Can someone tell me how to remove a worm?

Question

Received notice W32.Stration.DH@mm. States it is in my email. Can someone please explain?

PREVX.COM won't download.This is what comes up HELP! PXSETUP.EXE file is linked to missing export KERNEL32.DLL PROCESS32 NEXTW

Answer 1

Hi there,

Stration is actually a variant of the new "Warezov" Worm:
http://virusinfo.prevx.com/viruscenter.asp?returnpage=default&GRP=4878600015

The best and easiest way to remove this infection is by installing the Free Trial of Prevx1. This will scan your PC and remove this and any other infections free of charge.
http://www.prevx.com

___________________________________________________

As a side note:

I honestly wouldn't waste your time with programs such as AVG, Spybot and Adaware.

The number of people who have AVG, adaware and Spybot installed but then get confused as to why they have been infected is increasing by the day. In all seriousness, these programs (especially spybot and adaware) are no longer good enough to be your only protection against viruses, spyware and adware (as well as trojans, rootkits and other nasties). They used to be great programs a couple of years ago, but have now been overtaken by programs with next-generation approaches.

Everyone thinks AVG is amazing because it's free, but if you take a look at the latest protection figures you will find AVG comes virtually last - a LONG way behind the rest.
http://www.av-comparatives.org/seiten/ergebnisse_2006_08.php

________________________________________________

UPDATE

If you're unable to download Prevx from their website, try Download.com instead:
http://www.download.com/Prevx-1/3000-8022_4-10597754.html?tag=lst-0-1
 

Answer 2

This worm is a bad one. It changes itself while on your computer and that makes it very difficult to remove. It changes faster than some of the Anti-Virus software can update with the definitions needed to remove it. Update your Anti-Virus program and run it using this procedure. If it keeps changing and can't be removed then you might have to resort to a reformat.

I also recommend running AVG Antispyware (old ewido program). You can download it here:

http://www.ewido.net/en/download/

VIRUS and SPYWARE REMOVAL PROCEDURE FOR WINDOWS XP

Removing infections from your computer is never as easy as aquiring them. Malware infections are not meant to be removed, so, it takes TIME and PATIENCE to get rid of them. ONLY RESORT TO A REFORMAT AFTER ALL ELSE FAILS TO REMOVE THE INFECTION.

This procedure works for all Malware. Use any AntiVirus or AntiSpy program you choose.


UPDATE YOUR ANTI-VIRUS PROGRAM.


TEMPORARILY SHOW HIDDEN FILES AND FOLDERS.

1. Click Start, and then click Control Panel.

2. Click Appearance and Themes, and then click Folder Options.

3. On the View tab, under Hidden files and folders, click "Show hidden files and folders", and clear(uncheck) the "Hide protected operating system files" check box.

IMPORTANT: Files are hidden by Windows for a very good reason. It is not wise to experiment with these files. Unfortunately, to successfully remove modern spyware we must turn this protection off temporarily. Please turn the protection back on when you have finished cleaning your system.


EMPTY INTERNET EXPLORER BROWSER CACHE:

1. On the Internet Explorer Tools menu, click Internet Options.

2. On the General tab, in the Temporary Internet Files section, click the Delete Files button. Select the Delete all offline content check box in the confirmation dialogue box that appears, click OK. Click OK again.

RESTART IN SAFE MODE:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.



START THE SCAN WITH YOUR ANTI-VIRUS PROGRAM.


When the scan and removal are completed REBOOT COMPUTER. This will restart you in normal mode. DON'T FORGET TO RESET HIDDEN FILES AND FOLDERS.


NEW RESTORE POINT.

The RESTORE POINTS may be infected with the Malware and cannot be used.

