W32.Spybot.Worm

[kirsty]

After turning on my computer Norton alerted me that i had been infected with
W32.Spybot.Worm.
I have gone through all msn history and noticed that my daughter had a
strange message/address that popped up through some of the convo's,usually as
a link.
It was-
ah ah is that you?http://hi5-photos.org/~wwwhi5/view.php?=(name of person in
convo)@hotmail.com
I tried to type the address in myself but it came up as a broken link.
Norton is the only program that picks it up.when i done scans with
malwarebytes,norton would cut in and pick up the virus.
I have done a quick scan on malwarebytes with norton disabled but could not
pick it up on there.I'm using XP 98 home, service pack 2.Can you please help

 

[nass]

After turning on my computer Norton alerted me that i had been infected with
W32.Spybot.Worm.
I have gone through all msn history and noticed that my daughter had a
strange message/address that popped up through some of the convo's,usually as
a link.
It was-
ah ah is that you?http://hi5-photos.org/~wwwhi5/view.php?=(name of person in
convo)@hotmail.com
I tried to type the address in myself but it came up as a broken link.
Norton is the only program that picks it up.when i done scans with
malwarebytes,norton would cut in and pick up the virus.
I have done a quick scan on malwarebytes with norton disabled but could not
pick it up on there.I'm using XP 98 home, service pack 2.Can you please help

Hi,
What Norotn did when found this Worm? Did it removed it or you didn't tell
it to do so?
Run a complete scan with Norotn and MalwareByte in both Normal Mode and Safe
Mode.

The worm infected the machine through file sharing and can spread through
other machine using file sharing among each other!

Here are some info and how to remove
http://www.symantec.com/security_response/writeup.jsp?docid=2003-053013-5943-99

Can you please send me your hijackthis log?
(http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)
HTH,
nass

 

[kirsty]

Norton made me fix it then reboot.I also tried scanning with norton in safe
mode but it said norton cannot couldn't in safe mode.
I have copied the removal process but have only been able to go so far.
Do you want me to send the HJ log to the original address i had for you?
Thanks

 

[nass]

Hi Kirsty,
Yes please, send me the log at my old address. Here it is again:
(e-mail address removed)
HTH,
nass

 

[kirsty]

Sorry nass,i did send the log but its as H-J log not REMOVE THIS.