Calling all computer savvy people
May. 4th, 2004 07:09 pm![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
ellienihonI have caught this f*#&ing virus.
Win32.Parite
The virus consists of a dropper, which is witten in assembler, and the virus part itself, written in Borland C .
When an infected file is launched, the control flow is passed to the virus dropper, which writes the virus to a temporary file and executes its infection procedure.
The virus searches for Win32 EXE PE files with .scr and .exe extensions on all logical drives of computer, and also in shared resources of local network, and infects them.
The virus doesn't manifest itselfs presence in any way.
The structure of infected file looks like this:
Host file
Virus
dropper - drops "main" to TEMP dir and executes it.
main - searches for files and infects them, e.t.c.
Any suggestions? I don't know how to get rid of the TMP file, and the antivirus program tells me that ibmpmserver.exe is also infected and I can't erase that. In fact, from what I can tell, I need it. I'm ready to buy a memory stick and reinstall Windows, but if anyone has a better idea, I'd love to hear it.
Win32.Parite
The virus consists of a dropper, which is witten in assembler, and the virus part itself, written in Borland C .
When an infected file is launched, the control flow is passed to the virus dropper, which writes the virus to a temporary file and executes its infection procedure.
The virus searches for Win32 EXE PE files with .scr and .exe extensions on all logical drives of computer, and also in shared resources of local network, and infects them.
The virus doesn't manifest itselfs presence in any way.
The structure of infected file looks like this:
Host file
Virus
dropper - drops "main" to TEMP dir and executes it.
main - searches for files and infects them, e.t.c.
Any suggestions? I don't know how to get rid of the TMP file, and the antivirus program tells me that ibmpmserver.exe is also infected and I can't erase that. In fact, from what I can tell, I need it. I'm ready to buy a memory stick and reinstall Windows, but if anyone has a better idea, I'd love to hear it.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
(no subject)
Date: 2004-05-04 06:34 am (UTC)(no subject)
Date: 2004-05-04 08:05 am (UTC)If you can't get your PC running... A reinstall is sadly probably your best bet.
(no subject)
Date: 2004-05-05 02:24 am (UTC)(no subject)
Date: 2004-05-05 08:03 am (UTC)(no subject)
Date: 2004-05-05 08:07 am (UTC)They don't provide a removal tool, but they do give detailed instructions on how you can manually remove it from your system. Good luck.
(no subject)
Date: 2004-05-05 08:12 am (UTC)(no subject)
Date: 2004-05-05 09:56 pm (UTC)(no subject)
Date: 2004-05-05 11:46 am (UTC)