W32.Spybot.worm - what is it?

[PhilliePhan]

Thanks for the help. As you instructed I downloaded the new update for Java and removed the old program. Also downloaded the ATF cleaner and ran it.

I couldn't find the nig24.dll file in the system folder and I did a search that turned up nothing. I've been running more scans from other programs, so maybe one of them found this file and deleted it. Anyway, here is my new HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 9:42:38 PM, on 8/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

O4 - HKLM\..\Run: [WinDLL (nig24.dll)] "rundll32.exe" C:\WINDOWS\system32\nig24.dll,start

Hi Joan,

Interestingly enough, that new Java update is not the latest version . . . It is odd. The current version is Java Runtime Environment (JRE) 5.0 Update 8. I wonder why they reverted back to Update 6? I updated a couple days ago at the same site and got Update 8 . . .

At any rate, be advised that the current Update is 8 and you can get that here-->J2SE(TM) Runtime Environment 5.0 Update 8
You may wish to wait a few days and see how things shake out - Just remember to do it

As for C:\WINDOWS\system32\nig24.dll, it is still showing in your HJT log. I do not know what it is, but it could well be a baddie. Try looking for it again and make sure that you have enabled the viewing of hidden files.
I am a little hesitant to try to delete it without knowing what it is . . . . .

-- Can you run a scan with your Spy Sweeper and attach the log? Make sure it is up to date with its definitions first.
-- Also, can you copy the log from SpyBot showing the initial problem? I'd like a look at that, too.

nig24.dll is the only thing that really jumps out at me as a possible problem. Of course, there are a number of things that HJT does not see and we can look further if need be. For now, just do tha above and we'll go from there.

* I see Judy has checked in - I'll get out of the way now

PP