Win32.worm.vb.npm Problem

dadou131988
dadou131988
in Malware talk

Hello, my computer seems to be infected by the Win32.Worm.VB.NPM virus since like the 16th of December, only i didnt know it at the time. Now that i look back i remember how i got it. It was


through my friend's USB card. When he put it in my PC, i got the message "New material detected". like and idiot, i pressed next, and i think thats how i got infected.


Now Bit defender finds the virus everytime i scan, and delets it. This is what he puts in the log : C:\Autorun.inf Win32.Worm.VB.NPM


C:\WINDOWS....\System.exe


C:\WINDOWS....\Svchost.exe


D:\Autorun.inf


and yes, my own USB card is infected: G:\Autorun.inf


Now, i tried everyting, antivirus, spyware removals, and i even reformated my PC 3 times, and everytime it comes back


Bit Defender is the only one who caught this virus, but why can't it remove it completely ?


Is there something i should do ? please help me

«1

Comments

  • smeker
    smeker

    hello,


    As you said, the usb card is also infected. Please rescan your computer and usb card also so that the virus will be removed from there too.


    Please delete all autorun.inf files from the root of your every drive.


    If the infection persists a removal tool will be provided.


    Thank you!


    Hello, my computer seems to be infected by the Win32.Worm.VB.NPM virus since like the 16th of December, only i didnt know it at the time. Now that i look back i remember how i got it. It was


    through my friend's USB card. When he put it in my PC, i got the message "New material detected". like and idiot, i pressed next, and i think thats how i got infected.


    Now Bit defender finds the virus everytime i scan, and delets it. This is what he puts in the log : C:\Autorun.inf Win32.Worm.VB.NPM


    C:\WINDOWS....\System.exe


    C:\WINDOWS....\Svchost.exe


    D:\Autorun.inf


    and yes, my own USB card is infected: G:\Autorun.inf


    Now, i tried everyting, antivirus, spyware removals, and i even reformated my PC 3 times, and everytime it comes back


    Bit Defender is the only one who caught this virus, but why can't it remove it completely ?


    Is there something i should do ? please help me

  • dadou131988
    dadou131988
    hello,


    As you said, the usb card is also infected. Please rescan your computer and usb card also so that the virus will be removed from there too.


    Please delete all autorun.inf files from the root of your every drive.


    If the infection persists a removal tool will be provided.


    Thank you!


    I have scanned both drives and the USB 3 times, the virus doesnt even show there anymore, its always "No threats detected", and yet everytime i open my drives, Bit Defender deletes the virus again and again. It never goes away, as for the Autorun.inf files, i've looked everywhere even the hidden files, i never seem to see it, its like its invisible :(


    If you have a way for me to fix this, please tell me


    Thank you

  • smeker
    smeker

    Please tell me the exact location of the detected files so I can make a removal tool for them.


    I have scanned both drives and the USB 3 times, the virus doesnt even show there anymore, its always "No threats detected", and yet everytime i open my drives, Bit Defender deletes the virus again and again. It never goes away, as for the Autorun.inf files, i've looked everywhere even the hidden files, i never seem to see it, its like its invisible :(


    If you have a way for me to fix this, please tell me


    Thank you

  • dadou131988
    dadou131988
    Please tell me the exact location of the detected files so I can make a removal tool for them.


    Okay, here are the exact locations of the infected files that are always deleted and come back


    C:\Autorun.inf


    C:\WINDOWS\Config\System.exe


    C:\WINDOWS\Config\Svchost.exe


    D:\Autorun.inf


    G:\Autorun.inf (USB card)


    Also, this virus is making my PC slower, laggy, and consistently blocks my mouse ><


    Thank you for youre help

  • dadou131988
    dadou131988
    Okay, here are the exact locations of the infected files that are always deleted and come back


    C:\Autorun.inf


    C:\WINDOWS\Config\System.exe


    C:\WINDOWS\Config\Svchost.exe


    D:\Autorun.inf


    G:\Autorun.inf (USB card)


    Also, this virus is making my PC slower, laggy, and consistently blocks my mouse ><


    Thank you for youre help


    Oh, and add: C:\System Volume Information\_restore{B0D22BE2-A227-4068-A48A-E6B79217B4BA}\RP26\A0006306.EXE


    Which has been just caught by BitDefender and moved to Quarantone, thank you

  • alexcrist
    alexcrist ✭

    Hello dadou,


    If the virus still comes back after you delete it, it means it has another component that is not yet detected.


