Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Virus:W32/Sdbot.ETA.worm (keeps coming back) [CLOSED]

  • This topic is locked This topic is locked



    New Member

  • Member
  • Pip
  • 1 posts
Hi guys, I've registered for a while at g2g but haven't really posted anything, however now I've run into something that I can't handle.

Recently I picked up a pack of infections that just keep coming back no matter what I use to clear them out. I've even found a log file that shows how it downloads itself after I reconnect :tazz: Also after using the computer for some time, many applications will just not respond, especially if I am trying to save files. Hijackthis and regedit and some other programs close the second they open.

Here's the log. It just hung there when I clicked save log so oh well :)

I also ran panda activescan and got this log:
Incident Status Location

Adware:adware/virmaid No disinfected D:\WINDOWS\SYSTEM32\perfcii.ini
Adware:adware/transponder No disinfected D:\WINDOWS\abiuninst.htm
Dialer:dialer.xd No disinfected D:\WINDOWS\switchagreement.txt
Adware:adware/tubby No disinfected Windows Registry
Possible Virus. No disinfected C:\backup-20050220-205730-318.dll
Security Risk:HackTool/Gendel.ANo disinfected C:\gendel32.exe
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\inf\biC.inf
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\inf\biG.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\inf\biini.inf
Adware:Adware/KeenValue No disinfected C:\WINDOWS\system32\setup_incred_8.exe
Virus:W32/Sdbot.ETA.worm Disinfected D:\Documents and Settings\hey man let that go\Local Settings\Temp\1331.tmp
Virus:W32/ImpLinker.A Renamed D:\WINDOWS\Downloaded Program Files\a_exe.vir
Virus:W32/ImpLinker.A Renamed D:\WINDOWS\Downloaded Program Files\CONFLICT.1\a_exe.vir
Dialer:Dialer.Gen No disinfected D:\WINDOWS\switchagreement.txt
Virus:W32/Sdbot.ETA.worm Disinfected D:\WINDOWS\system32\msnzx.exe

The problem is that msnzx and some other files keep coming back, even after I've deleted them. Hopefully someone can help me with this. Thanks in advance! :)
  • 0




    Member 2k

  • Retired Staff
  • 2,744 posts
Hi pringles, welcome to GeeksToGo

Please first save these directions to the desktop as a text file, because you will need to copy and paste part of them later, once we are in Safe Mode.

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2)Please download this virus removal tool to your desktop:


Turn off your antivirus and double click on F-Bot.exe to run the tool. Reboot when done.

3) Upon reboot, boot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.

4) Once in Safe Mode, please run Killbox.

5) Select "Delete on Reboot".

6) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:


7) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

8) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt. If the computer doesn't reboot by itself, reboot manually back to normal mode.

Then try running HijackThis and posting the log. If no success then rename HijackThis.exe
to something else like water.exe and try again.


  • 0



    Member 2k

  • Retired Staff
  • 2,744 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP