mad computer problems

[Computer is messed up really bad...]

Alright, I have no idea where these files came from, but
it all started like last weekend... I started up my
computer and after it was done booting up, it said that
it couldn't open up some files all starting with TFTP and
having various numbers at the end such as 1212, 3172,
etc. called... so I disabled it in the startup... Then I
realized that I didn't System Scan on Norton for a
while... and it found me a virus.. a W32.Spybot.Worm and
it was infected on the file explorer.exe located in
C:/Windows/System32 ... so I decided to delete it Then
my computer started messing up really bad... I noticed a
ntelnet.exe on my msconfig in startup... So I disabled
that too and then my computer wouldn't finish rebooting,
so I ctrl+alt+delete and found that ntelnet was
running... so I ended the process and it finished booting
up, now I can't even disable it because it keeps coming
back... and msconfig automatically closes on me... So
hopefully one of you guys knows how to help me.... I
decided to print screen when I opened msconfig-startup
and I found that axbwxzb.exe is running too and after
that, these tftp files keep trying to open themselves,
I've tried scandisk and everything, hopefully this
doens't come to re-formatting again... but if I must... I
guess it's the only way...

[SunSpot]

"Computer is messed up really bad..." > wrote in
message ...
> Alright, I have no idea where these files came from, but
> it all started like last weekend... I started up my
> computer and after it was done booting up, it said that
> it couldn't open up some files all starting with TFTP and
> having various numbers at the end such as 1212, 3172,
> etc. called... so I disabled it in the startup... Then I
> realized that I didn't System Scan on Norton for a
> while... and it found me a virus.. a W32.Spybot.Worm and
> it was infected on the file explorer.exe located in
> C:/Windows/System32 ... so I decided to delete it Then
> my computer started messing up really bad... I noticed a
> ntelnet.exe on my msconfig in startup... So I disabled
> that too and then my computer wouldn't finish rebooting,
> so I ctrl+alt+delete and found that ntelnet was
> running... so I ended the process and it finished booting
> up, now I can't even disable it because it keeps coming
> back... and msconfig automatically closes on me... So
> hopefully one of you guys knows how to help me.... I
> decided to print screen when I opened msconfig-startup
> and I found that axbwxzb.exe is running too and after
> that, these tftp files keep trying to open themselves,
> I've tried scandisk and everything, hopefully this
> doens't come to re-formatting again... but if I must... I
> guess it's the only way...


Re-boot into safemode and disable the startup items there, (you should be
able to run msconfig in safemode) then remove or rename the files to stop
them from re-adding themselves. Reboot and run a virus scan again.

[Chek]

If you have Norton go to their website for detailed instructions on removing
the worm - its quite an involved process to thoroughly clean out (it may be
hiding in temp files and in some of your Restore Point backups too). Follow
the instructions in the suggested order.
Also consider setting your AV to auto start on boot up so it can do a boot
scan as well.
If you have it, you may as well use it fully.
Chek.

"SunSpot" > wrote in message
...
>
> "Computer is messed up really bad..." > wrote in
> message ...
> > Alright, I have no idea where these files came from, but
> > it all started like last weekend... I started up my
> > computer and after it was done booting up, it said that
> > it couldn't open up some files all starting with TFTP and
> > having various numbers at the end such as 1212, 3172,
> > etc. called... so I disabled it in the startup... Then I
> > realized that I didn't System Scan on Norton for a
> > while... and it found me a virus.. a W32.Spybot.Worm and
> > it was infected on the file explorer.exe located in
> > C:/Windows/System32 ... so I decided to delete it Then
> > my computer started messing up really bad... I noticed a
> > ntelnet.exe on my msconfig in startup... So I disabled
> > that too and then my computer wouldn't finish rebooting,
> > so I ctrl+alt+delete and found that ntelnet was
> > running... so I ended the process and it finished booting
> > up, now I can't even disable it because it keeps coming
> > back... and msconfig automatically closes on me... So
> > hopefully one of you guys knows how to help me.... I
> > decided to print screen when I opened msconfig-startup
> > and I found that axbwxzb.exe is running too and after
> > that, these tftp files keep trying to open themselves,
> > I've tried scandisk and everything, hopefully this
> > doens't come to re-formatting again... but if I must... I
> > guess it's the only way...
>
>
> Re-boot into safemode and disable the startup items there, (you should be
> able to run msconfig in safemode) then remove or rename the files to stop
> them from re-adding themselves. Reboot and run a virus scan again.
>
>

[GregH]

I found that this tftp#### file problem appeared at exactly the same
time as the LoveSan/Blaster worm appeared on a friend's computer (by
checking the properties of the files). One property of this
W32.Spybot.Worm is that it can be used in denial of service attacks
which is purported to be a feature of the Lovesan/Blaster worm.
Perhaps we're experiencing a new variant. I was able to remove
Lovesan/Blaster but I have yet been able to get rid of this tftp####
critter.

I did notice that it has an association with the hidden folder
c:\windows\pss.

Still, I delete it there and in the registry and msconfig but it keeps
reappearing. Norton found nothing even with updated definitions. A new
variant could explain that but so could a few other things I haven't
tried yet.

Any insight as to what is going on would be appreciated.


"Chek" > wrote in message >...
> If you have Norton go to their website for detailed instructions on removing
> the worm - its quite an involved process to thoroughly clean out (it may be
> hiding in temp files and in some of your Restore Point backups too). Follow
> the instructions in the suggested order.
> Also consider setting your AV to auto start on boot up so it can do a boot
> scan as well.
> If you have it, you may as well use it fully.
> Chek.
>
> "SunSpot" > wrote in message
> ...
> >
> > "Computer is messed up really bad..." > wrote in
> > message ...
> > > Alright, I have no idea where these files came from, but
> > > it all started like last weekend... I started up my
> > > computer and after it was done booting up, it said that
> > > it couldn't open up some files all starting with TFTP and
> > > having various numbers at the end such as 1212, 3172,
> > > etc. called... so I disabled it in the startup... Then I
> > > realized that I didn't System Scan on Norton for a
> > > while... and it found me a virus.. a W32.Spybot.Worm and
> > > it was infected on the file explorer.exe located in
> > > C:/Windows/System32 ... so I decided to delete it Then
> > > my computer started messing up really bad... I noticed a
> > > ntelnet.exe on my msconfig in startup... So I disabled
> > > that too and then my computer wouldn't finish rebooting,
> > > so I ctrl+alt+delete and found that ntelnet was
> > > running... so I ended the process and it finished booting
> > > up, now I can't even disable it because it keeps coming
> > > back... and msconfig automatically closes on me... So
> > > hopefully one of you guys knows how to help me.... I
> > > decided to print screen when I opened msconfig-startup
> > > and I found that axbwxzb.exe is running too and after
> > > that, these tftp files keep trying to open themselves,
> > > I've tried scandisk and everything, hopefully this
> > > doens't come to re-formatting again... but if I must... I
> > > guess it's the only way...
> >
> >
> > Re-boot into safemode and disable the startup items there, (you should be
> > able to run msconfig in safemode) then remove or rename the files to stop
> > them from re-adding themselves. Reboot and run a virus scan again.
> >
> >