Remember...
Hide your offended heart...
Keep your valued friend.
Master Chen Hai Yang
Yesterday my computer wouldn't boot up properly into Windows. It got as far a loading XP but seemed to hang, and I couldn't do a thing. I spent all of last night trying to fix it and went to bed thinking all was well. This morning when I booted up - same thing. It hung while loading the startup programs and I could only work in safe mode.
I've had one hell of a day. I spent 3 hours this morning backing up my emails, My Documents, and other folders on the C drive I didn't want to lose. I turned off System Restore last night because there was a virus in there so didn't have the option to restore anything. My last hope was a Norton Ghost image that I'd taken back in April. Thank God I did and why didn't a back up a more recent working version? I keep asking myself these questions. Me of all people should know how important backups are.
The nasty trojan is called Backdoor.Win32.Bifrose.wg and after searching the internet last night I found a lengthy discussion all about it. This is a new trojan with very little information available. The forum article is dated September 2nd.
c:\WINDOWS\_system32.exe
c:\WINDOWS\plugin1.dat
c:\WINDOWS\system32\drivers\oreans32.sys
adds itself to Software\Microsoft\Windows\CurrentVersion\Run startkey
plus it adds itself as a service, with lots of registry entries.
I managed to uninstall the three main files without any drama, but couldn't clean the registry and when I tried to do this manually, I was denied access. Trying to delete the registry files seemed to set the trojan off and I had more problems. It's been a nightmare trying to clean up, hence the need for Norton Ghost to come to the rescue.
A comment on the site that I thought was rather silly:
Hey... I already do. I have the pro version of Zone Alarm, a paid version of Spyware Doctor, and the free AVG (which I think is one of the best antivirus programs around). Until recently I also had TeaTimer, the resident shield for Spybot Search and Destroy, and still I manage to get hit with these rotten little blighters.
I'm probably my own worst enemy when it comes to downloading nasties from the internet though. I love to test new programs and quite often visit the crack sites (notoriously nasty sites), but usually Spyware Doctor warns me of potentially dangerous sites. This one slipped past all my defences.
Leave a comment