    Follow theses steps:


    - disable BD Realtime Protection


    - find a Autorun.inf file (that is reported as infected) and put it in a ZIP archive (with the password infected)


    - re-enable BD Realtime Protection (it will again detect the threats...let it delete them)


    - attach the ZIP to your next post. Hopefully, that file contains the path to the component that resurrects in infection everytime.


    Cris.

  • dadou131988
    dadou131988
    Hello dadou,


    If the virus still comes back after you delete it, it means it has another component that is not yet detected.


    Follow theses steps:


    - disable BD Realtime Protection


    - find a Autorun.inf file (that is reported as infected) and put it in a ZIP archive (with the password infected)


    - re-enable BD Realtime Protection (it will again detect the threats...let it delete them)


    - attach the ZIP to your next post. Hopefully, that file contains the path to the component that resurrects in infection everytime.


    Cris.


    Thank you for youre words Cris, unfortunatly, the Autorun.inf files appear to be invisible,and i don't mean as hidden files. I can't find them anywhere.

  • dadou131988
    dadou131988
    Thank you for youre words Cris, unfortunatly, the Autorun.inf files appear to be invisible,and i don't mean as hidden files. I can't find them anywhere.


    Ok, i've got updates. I did it like you told me Cris, and i deactivated BD, rebooted and entered C:\


    This is the only Autorun.inf i've found and i doubt this is the one


    And i got some news on the virus. If i open my directories without deleting the virus with BD, the hidden autorun.inf file will activate, and create a new folder :


    C:\Recycled\INFO.EXE


    When it does, i am forbidden of entering either C:\ or D:\


    That is one nasty piece of trash


    But BD fixed it by quarantining all those files again when i rebooted


    Anyway, i upleaded the ziped autorun.inf file (wich i believe is not the one)

    /applications/core/interface/file/attachment.php?id=1297" data-fileid="1297" rel="">autorun.zip

  • alexcrist
    alexcrist ✭

    I checked the file you attached. Unfortunately, it is far too complex and I don't have the knowledge to correctly analyze it, so you'll have to wait for a Virus Analyst's response about it.


    About the C:\Recycled\INFO.EXE file: is it detected by BD as infected? If it isn't, please attach it.


    Cris.

  • dadou131988
    dadou131988
    I checked the file you attached. Unfortunately, it is far too complex and I don't have the knowledge to correctly analyze it, so you'll have to wait for a Virus Analyst's response about it.


    About the C:\Recycled\INFO.EXE file: is it detected by BD as infected? If it isn't, please attach it.


    Cris.


    Hmm, too bad, about the file.


    But about C:\Recycled\INFO.EXE, if the file is not deleted, then i cant access my drive. So it's either there and i cant do anything bout it, or deleted

  • alexcrist
    alexcrist ✭

    You can access the drive by right-clicking on it, and selecting Explore.


    Cris.

  • dadou131988
    dadou131988
    You can access the drive by right-clicking on it, and selecting Explore.


    Cris.


    Looked for the file, but its invisible, and minuts after it reboots, i cant access my drives anymore, and i cant even explore


    I get the interface for choosing a program from the list to be able to read my drives :S


    Got any more ideas?


    and tks for all youre help

  • phanthom
    phanthom
    edited January 2008

    I made a removal tool that should solve all your problems with this virus. Check out the attached archive


    Later edit: Only virus researchers can download files from this forum to prevent accidental infections (since most of the posted files are infected). If you need this removal tool, please send a Personal Message to a virus researcher.

    /applications/core/interface/file/attachment.php?id=1313" data-fileid="1313" rel="">Anti_Win32.Worm.VB.NPM_EN.zip

  • dadou131988
    dadou131988
    I made a removal tool that should solve all your problems with this virus. Check out the attached archive


    Thanks a lot man, but i can't download it, it sais i'm not allowed, what gives ?

  • dadou131988
    dadou131988
    Thanks a lot man, but i can't download it, it sais i'm not allowed, what gives ?


    I can't download the file, is there something i should do first ?

  • phanthom
    phanthom

    Give me your email address. I will email it to you personally!


