Worms

[GHOST]

I moved in with a friend and let him use a machine-but it has to fold! Checked it today and no output for a day and a half. did an online scan (trend micro) and found spybot and agobot worms. Task manager said svchost.exe was using all the power. Found and removed a svchost.exe and winhlp file. Somehow a Datemanager app and Precisiontime app were installed and I removed these too.

He uses yahoo messenger and msnmessenger- can these worms be picked up through these? I installed norton internet security to prevent more:trash: .

In the last month I have been getting these grey popups as soon as I connect to internet. Not even opening browser and surfing. just connecting. I got a new laptop yesterday and as soon as I connected I got a popup. Never got these 'till a month ago, get them on my cable and his dsl. My new machine could not have had malware/ whatever on it so surprised me to get popup immediately.:dunno:

[willy1]

Sounds like possibly the nachi worm or one of the other RPC DCOM exploits. It will infect unprotected W2K or XP machines on the same network almost instantly, without your having to do anything. :scared:

Need to install the Windows critical updates for the exploits, reboot !!, then use McAfee stinger or another virus tool to remove the worm.

Here is some information (http://vil.nai.com/vil/content/v_100559.htm)