PCTech Forums

You have been infected by the W32.Chod.D worm virus.
If you have an anti-virus program it most likely been disabled by the worm.

You should not have any open windows when you are following the procedures below.

First we will need to fix your Hosts file so you can do an online virus scan.
Start HijackThis and click the Open the misc tools section now click Open hosts file manager.
You will need to remove the following lines from the hosts file:
127.0.0.1 avp.com
127.0.0.1 www.avp.com
127.0.0.1 ca.com
127.0.0.1 dispatch.mcafee.com
127.0.0.1 download.mcafee.com
127.0.0.1 f-secure.com
127.0.0.1 fastclick.net
127.0.0.1 ftp.f-secure.com
127.0.0.1 ftp.sophos.com
127.0.0.1 liveupdate.symantec.com
127.0.0.1 customer.symantec.com
127.0.0.1 rads.mcafee.com
127.0.0.1 mast.mcafee.com
127.0.0.1 mcafee.com
127.0.0.1 my-etrust.com
127.0.0.1 nai.com
127.0.0.1 networkassociates.com
127.0.0.1 secure.nai.com
127.0.0.1 securityresponse.symantec.com
127.0.0.1 service1.symantec.com
127.0.0.1 sophos.com
127.0.0.1 support.microsoft.com
127.0.0.1 symantec.com
127.0.0.1 update.symantec.com
127.0.0.1 updates.symantec.com
127.0.0.1 us.mcafee.com
127.0.0.1 vil.nai.com
127.0.0.1 viruslist.com
127.0.0.1 www.viruslist.com
127.0.0.1 www.awaps.net
127.0.0.1 www.ca.com
127.0.0.1 www.f-secure.com
127.0.0.1 www.fastclick.net
127.0.0.1 www.mcafee.com
127.0.0.1 www.microsoft.com
127.0.0.1 www.my-etrust.com
127.0.0.1 www.nai.com
127.0.0.1 www.networkassociates.com
127.0.0.1 www.sophos.com
127.0.0.1 www.symantec.com
127.0.0.1 www3.ca.com
127.0.0.1 www.grisoft.com
127.0.0.1 grisoft.com
127.0.0.1 housecall.trendmicro.com
127.0.0.1 trendmicro.com
127.0.0.1 www.trendmicro.com
127.0.0.1 www.pandasoftware.com
127.0.0.1 pandasoftware.com
127.0.0.1 kaspersky.com
127.0.0.1 www.kaspersky.com
127.0.0.1 www.zonelabs.com
127.0.0.1 zonelabs.com
127.0.0.1 www.spywareinfo.com
127.0.0.1 spywareinfo.com
127.0.0.1 www.merijn.org
127.0.0.1 merijn.org

Exit Hijackthis you should now be able to do an online virus scan at :

The alternative would be to download this is a trial version of the program.
Install ewido security suite and update ewido to the latest definition files.
Once the updates are installed do the following:
Click on scanner, click on Complete System Scan and the scan will begin.
NOTE: During some scans with ewido it can find false positives.**
You will need to step through the process of cleaning files one-by-one.
If ewido detects a file you KNOW to be legitimate, select none as the action.
DO NOT select "Perform action on all infections"

The files you need to have ewido fix are:
C:\WINDOWS\system32\rgkwpk\csrss.exe
C:\WINDOWS\system32\rgkwpk\csrss.dat
C:\WINDOWS\system32\rgkwpk\csrss.ini

Once ewido is finished empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.[/b]

Thank you for your thorough response, Gecko. But as I stated before, HijackThis closes itself. Oddly enough, the HijackThis log seems to close itself as well. It seems that anything that is in the same directory as the executable falls victim of its symptoms as well.

I'm going to try this though; http://securityresponse.symantec.com/av ... structions

Also, you have a dead-aim when it comes to spotting these things. I ran a virus software last night and it found, and "apparently" removed it. I'm going to follow this tutorial though. I'll get back to you if anything happens before you can respond.

Not sure if you'll be able to run this, but it's worth a shot. They have a program that removes all known AIM viruses.

http://www.softpedia.com/get/Antivirus/AIM-Fix.shtml

Well, all the virus symptoms are now gone. The link I pasted helped me.

But my AIM is still dying, due to an unrelated problem.

I have re-installed the most reason of AIM from aim.com several times, but upon launching it(since it is the first time), this prompt box comes up.

And that prompt box freezes, so I cannot click yes or no.
Ii've also tried setting my default IM'ing service in my control panel to AIM, but I guess AOL doesn't use Windows standards, because they're shitty.