    I can't download the file, is there something i should do first ?
  • dadou131988
    dadou131988
    edited January 2008
    Give me your email address. I will email it to you personally!


    Thank you : dadou_thirteen@hotmail.fr


    Thanks a lot for all your help Mihai

  • dadou131988
    dadou131988
    I can't download the file, is there something i should do first ?


    I managed to dowload it and it worked wonders.


    My PC is finally clean.


    Thanks a lot Mihai for everything :D

  • phanthom
    phanthom

    You are quite welcome :D


    I managed to dowload it and it worked wonders.


    My PC is finally clean.


    Thanks a lot Mihai for everything :D

  • sheepi
    sheepi

    I need it too... :wacko:


    Could you email it to me?


    pepper_shroom@yahoo.com

  • Unknown
    Unknown

    Hello lostsoul,


    I downloaded the removal tool from one of the previous posts and I e-mailed it to you.


    Have a nice day!


    I need it too... :wacko:


    Could you email it to me?


    pepper_shroom@yahoo.com

  • sheepi
    sheepi

    Hi, I made a mistake with my email. Do you mind if you could send me again?


    So sorry, and thanks for the trouble.


    pepper_shroom@yahoo.com.sg

  • Unknown
    Unknown

    I resent the tool. I hope that now you received it.


    Hi, I made a mistake with my email. Do you mind if you could send me again?


    So sorry, and thanks for the trouble.


    pepper_shroom@yahoo.com.sg

  • sheepi
    sheepi

    I am sorry, but did you left out the attachment?

  • Unknown
    Unknown

    Mail resent, with attachment this time


    I am sorry, but did you left out the attachment?
  • sheepi
    sheepi

    Thanks a lot people. I got the file and it works perfectly. Extremely grateful. Thanks for the help!!

  • agstark
    agstark

    I have the same pb and can't download the file either


    Could you email it to me too?


    (ag_stark@yahoo.fr)

  • Unknown
    Unknown

    Hello cyberag,


    I sent you the tool.


    Have a nice day!


    I have the same pb and can't download the file either


    Could you email it to me too?


    (ag_stark@yahoo.fr)

  • agstark
    agstark

    thank you so much!


    it worked wonderfully and my PC is clean!

  • hasano
    hasano

    Hey guys...I'm also having this problem. I only bought this USB drive (HP personal media drive 500gig) a few weeks ago...


    I just don't understand, does the USB drive come packaged with a trojan? Or did it get it from my pc?


    Well anywho, I did a system restore the first time i got it and the trojan was gone, but now its just annoying. It activates everytime I want to access my USB drive. So, I was wondering if you kind people here at BitDefender could send me that wonderful tool of yours to help me with my situation?


    My email is at: kathyl30@hotmail.com


    Thank you very much!!

  • phanthom
    phanthom

    I've sent the removal to the specified address

  • ayumiayumi
    ayumiayumi

    i have the same pb and can't download the file either


    Could you email it to me too?


    (dots.dot_@hotmail.com)


    thanks.=)

  • Unknown
    Unknown

    Hello,


    I am going to e-mail it to you in a few minutes.

  • SICKY
    SICKY

    Hi, I have the same problem. Could someone send me the removal tool PLEASE!


    edwin6_2000@yahoo.com

  • ayumiayumi
    ayumiayumi

    is Win32.worm.vb.npm same as Win32.worm.vb.nrm ? cos i have use the removal . but it seems not working.. and i noticed that the virus is Win32.worm.vb.nrm . can anyone help me ?

  • goldstar10
    goldstar10

    I am sooo relieved to find that others have the same issue with this dreaded worm. Could you please...please email me this removal tool.


    goldstar10@bellsouth.net


    eternally grateful :wub:

  • Unknown
    Unknown

    Hello,


    @goldstar10, @SICKY : I sent you the removal tool.


    @ayumiayumi: The tool works only for Win32.worm.vb.npm. I will try to provide these days a removal tool for your malware, too.

  • SICKY
    SICKY
    edited January 2008

    Problem fixed. Thanks a lot Lirima.

  • b00zer
    b00zer
    edited January 2008
    Hello,


    @goldstar10, @SICKY : I sent you the removal tool.


    @ayumiayumi: The tool works only for Win32.worm.vb.npm. I will try to provide these days a removal tool for your malware, too.


