Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How to get rid of worm.win32.netsky virus on Windows XP?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

worm.win32.netsky can be removed via the following:

This manual removal method is for techie computer users. Worm.Win32.Netsky manual removal may be difficult and time consuming to remove. There’s no guarantee that Worm.Win32.Netsky will be removed completely. So read the Worm.Win32.Netsky removal steps carefully and good luck.

Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.

  1. Uninstall Worm.Win32.Netsky Program Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall Worm.Win32.Netsky if found.
  2. To stop Worm.Win32.Netsky processes (view process removal steps) Go to Start > Run > type taskmgr. The click the Processes tab and you’ll see a list of running processes. Search and stop these Worm.Win32.Netsky processes: There are no processes. For each unwanted process, right-click on it and then select “End task”.
  3. To Unregister Worm.Win32.Netsky DLLs (view DLL removal steps) Search and unregister these Worm.Win32.Netsky DLLs: There are no dll's.

    To locate the Worm.Win32.Netsky DLL path, go to Start > Search > All Files or Folders. Type Worm.Win32.Netsky and in the Look in: select either My Computer or Local Hard Drives. Click the Search button. Once you have the Worm.Win32.Netsky DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK. To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister).

  4. To unregister Worm.Win32.Netsky registry keys (view registry keys removal steps) Go to Start > Run > type regedit > press OK. Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option. Search and delete these Worm.Win32.Netsky registry keys: There are no registry keys.
  5. If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
  6. Remove Worm.Win32.Netsky Directories. To find Worm.Win32.Netsky directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder. Search and delete the following Worm.Win32.Netsky directories: There are no directories.

    Right-click on the Worm.Win32.Netsky folder and select Delete.

    A message will appear saying ‘Are you sure you want to remove the folder Worm.Win32.Netsky and move all its contents to the Recycle Bin?’, click Yes. Another message will appear saying ‘Renaming, moving or deleting Worm.Win32.Netsky could make some programs not work. Are you sure you want to do this?’, click Yes.

  7. To remove Worm.Win32.Netsky icons on your Desktop, drag and drop them to the Recycle Bin.
share|improve this answer
    
Thank you. I'll try this when I'm back home. Appreciate the response! –  JW. Dec 21 '09 at 16:49
1  
To add, Symantec has come up with an Automated tool symantec.com/security_response/… –  Sathya Dec 21 '09 at 19:57
    
Sathya, add your suggestion as an answer. I'll vote it up. I had to start with this tool because the virus had disabled Task Manager. –  JW. Dec 22 '09 at 2:40
    
JW - added the suggestion as an answer. Were you able to get rid of it ? –  Sathya Dec 27 '09 at 17:38
    
Had to get a friend to fix it. I couldn't quite cut it myself. –  JW. Jan 21 '10 at 6:40
add comment

An automated tool for the same has been developed by Symantec, you can try it out.

share|improve this answer
add comment

As with any virus the only way to be 100% sure is to reformat and reinstall. So while you should try the other approaches outlined here first, be prepared to "go nuclear".

Given that the removal instructions warn:

Also back up your computer in case you make a mistake and your computer stops working.

be prepared for the worst and make sure you have backups of all your data and installs for all your applications before you start.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.