Win32.ceBot
Title: Win32.ceBot
Also Known as: E-mail-Worm.Win32.NetSky.a [Kaspersky Lab]
Severity scale:
Win32.ceBot is a backdoor Trojan with a variety of alias and mutant variations. It is impossible to know where the spyware is from but it is speculated that it comes from Germany, Russia, or Macedonia.
Backdoor Trojans exploit security weakness and give attackers unauthorized access to infected computers. Once an infection is detected, immediate removal is recommended.
Threat
Win32.ceBot
Alias
E-mail-Worm.Win32.NetSky.a [Kaspersky Lab]
W32/Netsky-A [Sophos]
I-Worm.Netsky.A [PC Tools]
E-mail-Worm.Win32.NetSky.A [Ikarus]
WORM_NETSKY.GEN [Trend Micro]
E-mail-Worm.NetSky!sd5 [PC Tools]
W32/Netsky.a@MM [McAfee]
Worm:Win32/Netsky.A@mm [Microsoft]
Mal/Behav-285 [Sophos]
Win32/Netsky.worm.43180 [AhnLab]
Worm:Win32/Pushbot.gen!C [Microsoft]
Generic.dx [McAfee]
Worm.Win32.AutoRun.qea [Kaspersky Lab]
Email-Worm.Netsky!sd6 [PC Tools]
W32/Sdbot.worm.gen.ci [McAfee]
WORM_SDBOT.GAV [Trend Micro]
Mal/Generic-A [Sophos]
Packed.Win32.Black [Ikarus]
Packed.Win32.Black.a [Kaspersky Lab]
Trojan:Win32/Ircbrute [Microsoft]
Virus.Win32.Agent.WOW [Ikarus]
Virus.Win32.IRCBot.BSX [Ikarus]
W32/Feebs!rootkit [McAfee]
W32/Sdbot.worm [McAfee]
Win32.Worm.Slenfbot.X [Ikarus]
Win32/IRCBot.worm.variant [AhnLab]
Worm.Feebs!sd5 [PC Tools]
Backdoor.Bifrose [PC Tools]
Backdoor.VB.GEN [PC Tools]
Backdoor.Win32.ceBot.b [Kaspersky Lab]
Backdoor.Win32.IRCBot.gen [Kaspersky Lab]
Backdoor.Win32.SdBot.dqh [Kaspersky Lab]
Email-Worm.Win32.NetSky [Ikarus]
Mal/CryptBox-A [Sophos]
Mal/EncPk-BW, W32/Feebs-Gen [Sophos]
Mal/TinyDL-T, Mal/Behav-024, Mal/Heuri-E, Mal/Heuri-D, Mal/Behav-027, Mal/Behav-010 [Sophos]
Trojan.Win32.VB.klk [Kaspersky Lab]
Trojan:Win32/Vake.B [Microsoft]
Trojan-Spy.Banker.GEN [PC Tools]
W32/Generic.b.worm [McAfee]
W32/Netsky.gen@MM [McAfee]
Worm.Win32.AutoRun [Ikarus]
Worm.Win32.Feebs.AF [Ikarus]
Backdoor.DsBot.A [PC Tools]
Backdoor.IRCBot!ct [PC Tools]
Backdoor.IRCBot!sd6 [PC Tools]
Backdoor.Win32.Bifrose [Ikarus]
Backdoor.Win32.ceBot [Ikarus]
Backdoor.Win32.ceBot.c [Kaspersky Lab]
Backdoor.Win32.IRCBot.alo [Kaspersky Lab]
Backdoor.Win32.IRCBot.and [Kaspersky Lab]
Backdoor.Win32.IRCBot.dxu [Kaspersky Lab]
Backdoor.Win32.SdBot.miz [Kaspersky Lab]
BehavesLikeWin32.ExplorerHijack [Ikarus]
BKDR_SDBOT.BPX [Trend Micro]
Email-Worm.Win32.NetSky.iq [Kaspersky Lab]
Email-Worm.Win32.NetSky.t [Kaspersky Lab
Email-Worm.Win32.NetSky.z [Kaspersky Lab]
Generic Dropper [McAfee]
Generic.Sdbot [Ikarus]
Mal/EncPk-EY [Sophos]
Mal/IRCBot-B, Mal/SillyFDC-A [Sophos]
Mal/Packer, Mal/EncPk-BW [Sophos]
Mal/ProcInj-Fam [Sophos]
