MSN Messenger - cute.pif - Page 2

Stephen · 16-03-2005, 10:40

Quote:

Originally Posted by Aragorn

It would identfy any files left by the worm but wouldn't be able to edit the registry. By deleting the files it may get you in to a position where you can run regedit from safe mode. The other advantage of a temporary copy on another partition is you can move any data of the main partition.

If you have all the OS and app disks available, it may be quicker to save the data and reinstall the OS

Yea have all my disks, only problem is my spare partition is only 20GB, the main partion has about 80-90GB of stuff I would need to back up first.

Aragorn · 16-03-2005, 10:52

Are you sure it's just Bropia on there? The Symantec page doesn't say anything about blocking regedit. Has it overwritten regedit with it's own copy? Do both regedit & regedt32 fail in safe mode?

Stephen · 16-03-2005, 11:00

Quote:

Originally Posted by Aragorn

Are you sure it's just Bropia on there? The Symantec page doesn't say anything about blocking regedit. Has it overwritten regedit with it's own copy? Do both regedit & regedt32 fail in safe mode?

The regedit window appears and dissappears as soon as it is opened. I think it is the N variant. It seems to close any security windows system stuff. It still closes even in safemode. The worm appears to edit the regisrty and add itself to the main windows part so it loads every time windows starts.

Aragorn · 16-03-2005, 11:10

Do you have another XP system on the same network as the infected system? If so, you might be able to use remote registry access to edit the corrupt registry.

I would suggest
1. Load minimal XP on the spare partition and Norton AV (with latest defs!).
2. Run a Scan of the main partition to identify known virus files.
3. If the main partition still has problems in safe mode and you have another system, try opening the registry remotely.
4. Failing that spend ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â£40 on a second drive to save your data and then reinstall

5. Hope you meet one of the virus writers on a dark night with no witnesses

HTH

Stephen · 16-03-2005, 11:19

Quote:

Originally Posted by Aragorn

Do you have another XP system on the same network as the infected system? If so, you might be able to use remote registry access to edit the corrupt registry.

I would suggest
1. Load minimal XP on the spare partition and Norton AV (with latest defs!).
2. Run a Scan of the main partition to identify known virus files.
3. If the main partition still has problems in safe mode and you have another system, try opening the registry remotely.
4. Failing that spend ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â£40 on a second drive to save your data and then reinstall

5. Hope you meet one of the virus writers on a dark night with no witnesses

HTH

I'll try that when I get home. I do have a second drive it is an 80GB but only about 40GB free. My main drive is a 300GB. I will try burning as much as possible to DVD.

Aragorn · 16-03-2005, 11:30

Depending how compressible the data is, you could use XP backup on the temporary install to backup to a single file on the second disk or possibly zip up you data in 6Gb chunks for DVD burning.

Aragorn · 16-03-2005, 16:51

Hi,

A couple of my colleagues picked up this worm this afternoon, so I've seen the effects.

We did manage to run a Norton Scan in Safe Mode - rather than opening Norton if you start Explorer, Right-Click on the root of C: and select "Scan for Viruses" it will run, despite asking whether you want to abort (obviously ignore this question). However, Norton didn't actually pick up any files to clean! You could try downloading the latest defs in advance.

Another suggestion was that running Spybot S&D in safe mode cleans it enough to run Regedit.

Also we confirmed that from a second XP install you can open an inactive registry from the corrupt partition using Regedit.

Having said all that, the general view was that the quickest way out of this was a rebuild

HTH

Horace · 16-03-2005, 18:19

Just cleaned something out similar, using VNC on my GF's nephews PC in Spain :o . The virus was spread via msn using .pif extension. The virus itself would stop regedit,taskmanager and command prompt amongst others from running. It would also continue to use MSN to attempt to spread itself.
On top of all that it would shut down any window (read browser) that contained any security related strings, virus, security, scan etc. Would also attempt to stop execution of executables tho' it wasn't perfect in that regard and I managed to "beat" it by continually hitting return to get Nortons fix run.
The virus itself was W32.Serflog.A. The fix is on Nortons site, had to clean the host file and then upload the exe to the pc via a blank webpage since it would instantly shutdown nortons download page (for reasons mentioned above).

-EDIT- Yes it's also known as Bropia, so it is the same virus as mentioned in previous posts
http://securityresponse.symantec.com...serflog.a.html

http://securityresponse.symantec.com...oval.tool.html

Stephen · 16-03-2005, 18:43

Quote:

Originally Posted by Horace

Just cleaned something out similar, using VNC on my GF's nephews PC in Spain :o . The virus was spread via msn using .pif extension. The virus itself would stop regedit,taskmanager and command prompt amongst others from running. It would also continue to use MSN to attempt to spread itself.
On top of all that it would shut down any window (read browser) that contained any security related strings, virus, security, scan etc. Would also attempt to stop execution of executables tho' it wasn't perfect in that regard and I managed to "beat" it by continually hitting return to get Nortons fix run.
The virus itself was W32.Serflog.A. The fix is on Nortons site, had to clean the host file and then upload the exe to the pc via a blank webpage since it would instantly shutdown nortons download page (for reasons mentioned above).

-EDIT- Yes it's also known as Bropia, so it is the same virus as mentioned in previous posts
http://securityresponse.symantec.com...serflog.a.html

http://securityresponse.symantec.com...oval.tool.html

That is the one I have. I tried emailing myself the fx file from work but it is blocked and corrupted before I can open it.

How do you access the registry from another partition of windows?

This is doin my head in.

EDIT: anyone there I have ran the removal tool for Bropia, kelvir and serflog and it tells me it can't find it. now I am really puzzled, from the description of the virus it matches perfectly with the serflog one as I had the web page appear with a cartoon of Billgates.

Guess I will have to just back up and reformat.

Horace · 16-03-2005, 20:35

I've pm'd you a link to the fix (on my hosting), you should be able to "force" the pc to execute it.Once run everything should be fine.

Stephen · 16-03-2005, 21:20

That didn't work says it didn't find any virus. Looks like I'll have to reformat after all.

EDIT: never mind all is fixed. Norton updated and then popped up saying it found the serflog virus. all seems fine now.

Buzzby · 24-03-2005, 21:43

My partners daughter will just click on anything ( only 23 ) and infected a rebuilt clean XP setup with what symantec call W32.Serflog.A.
Try to stop it on the pc and the worm stops anything it sees as a threat. See
E:\Software\Tools\AV Tools\Symantec Security Response - W32_Serflog_A.htm

The removal tool must be downloaded to another pc. It's small enough to use a floppy. You can transfer it to the infected pc and run it. It cleaned up the pc in question in one go, nice one symantec.

Stephen · 24-03-2005, 21:49

I managed to fix my PC simply with Norton updating itself. I got infected by W32.serflog.C shortly after it was found so norton could not detect it.