!
Paula

 

[The Prophecy]

I have been fighting to rid my PC of the dreaded w32.spybot.worm for
almost two months now. I had to re-format my PC - and boot sector -
as this virus was on my PC, but every once in a while (after
start-up), my Norton Antivirus tells me it found a w32.spybot.worm
file and it deletes it (usually the TFTP files). This keeps happening
after I visit websites that have pop-up ads (Since my re-format, I
have not downloaded ANYTHING from any website besides Norton and I am
not a Kazza user).

My firewall is enabled, I have all Windows security patches and Norton
running. What else should I do to prevent this spybot.worm from
re-infecting my PC? Should I use the Google Toolbar to prevent
pop-ups and see if that works?

Is it possible that the w32.spybot.worm is still on my PC (and that's
why it keeps re-appearing sometimes?)? How can I tell?

Any advice you can give would be much appreciated!

Thanks!
Paula

If you have 2 hard drives in your computer, W32.Spybot.Worm could have
infected some file(s) on the second drive and been hiding there when you did
a format of the first one. In any case, follow the steps below to completely
remove Spybot.Worm

--
Virus Removal Steps:

1. Obtain the latest virus definitions for your Antivirus client
2. Disable System Restore (Windows ME and XP only)
3. Reboot your computer and press F8, and select Safe Mode
4. Perform a full system scan with your Antivirus program, and remove every
infected file found by the scan.

Notes:
How to disable System Restore (Windows ME and XP only)

Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;[LN];310405

Windows ME:
http://support.microsoft.com/default.aspx?kbid=264887

 

[Theo]

(e-mail address removed) (Paula) wrote in

My firewall is enabled, I have all Windows security patches and Norton
running. What else should I do to prevent this spybot.worm from
re-infecting my PC? Should I use the Google Toolbar to prevent
pop-ups and see if that works?

Is your firewall set to block and alert you to all incomming connections
from the internet by default? If not, then you should and selectively allow
access. Do the same for outgoing access so that any new program attemting
access (like this one) will alert you and give you the chance to allow it
or not.

This worm finds its way to others directly from infected computers, not so
much via downloads or the web.

Whats the filename?

 

[Theo]

(e-mail address removed) (Paula) wrote in

Any advice you can give would be much appreciated!

forgot...

also, if you havent yet go to http://grc.com/default.htm and run the
sheildsup test to see if you have any open ports.

 

[Beauregard T. Shagnasty]

Quoth the raven Paula:

I have been fighting to rid my PC of the dreaded w32.spybot.worm for
almost two months now. I had to re-format my PC - and boot sector -
as this virus was on my PC, but every once in a while (after
start-up), my Norton Antivirus tells me it found a w32.spybot.worm
file and it deletes it (usually the TFTP files). This keeps happening
after I visit websites that have pop-up ads (Since my re-format, I
have not downloaded ANYTHING from any website besides Norton and I am
not a Kazza user).

If the worm is in your System Restore, you'll have to dump the restore
points.

My firewall is enabled, I have all Windows security patches and Norton
running. What else should I do to prevent this spybot.worm from
re-infecting my PC? Should I use the Google Toolbar to prevent
pop-ups and see if that works?

You don't say what browser you are using, but the Google Toolbar
indicates IE. Do you think it is time to switch to a modern, secure,
unhijackable browser?

http://home.rochester.rr.com/bshagnasty/tips.html#browsers

Is it possible that the w32.spybot.worm is still on my PC (and that's
why it keeps re-appearing sometimes?)? How can I tell?

See also the link to A-Squared anti-trojan program on my tips page,
plus the other anti-spyware apps.

Any advice you can give would be much appreciated!

Practice Safe Hex. <g>

 

[Criminal Element]

If you have 2 hard drives in your computer, W32.Spybot.Worm could have
infected some file(s) on the second drive and been hiding there when you did
a format of the first one. In any case, follow the steps below to completely
remove Spybot.Worm

Has Spybot worm now become a file infector virus too? I came here thinking I knew the difference between
"self-contained" worm files and "virally infected" host programs and now find both to be false notions. Some
poster said that worms are viral and now someone says a worm infects files on a second drive - - what gives?

 

[Watson]

Checked out this site.

Thanks for the link.

Watson

 

[The Horny Goat]

I did as you suggested and it shows the open port is the one for
Kerberos which I've heard of but don't know what it does - any major
applications use this to communicate to the outside world? Any easy
way to close it? (I'm using the standard XP home firewall)