Norton Internet Security / Norton AntiVirus

[keithsri]

Please help me someone!!

I seem to have a virus, that tries to send random spam out to people...Or it seems that way, as Norton keeps kicking in to scan all thse outgoing messages.  I also suffered whereby the computer would not run any program at all from the desktop.  This has been resolved somehow, by starting in safe mode, and doing full scan and checkup..  Yet every 2 - 3 mins, the PC will try and send a huge amount of mail out.  It's strange that the mail icon the system tray does not match the usual outlook style icon, so  I'm not sure if it's actually sending anything...  All these icons go when you hover over them with pointer.  Laslty, nothing is showing up in the task manager when this is happening.  I have no idea how to remove this!!??...Please help me, someone must know what type of worm this is...?  I though it was the Bagle worm, yet the sysmptoms don't quite match.!!  Thanks people....

[Floating_Red]

Have you looked the History or Activity Log? 

Until someone Posts with knowledge of this, I would suggest you Update you Product and Run a Full System Scan.  Please note that Virus Definitons are Updated once-a-week if you have 2005-and-older, once-a-day if you have N.I.S. 2006/2007 and at least twice-a-day if you have N.I.S. 2008; there can be up to three V.D.s Updates a day with N.I.S. 2008.

Message Edited by Floating_Red on 06-03-2008 08:13 PM

[keithsri]

Thanks, definitions are up to date, from 2 days ago, but now have had to disconnect that PC from inernet until I find solution.  It now pops up with the standard "click here to work offline, or click here to try again",,, as something is trying to get access to web....  Ful scan has been done by Norton, Ad Aware, and now  is running MalwareBytes scan.  Nothing was removed by Norton, and it did not see it in registry where I gues a key has been input by program.....  I'm so worried as this machine has important work stuff on there....

[Tony_Weiss Administrator]

I would recommend the following (if you haven't done it already):

1) Download the current virus definitions with a computer that is not infected:

http://www.symantec.com/avcenter/defs.download.html

2) Run the Intelligent Updater package on the infected system, which will update your definitions to today

3) Boot the infected computer in Safe Mode, and run a Full Scan

If you still have problems, please update us on the status of your system. If you need any other help, just let us know. Thanks!

[Floating_Red]

If you use N.I.S. 2006/2007/2008, you should be Updating your Virus Definitions every day.

Nothing has been Removed by Norton because you have not Updated your Virus Definitions.

Let us know if Norton Removes anything once you Update your V.D.s and have Run a Full System Scan.

I would check you History and Activity Log to see if you can idenitfy this problem although, if Norton is not Detecting anything, then it will probably be down to you not Updating your V.D.s.  You should also be Running LiveUpdate throughout the day to Update things like Firewall Definitions, Intrusion Prevention, Spyware Protection and Phishing Protection (Phishing Protection is only in N.I.S. 2007/2008).

 

Message Edited by Floating_Red on 06-03-2008 08:12 PM

[keithsri]

Thanks for the advice guys, system is still being scanned again now in safe mode, as when restarted last time, Norton (I believe) pops up saying something has tried to change system settings on startup, so therfore will restart with last known good start up config.  The machine now somehow turns it's wireless connection on itslef after 10 mins, even after I have turned off wireless with hotkey on laptop!!!  It's done this twice now, something is tellling it to go back online and actually does - to send spam (even though outlook is not started) even the wireless light on the laptop comes on itself when this virus does its thing!!  I've never seen something that can actually control hardware like this, but I've no real knowledge on subject.

[Floating_Red]

Make sure your Out-going E-mail Scanning is On; Norton should stop the e-mails from being sent.  Then I would suggest you go to the N.I.S. Options and make sure you Check all relevant Boxes in all Sections, e.g. LiveUpdate, Intrusion Prevention, e.t.c., e.t.c..  Do this after the Full System Scan Completes.

Maybe you could Downlaod and Install Norton AntiSpam, Norton Add-On Pack (http://www.symantec.com/en/uk/norton/products/overview.jsp?pcid=is&pvid=naop2).

Message Edited by Floating_Red on 06-03-2008 10:44 PM

[keithsri]

Right....After full scans in safe mode, with all options on, Norton removed 2 infected files, but they were spybot malware.  The machine was rebooted and again popped up a norton note saying something had tried to change system settings on start up, and then reboots yet again, after which same mail bomb occurs when online after 1 - 2 mins.  This happened twice before the machine then started displaying symptoms of the old blaster worm.....The machine shut itself down giving me a warning about "NT Authorisation ....." wihtin approx 30 secs - it gave me a countdown timer.  Now running blaster worm removal tool......Wish me luck - this one is nasty and has been doing this for 2 days straight....  I hope someone knows what this may be and get a patch up soon!!!

[keithsri]

My machine won't let me get to the desktop any more...It's now asking for password when I never specified one...It breifly flashes to the desktop and then acts as if it's been asked to log off..Malaawarebytes removed 8 more files including various "wsnpoem" files, and an infected system32/ntos.exe file (not sure what that is?)..I'm gonna have to take the drive out and try and salvage all my stuff..  Thanks for the advice anyhow...

[keithsri]

After taking drive out and connecting to another machine via usb, it has duplicated itself to C drive without me knowing!  This other machine (an old one I got kicking around) is trying to get onlinre for no reason, so I guess it's the same.  Also, a new file in the system32 folder has been created, mdtootly.dll - Anyone know what this is?, I cannot delete it (this old machine has no virus software)...The drive from the original machine is readable though, so I need to copy all my stuff over to a fully updated "safe" machine...Wish me luck (again!)..