Watch out for Worsock.dll

A

Asha'man X

Expert Member
Joined
Aug 31, 2006
Messages
1,401
Reaction score
23
Location
Cape Town
Hey everyone

My server got infected on Friday with a virus, W32.HLLP.Sality.O, and I'm still nursing the system back up. SpyBot found some stuff about Smitfraud.C, and a few others. There is also an Internet Explorer add on, min stor obj, with a dll called msindc.dll.

I use a network inventory tool called SpiceWorks, and after I got infected the system hasn't run right. Using LSPFix, I discovered Worsock.dll loaded, which according to the scarce information, is a form of malware.

This blight on computers will never end I guess. I'm going to have to keep a close eye on my network now.

Just a warning out to fellow forumites.
 
@ gregmcc

I wasn't browsing the net on the server, just using my Maxthon browser to look at my SpiceWorks inventory. Somwhow that little critter crept through and infected the server. Symantec did pick up the host file and did get rid of it, but by then it had already delivered it's payload.

I've managed to just about clean all traces of it, but I still need to get rid of that worsock file. I've scheduled time tomorrow afternoon to sort it out, and all the staff are happy with the downtime.

It seems another staff member's laptop is also infected with this thing, and I'll be sorting his out a little later today.
 
For what it's worth, I got rid of this with HijackThis and a reboot. Luckily the file didn't appear to do any lasting damage.

I cleaned out SmitFraud on another laptop, but luckily it didn't have this dll file on it.

With the rise in infections coming in on flash drives, I'm tempted to glue the USB ports closed lol :p

Seriously though, one staff member had almost 1500 copies of the Fujacks worms on his 2 flash drives. If that isn't a threat I don't know what is.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X