Hopefully, disabling sharing of the folders/drives will prevent the worm files from being created. The worm has obviously been on the network if other people are getting the same symptoms as you. It looks as if AVG, and then NOD32, may have prevented you from becoming infected with the worm. Please let me know if you get any further warnings from NOD32.
I think that it would be a good idea to run the Kaspersky scan now. I'll repeat the instructions for clarity:
Kaspersky Online Scanner
Using Internet Explorer, go to: http://www.kaspersky.com/virusscanner
- Click on Kaspersky Online Scanner
- Click the Accept button
- Follow the prompts to download and install the ActiveX component(s) and other software
- If a yellow information bar appears at the top of the browser window, click on it and select Install ActiveX Control
- If a message box appears, click on OK or Run as appropriate
- Click Accept again (see the note below if using IE7)
- The program will launch and then start to download the latest definition files.
- Once the scanner is installed and the definitions downloaded, click 'Next'.
- Now click on 'Scan Settings'
- In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
- Scan Options: 'Scan Archives' and 'Scan Mail Bases'
- Click 'OK'
- Now under 'Select a target to scan' select 'My Computer'
- The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
- Now click on the Save as... button:
- Save the report to your desktop (Save as type: Text document (txt))
The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are
there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.
Please post the Kaspersky report as a reply to this thread.
You could try running CleanX-II on your friend's computer. This should get rid of the worm if present. However, I suggest that he creates a new thread and posts a HijackThis log on this forum. It's almost certain that there will be other infections. If you run CleanX first, please post the resultant report as well, so that the helper can see what has happened..