Mal/TinyDL-T, Mal/Behav-024, Mal/Behav-027, Mal/Behav-010 [Sophos]
Mal_Banker [Trend Micro]
New Malware.dq [McAfee]
Packer.Expressor [Ikarus]
PWS-Banker [McAfee]
Trojan.Win32.Agent.ayfa [Kaspersky Lab]
Trojan.Win32.Buzus.hjz [Kaspersky Lab]
Trojan.Win32.Meredrop [Ikarus]
Trojan.Win32.Vake [Ikarus]
Trojan:Win32/Meredrop [Microsoft]
Trojan:Win32/SystemHijack.gen!C [Microsoft]
VirTool:Win32/DelfInject.gen!L [Microsoft]
Virus.Win32.Bifrose [Ikarus]
Virus.Win32.IRCBot [Ikarus]
W32/AutoRun-MT [Sophos]
W32/Checkout [McAfee]
W32/Feebs.gen [McAfee]
W32/Feebs-Fam, Mal/Behav-010, Mal/Packer, Mal/EncPk-BW, W32/Feebs-Gen [Sophos]
W32/Netsky [McAfee]
W32/Netsky-T [Sophos]
W32/Opanki.worm.gen [McAfee]
W32/Sdbot.worm.gen.a [McAfee
W32/Spybot.worm.gen [McAfee]
Win32/ExprPacked.suspicious [AhnLab]
Win-Trojan/Agent.157696.AB [AhnLab]
Win-Trojan/Agent.420864.J [AhnLab
Win-Trojan/AutoRun.126464 [AhnLab]
Win-Trojan/Black.379904 [AhnLab]
Win-Trojan/Black.446976 [AhnLab]
Win-Trojan/Siybdld.53248 [AhnLab]
Worm.Feebs.BH [PC Tools]
Worm.Feebs.BK [PC Tools]
Worm.SdBot.ABOO [PC Tools]
Worm.SdBot.ABRD [PC Tools]
Worm.Win32.AutoRun.adfr [Kaspersky Lab]
Worm.Win32.AutoRun.afhl [Kaspersky Lab]
Related Files
%AppData%\shieldmanager.exe %System%\defender.exe %System%\dllcache\spoolms.exe %System%\jushed.exe %System%\mcmhndrsv.exe %System%\msjg32.dll %System%\msnupnp.exe %System%\msoo.exe %System%\msru32.dll %System%\msus32.dll %System%\mswj32.dll %System%\nmvcs.exe %System%\symrestore.exe %System%\vmcthlp.exe %System%\winhost32.exe %System%\winservces.exe %Temp%\ixp000.tmp\svchost.exe %Windir%\appdata32.exe %Windir%\game.exe %Windir%\iexplorer.exe %Windir%\ituneshelp.exe %Windir%\ky0vr.exe %Windir%\msagent\svhost.exe %Windir%\msnexec.exe %Windir%\msnmsgr.exe %Windir%\msnsrv.exe %Windir%\nero3.exe %Windir%\new.exe %Windir%\pchealth\helpctr\binaries\system.exe %Windir%\rvnant.exe %Windir%\scvrun.exe %Windir%\services.exe %Windir%\svchost.exe %Windir%\svchoste.exe %Windir%\wcsrss.exe %Windir%\wkssvr.exe %Windir%\wkssvrs.exe %Windir%\wkssxr.exe
Removal
SpyZooka removes 100% of spyware guaranteed. Click the button below to start your free scan.
Just a quick word to say thanks. After trying unsuccessfully to remove some stubborn trojans with various other tools, Exterminate It has done the trick!
After scanning my computer many times using big name anti-virus and malware programs I still had several problems. Finally SpyZooka found multiple infections from NetSky. I sent It a sample and the next day I received an e-mail instructing me to update and rescan. After following the instructions ZAP the worm/trojan was gone. My computer seems to be completely back to normal now.