HELP PLEASE! NACHI-B Worm..KEEPS COMING BACK!!

Avast Free Antivirus / Premium Security
1

Hi,
My ADSL went down last monday and I got it back yesterday… as while after I logged on to the internet Avast said Virus foud in C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5 in a folder with numbers like O633FHR1. I try clicking repair and it says cannot process the file… Then SVhost Says its infected with teh NBachi Worm…I tried deleting thre Wkspatch.exe file that was in the tem donloaded files, but it keeps coming back.
I really don’t know what to do. Please can some one help ASAP.
Thank you very much

Regards

WillB

2

Download the Avastcleaner: http://www.avast.com/i_idt_171.html

Delete everything inside this folder: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files

Enable the XP Firewall and update your Windows via www.windowsupdate.com

3

should i run the scan safe mode?

4

Not really necessary, but it is not a bad idea.:slight_smile:

5

Ok.
When I finnish download XP SP2 ill enable Internet connection Firewall (I have Zone Alarm too which i would have thought stoped it) Ill install SP2 then boot into safe mode, delete the files in Temp internet files then run teh cleaner. sound good?

Thanks

Will

6

Remember, SP2 is still beta and to install the final sp2 you have to uninstall the beta first. Not all software is combatible to Sp2 right now!

7

ok. shall i delete the temp internet files before running the cleaner…thanks

Will

8

Yes, they are “useless” and so there are less files to scan.:slight_smile:

9

But when I deleted them before…the wkspatch.exe just came back?

10

No if the file is deleted it is gone, The problem is that it does not come back. You need a firewall or/and a patched Windows. Maybe the worm is hidding somewhere else…

11

Remember, if you are running 2 similar programs … XP’s firewall & ZoneAlarm … at the same time that there may be some interference between the 2 programs. This could have allowed your problem. :frowning:

If it were me, I would turn off the XP firewall as it only provides inbound protection and I suspect that it does not close all ports. :-\

ZoneAlarm is so much better! :slight_smile:

12

When i got the Virus I was not running the XP Firewall. Just Zone Alarm (the fre one) I downloaded the Service pack 2 beta and the fire wall looks ALOT better… You can actually configure programs 4 internet acces and it disables active x controls on some pages. If you know you can trust the page you then click on the information bar at the top and it enables active x…Its got lots of other holes closed to. Since I Installed SP2 then ran the cleaner (which didn’t find aything I see to be virus free…) Fingers are crossed…

Thanks for all your help

Will

13

Also, I don’t know if this is related in your case, it does not seem to be, but turning off system restore and then turning it on again can sometimes rid your computer of a particular virus. (some viruses get “recovered” in system restore.)

I always turn system restore off after I have found a virus and purged it or before running the avast! virus cleaner, and then turn it back on afterwards.

Cheers!