HERE'S HOW:

1. Click Start, and then click Control Panel.

2. Click Performance and Maintenance, click System, and then click on the System Restore tab.

3. Select the Turn Off System Restore check box, click Apply, then restart your computer.

4. Return to the System Restore Tab and turn System Restore back on.


TO SET A NEW RESTORE POINT:

1. Click the Start button.

2. Point to Programs, then navigate to Accessories, then System Tools, then click System Restore.

3. Choose Create a restore point, and then click Next.

4. In the Restore point description box, type a name for your restore point, and then click Next.

5. Click OK.

NOTE: If you are using Windows XP Service Pack 2 (SP2) and are unable to access the Internet after removing Malware, there is a command that may fix the problem. It works by resetting the winsock catalogue. Click on Start, then Run and type CMD in the box. Click OK. Type "netsh winsock reset" (no quotes)into the DOS window that appears.

Answer 3

Try some of these:

Spyware, Adware, Trojans, Malware, Dialers, Keyloggers, Popups:
http://www.download.com/Ad-Aware-SE-Personal-Edition/3003-8022_4-10399602.html?tag=tab_rev
http://www.ewido.net/en/download/
http://www.javacoolsoftware.com/spywareblaster.html
http://www.download.com/Bazooka-Adware-and-Spyware-Scanner/3000-8022-10247782.html
http://www.javacoolsoftware.com/sgdownload.html
http://www.safer-networking.org/
http://www.download.com/HijackThis/3000-8022_4-10379544.html
http://www.emsisoft.com/en/software/download/
Online Scanners:
http://www.webroot.com/consumer/products/spysweeper/freescan.html?
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
http://www.pandasoftware.com/products/activescan.htm
http://www.bitdefender.com/scan8/ie.html
http://www.windowsecurity.com/trojanscan/
http://www.kaspersky.com/virusscanner
http://www.spywareguide.com/onlinescan.php
http://housecall65.trendmicro.com/
Spyware, Adware, Trojans, Malware, Dialers, Keyloggers, Popups Lists:
http://www.softpedia.com/catList/104
http://www.download.com/Adware-Spyware-Removal/3150-8022_4-0.html?tag=dir
http://www.majorgeeks.com/downloads31.html
http://www.filehippo.com/software/antispyware/setarea
http://www.soft32.com/s/Windows/Security/AntiSpyware/3-9-0-0.html
Antivirus:
http://free.grisoft.com/doc/avg-anti-virus-free/lng/us/tpl/v5
http://www.avast.com/
http://www.free-av.com/
http://www.bitdefender.com/PRODUCT-14-en--BitDefender-8-Free-Edition.html
Antivirus Lists:
http://www.softpedia.com/catList/1
http://www.download.com/Antivirus/3150-2239_4-0.html?tag=dir
http://www.majorgeeks.com/downloads29.html
http://www.filehippo.com/software/antivirus/
http://www.soft32.com/s/Windows/Security/Antivirus/3-1-0-0.html
Firewall:
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?dc=12bms&ctry=US&lang=en&lid=staticcomp_za
Firewall Lists:
http://www.softpedia.com/catList/97
http://www.download.com/Firewalls/3150-10435_4-0.html?tag=dir
http://www.majorgeeks.com/downloads34.html
http://www.filehippo.com/software/firewalls/
http://www.soft32.com/s/Windows/Security/Firewalls/3-5-0-0.html
IP Blocker:
http://prdownloads.sourceforge.net/peerguardian/pg2-050918-nt.exe?download
Browser:
http://www.mozilla.com/firefox/
Email, News, RSS:
http://www.mozilla.com/thunderbird/
System Cleaner:
http://www.ccleaner.com/
System Cleaning List:
http://www.softpedia.com/catList/98
http://www.majorgeeks.com/downloads12.html
http://www.filehippo.com/software/cleaning/
System Info:
http://www.softpedia.com/catList/92
http://www.majorgeeks.com/downloads9.html
http://www.soft32.com/s/Windows/System_Utilities/System_Tools/3-50-0-0.html

Answer 4

I agree with Secure Expert.This is win32 stuff and this link will get it gone Good Luck

Answer 5

Try running some virus scans, there's a good list here if you need it.
http://www.basicspywaretips.com/getridofspyware.html

Answer 6

install norton antivirus program or use trend microsystem program i refer second option