    Dear Lirima,


    Can I also have a copy of the removal tool?


    My email is outer_singapore@hotmail.com


    Thank!

  • Unknown
    Unknown

    Hello to all who read this topic,


    Please don't ask for the removal tool unless you are infected with the Win32.Worm.VB.NPM malware, because it won't clean anything else. It would be only a waste of time for both me and you. If you are really infected with this worm, I will gladly send you the removal.


    Thank you!



    @b00zer: The tool must have arrived in your inbox.

  • jpav
    jpav
    Hello to all who read this topic,


    Please don't ask for the removal tool unless you are infected with the Win32.Worm.VB.NPM malware, because it won't clean anything else. It would be only a waste of time for both me and you. If you are really infected with this worm, I will gladly send you the removal.


    Thank you!



    @b00zer: The tool must have arrived in your inbox.

  • jpav
    jpav
    Hello to all who read this topic,


    Please don't ask for the removal tool unless you are infected with the Win32.Worm.VB.NPM malware, because it won't clean anything else. It would be only a waste of time for both me and you. If you are really infected with this worm, I will gladly send you the removal.


    Thank you!



    @b00zer: The tool must have arrived in your inbox.


    Hello,


    I am infected since early this year with Win32.worm VB.NPM which is now quoted VB.NRM by bitdefender online.


    I have at home 4 PCs with some USB keys and portable disks and it is a big mess.


    I would strongly appreciate if you have the solution and can send me the removal tool (with the process ; in other words how to proceed with my PCs and external support)!!


    Thank you in advance.


    JP

  • jpav
    jpav
    Hello to all who read this topic,


    Please don't ask for the removal tool unless you are infected with the Win32.Worm.VB.NPM malware, because it won't clean anything else. It would be only a waste of time for both me and you. If you are really infected with this worm, I will gladly send you the removal.


    Thank you!



    @b00zer: The tool must have arrived in your inbox.


    sorry i forgot my email adress: jean-pascal.arrou-vignod@wanadoo.fr

  • bkongen
    bkongen
    Hello to all who read this topic,


    Please don't ask for the removal tool unless you are infected with the Win32.Worm.VB.NPM malware, because it won't clean anything else. It would be only a waste of time for both me and you. If you are really infected with this worm, I will gladly send you the removal.


    Thank you!



    @b00zer: The tool must have arrived in your inbox.


    Hello,


    My PC have been infected with this Win32.worm VB.NPM (now quoted VB.NRM by bitdefender online).


    I would strongly appreciate if you have the solution and can send me the removal tool


    Thanks a lot.


    BC


    (My mail is : boldair1999@graffiti.net)

  • dicecan
    dicecan
    Hello to all who read this topic,


    Please don't ask for the removal tool unless you are infected with the Win32.Worm.VB.NPM malware, because it won't clean anything else. It would be only a waste of time for both me and you. If you are really infected with this worm, I will gladly send you the removal.


    Thank you!



    @b00zer: The tool must have arrived in your inbox.


    Hello,


    My PC have also been infected with this Win32.worm VB.NPM (now quoted VB.NRM by bitdefender online).


    If you have the solution, can you send me the removal tool ?


    Thanks a lot,


    dice


    (My mail is : dicecan3@yahoo.fr)

  • Unknown
    Unknown

    The removal tool has been sent to: candice, bkongen and jpav.

  • Barthjr
    Barthjr

    Hello everybody.


    I'm also infected with this malware.


    Can somebody send me the removal tool so I canget rid of this at barthjr@gmail.com?


    thank you in advance


    Barth

  • Unknown
    Unknown

    Hello Barthélémy,


    I have just sent you the tool.

  • flocalifornia@hotmail.com
    flocalifornia@hotmail.com
    The removal tool has been sent to: candice, bkongen and jpav.


    dear lirima,


    my computer is infected by win32.worm.vb.nrm too; can you send me the removal too ?? i'm sorry to disturb you again but it seems that your help is the only way for me to stop the virus... my email address is carvanni@hotmail.fr !


    thanks lirima, see you !!

  • posanios
    posanios
    I need it too... :wacko:


    Could you email it to me?


    pepper_shroom@yahoo.com


    i have the same problem


    please, could you emeil it to me also


    batimob@wanadoo.fr


    dolby

All Time Leaders

Categories

Defenders of the month