Download the
FxNetsky.exe file from: http://securityresponse.symantec.com/avcenter/FxNetsky.exe.
Save the file to a convenient location, such as your downloads folder or the Windows desktop, or removable media known to be uninfected.
To check the authenticity of the digital signature, refer to the "Digital signature" section later in this writeup.
Close all the running programs before running the tool.
If you are on a network or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
If you are running Windows Me or XP, then disable System Restore. Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details.
Caution: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
Double-click the FxNetsky.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.
Restart the computer.
Run the removal tool again to ensure that the system is clean.
If you are running Windows Me/XP, then re-enable System Restore.
Run LiveUpdate to make sure that you are using the most current virus definitions.
Note: The removal procedure may not be successful if Windows Me/XP System Restore is not disabled as previously directed, because Windows prevents outside programs from modifying System Restore.
When the tool has finished running, you will see a message indicating whether W32.Netsky@mm infected the computer. In the case of a removal of the worm, the program displays the following results:
Total number of scanned files
Number of deleted files
Number of repaired files
Number of terminated viral processes
Number of fixed registry entries
Digital signature
FxNetsky.exe is digitally signed. Symantec recommends that you use only copies of FxNetsky.exe, which have been directly downloaded from the Symantec Security Response Web site. To check the authenticity of the digital signature, follow these steps:
Go to
http://www.wmsoftware.com/free.htm.
Download and save the chktrust.exe file to the same folder in which you saved FxNetsky.exe (for example, C:\Downloads).
Depending on your operating system, do one of the following:
Click Start, point to Programs, and then click MS-DOS Prompt.
Click Start, point to Programs, click Accessories, and then click Command Prompt.
Change to the folder in which FxNetsky.exe and Chktrust.exe are stored, and then type: chktrust -i FxNetsky.exe.
For example, if you saved the file to the C:\Downloads folder, you would enter the following commands:
cdcd downloads
