topic System infested:Worm W32.VBNA.b Activity in Norton 360

System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 06:51:18 GMT

Hi, I'm new to the forums. I keep getting a message that an intrusion was blocked, and no further action needed. The thing is, I get it quite a lot. I've ran scans and there's no problem, and it's not mentioned as dealt with.

Then a while later the box comes into view telling me that this worm has been blocked.

The details are,

System infested:Worm W32.VBNA.b Activity
Attacker Url api.ipinfodb.com
source address. 67.212.77.13
Attacking computer 27.212.77.13, 80

Attack resulted from \DEVICE\HARDDISKVOLUME\USERS\GARYANDMERYL\APPDATA\TMP\LOCAL.EXE

It is obviously being detected and blocked, but does this mean I have some kin of infection, and can I get rid of it?

I'm not sure if I picked it up from Facebook, or when looking at an animal vet site in Australia (after my cat was ill).

Any ideas?

Thanks, Gary.

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 06:56:58 GMT

What is you Antivirus product installed??

Quads

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 06:59:00 GMT

Further to that, I found this on here.

System Infected: Worm W32.VBNA.b Activity

Severity: HighThis attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

DescriptionWorm Win32.VBNA.b is a network-aware worm infection, which is also regarded by many experts as cloaked malware.

Additional InformationWorm Win32.VBNA.b is a network-aware worm infection, which is also regarded by many experts as cloaked malware.

Affected

Various

But no details as to how to deal with it.

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 07:00:06 GMT

Norton 360 version 6.2.0.9

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 07:13:24 GMT

ODD I had never heard of that detection name for Symantec products (and just looked it's not in the online database) but another AV uses thart name.

Please do not run any tools unless instructed to do so.

We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

Please read every post completely before doing anything.

Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

Please read carefully

1. Please download aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe to your desktop. (replace the hxxp with http)
Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT / Yes
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and Please attach the log in the post back, Don't have the program fix anything.

2. Download OTL hxxp://oldtimer.geekstogo.com/OTL.exe (change the hxxp to http) save it to your Desktop.

Double click on OTL.exe to run it. Right click OTL.exe and select run as administator for Vista and Win 7.

Click the Scan All Users checkbox.

Change file age to 60 days

Press the

Quads

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 07:21:57 GMT

Oops, accidentally clicked the solution button!

How do I download the aswMBR hxxp://public.avast.com/~gmerek/aswMBR.exe? I tried (I changed the 2 x's to tt) Should I just start at HTTP, or include aswMBR?

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 07:26:50 GMT

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-07 08:23:37
-----------------------------
08:23:37.699    OS Version: Windows x64 6.0.6002 Service Pack 2
08:23:37.699    Number of processors: 4 586 0x170A
08:23:37.699    ComputerName: GARYANDMERYL-PC UserName: GaryandMeryl
08:23:39.540    Initialize success
08:24:03.366    The log file has been saved successfully to "C:\Users\GaryandMeryl\Documents\aswMBR.txt"

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 07:38:30 GMT

If you can't follow the instructions including the website addresses like others do then there is no point in me continuing with you and the more dangerous tools that may come.

Quads

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 07:52:09 GMT

Sorry. I made a mistake is all.

I'm normally OK with stuff, but was being a little dense.

I've got a log file from OTL. Posting it shown highlighted entries that this site won't accept. How would you have me deal with them?

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 07:53:54 GMT

Attach the OTL.txt log

Quads

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 07:56:05 GMT

Done.

I was trying to copy and paste.

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 08:00:13 GMT

I also had this.

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 08:06:11 GMT

There was a slight problem, at one time the program stopped responding. So it looks like both those files are the same, maybe.

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 08:12:40 GMT

OTL sometimes looks like it freezes at the modules stage of the scan but it is still working.

Run AswMBR.exe from the desktop.

Quads

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 08:17:31 GMT

here

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 08:23:42 GMT

Sorry. Downloading extra definitions, will repost.

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 08:32:22 GMT

I Suggest reading very carefully instructions as I will be using scripts and if you don't do things correctly things can go wrong!!

Quads

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 08:45:20 GMT

Still scanning. I will double check and confirm everything with you if necessary. Similar to a hijackme log. It loooks as though it has a few red entries

Re: System infested:Worm W32.VBNA.b Activity

gary8158 — Mon, 07 May 2012 08:47:26 GMT

Done.

Re: System infested:Worm W32.VBNA.b Activity

Quads — Mon, 07 May 2012 08:48:25 GMT

You only create a log you can't fix individual files with it just by clicking.

Quads