TFTP#### virus, spybot worm..?

[tlinden14]

Hello,
I have a machine that is running Norton and is up to date with microsoft updates. It is windows 2000, SP4 and have ran system scans several times with Norton. The anti-virus software keeps popping up that it detects and deletes a w32.spybot.worm in the system 32 folder. It shows up as TFTP1568, TFTP1656, etc, etc. All Starting with TFTP then 4 numbers.
I deleted a bling.exe out of the registry and have not found anything else that looks suspicious. It continues to pop up as being detected every 5 - 10 minutes and extremely disruptive. Any ideas how to permanently get rid of it?

Thankssssssss

"A grizzly bear with a chainsaw, now that's a killing machine!" - Homer Simpson

 

[carrr]

Have yo ran through this yet?

http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[carrr]

On second thought, you might find this more helpful:

http://www.experts-exchange.com/Applications/Viruses/Q_20777095.html

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[bfralia]

If you're on a network or have an internet connection without some kind of firewall. Spybot has a point to point component meaning an infected computer will send itself across a network or the internet looking for unsecured shares.

All this means another computer could have your number and be sending it to you as opposed to an infection on your computer you haven't found.

 

[tlinden14]

I ran a scan with symantec(norton) but it didn't seem to find it...?

"A grizzly bear with a chainsaw, now that's a killing machine!" - Homer Simpson

 

[bfralia]

You didn't find it on your computer because it's probably not the one infected. What you are now seeing is the on access activity where the virus is being detected and blocked as it tries to infect your computer.