?
Solved

E-mail Worm

Posted on 2006-10-27
2
Medium Priority
?
179 Views
Last Modified: 2013-12-04
Hello there,

One of secretaries in our company has accidentaly opened a *.zip with a *.exe inside. It was a worm. Unfortunately she deleted the mail completely because she thought it was a dud. Her anti virus tool was not able to stop the worm its seems. She is using Avast.

Now this worm is using her e-mail to send "Update-KB7359-x86.exe" to who ever is on her personal list. Her OS is Windows 2000.

How do I stop it and remove it... please help.
0
Comment
Question by:Vulconi
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 37

Accepted Solution

by:
bbao earned 1500 total points
ID: 17817853
hi Vulconi,

you may try these steps:

1. download TCPView (tcpview.exe) and Process Explorer (procexp.exe) from www.sysinternals.com.
2. run TCPView to see which process is connecting to other hosts through SMTP port 25.
3. run Process Explorer to find out the related process, locate its folder, then kill the worm process.

(the worm distribution should be terminated now, please make sure this is done before going to step 4)

4. rename or delete the executable file of the worm process in the folder located above.
5. run msconfig.exe from Start | Run, check if this worm process appears in the lists of Services and Startup.
6. uncheck the related items if found.
7. run regedit.exe from Start | Run, search for the items containing the name of that process.
8. delete the related items if found. better backup the windows registry before making changes.
9. reboot.

hope it helps,
bbao
0
 

Author Comment

by:Vulconi
ID: 17817976
Well I think I have already sorted it out.

I did follow some of your steps although I deviated somewhat.

1. I rebooted the machine into safemode.
2. Deleted all files located in the temp and Tempory internet files
3. Installed Nod32
4. Scanned and found an infected file ... W32/Rbot
5. Downloaded a removal tool via other computer and transfered via flash disk.
6. Ran the removal tool on machine.
7. Restarted and ran a full scan

The problem I encountered was the Nod32 did not want to work...services was disabled. Avast was re-installed and I ran the full system check.

No problems yet...

Thank you for your help. I hope both our steps will prove useful for other.

Vulconi
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
Suggested Courses
Course of the Month12 days, 2 hours left to enroll

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question