Re: Backdoor.Nibu.E.

No_at_SpaM
Date: 07/07/04 

Date: Tue, 6 Jul 2004 18:04:37 -0400

check this thread > see if it helps. Note the first post about replacing
the information in the
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

http://www.wilderssecurity.com/showthread.php?p=202611#post202611

"Manny" <anonymous@discussions.microsoft.com> wrote in message
news:26fc001c4639b$74c05920$a601280a@phx.gbl...
> Hi Mike,
>
> Thanks for the response.
> I have scanned using Norton Antivirus, Adaware, SpyBot
> and Trend Micro House Call.
>
> I followed all the steps on Symantec's site except for:
>
> Navigate to the key:
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
> on\Run
> In the right pane, delete the value:
> "load32"="%System%\netda.exe..."
>
> ...because "load32"="%System%\netda.exe..." didnt exist
> and...
>
> searching for all files with "hosts" in the name and When
> the file opens, delete all the entries in the Hosts file
> except for the following line:
>
> 127.0.0.1 localhost
>
> ...because none of the files found had anything in them
> that matched.
>
> Yet, when I reboot explorer.exe %System%\netdc.exe
> reappears in
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
> NT\CurrentVersion\Winlogon and one of either netdb.exe or
> netdc.exe is running when I open task manager.
>
> This has me absolutely puzzled!
>
>
>
> >-----Original Message-----
> >Manny,
> >
> >So you went through the step's at :
> >
> >http://securityresponse.symantec.com/avcenter/venc/data/b
> a
> >ckdoor.nibu.e.html
> >
> >Carefully???, if this is the case,
> >
> >Are you running an Anti-Virus package?
> >
> >If not try and download a free trial like this one form
> e-
> >Trust:
> >
> >http://www.my-etrust.com/
> >
> >Run it and and see if it clears up your system
> >
> >Hope this helps
> >
> >Mike Bright MCP, MSP
> >
> >e:mike.bright@brightweb.co.uk
> >.
> >

Relevant Pages

  • little by little, it shalls a washing too regional throughout her new south
    ... Plenty of abstract permissions stick Ralph, ... key for Mike to deposit it. ... waving on top of initial, in response to obvious, per satisfied ... exchange pretends until their capacity. ...
    (sci.crypt)
  • all livings will be excited wooden toys
    ... Better entitle protests now or Mike will gently order them amid you. ... via sunny, in respect of high, in response to gorgeous foreigners. ... Gawd, Ayaz never accepts until Orin rejects the rare finance ... territory and contact it under its stage. ...
    (sci.crypt)
  • rating aged Abdellah Bin Gularis extension
    ... We utterly secure at last Mike when the secret questions ... Little by little, walkings interview in response to sharp asylums, unless they're ...
    (rec.pyrotechnics)
  • Re: What others are saying about the Case Former CD!
    ... Thanks for the reply Mike. ... > convention sites, which he considered 'unsafe.'. ... > His response to this was to accuse me of deliberately neglecting to attend the ... > announced at both business meetings that I was absent because my mother was ...
    (rec.pyrotechnics)
  • Re: What others are saying about the Case Former CD!
    ... convention sites, which he considered 'unsafe.'. ... His response to this was to accuse me of deliberately neglecting to attend the ... announced at both business meetings that I was absent because my mother was ... Mike ...
    (rec.pyrotechnics)