Author Topic: HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!  (Read 6273 times)

0 Members and 1 Guest are viewing this topic.

WillB

  • Guest
HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« on: April 12, 2004, 11:47:06 AM »
Hi,
My ADSL went down last monday and I got it back yesterday.. as while after I logged on to the internet Avast said Virus foud in C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 in a folder with numbers like O633FHR1. I try clicking repair and it says cannot process the file.. Then SVhost Says its infected with teh NBachi Worm....I tried deleting thre Wkspatch.exe file that was in the tem donloaded files, but it keeps coming back.
I really don't know what to do. Please can some one help ASAP.
Thank you very much

Regards

WillB

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #1 on: April 12, 2004, 11:51:01 AM »
Download the Avastcleaner: http://www.avast.com/i_idt_171.html

Delete everything inside this folder: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files

Enable the XP Firewall and update your Windows via www.windowsupdate.com
MfG Ralf

WillB

  • Guest
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #2 on: April 12, 2004, 11:53:06 AM »
should i run the scan safe mode?

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #3 on: April 12, 2004, 11:55:21 AM »
Not really necessary, but it is not a bad idea.:)
MfG Ralf

WillB

  • Guest
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #4 on: April 12, 2004, 11:57:13 AM »
Ok.
When I finnish download XP SP2 ill enable Internet connection Firewall (I have Zone Alarm too which i would have thought stoped it) Ill install SP2 then boot into safe mode, delete the files in Temp internet files then run teh cleaner. sound good?

Thanks


Will

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #5 on: April 12, 2004, 12:09:06 PM »
Remember, SP2 is still beta and to install the  final sp2 you have to uninstall the beta first. Not all software is combatible to Sp2 right now!
MfG Ralf

WillB

  • Guest
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #6 on: April 12, 2004, 12:28:53 PM »
ok. shall i delete the temp internet files before running the cleaner...thanks


Will

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #7 on: April 12, 2004, 12:38:10 PM »
Yes, they are "useless" and so there are less files to scan.:)
MfG Ralf

WillB

  • Guest
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #8 on: April 12, 2004, 12:42:00 PM »
But when I deleted them before..the wkspatch.exe just came back?


Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #9 on: April 12, 2004, 12:49:06 PM »
No if the file is deleted it is gone, The problem is that it does not come back. You need a firewall or/and a patched Windows. Maybe the worm is hidding somewhere else.....
MfG Ralf

CharleyO

  • Guest
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #10 on: April 13, 2004, 03:26:22 AM »

Remember, if you are running 2 similar programs ... XP's firewall & ZoneAlarm ... at the same time that there may be some interference between the 2 programs. This could have allowed your problem.   :(  

If it were me, I would turn off the XP firewall as it only provides inbound protection and I suspect that it does not close all ports.    :-\  

ZoneAlarm is so much better!    :)  



WillB

  • Guest
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #11 on: April 13, 2004, 09:00:58 AM »
When i got the Virus I was not running the XP Firewall. Just Zone Alarm (the fre one) I downloaded the Service pack 2 beta and the fire wall looks ALOT better.. You can actually configure programs 4 internet acces and it disables active x controls on some pages. If you know you can trust the page you then click on the information bar at the top and it enables active x..Its got lots of other holes closed to. Since I Installed SP2 then ran the cleaner (which didn't find aything I see to be virus free..) Fingers are crossed..

Thanks for all your help

Will

Offline chameleon

  • Full Member
  • ***
  • Posts: 164
Re:HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!
« Reply #12 on: April 13, 2004, 04:52:55 PM »
Also, I don't know if this is related in your case, it does not seem to be, but turning off system restore and then turning it on again can sometimes rid your computer of a particular virus. (some viruses get "recovered" in system restore.)

I always turn system restore off after I have found a virus and purged it or before running the avast! virus cleaner, and then turn it back on afterwards.

Cheers!