Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

VBS/Redolf.A Virus - How do I clean it?

Options
  • 24-12-2003 1:04pm
    #1
    Dr Bolouswki
    Registered Users Posts: 1,333 ✭✭✭


    Hey folks

    I was kindly given this virus by a mate when he backed up some data on my system.

    My understanding of how to remove it (found on some urdu language pages!!??) is to remove the kernal32 reg key from the registry at hklm/software/microsoft/windows/currentversion/run...

    however, when I get there there IS NO key referring to kernal32...

    command anti-virus will not get rid of it, neither does norton...

    How do I kill this virus?

    Any ideas?


Comments

  • Options
    #2
    maxheadroom
    Registered Users Posts: 1,569 ✭✭✭maxheadroom


    what AV package discovered it?


  • Options
    #3
    Capt'n Midnight
    Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 91,793 Mod ✭✭✭✭Capt'n Midnight


    For a sec I thought you said Rudolf

    http://www.s-cop.com/virus-details.asp?selectID=155

    This is an encrypted VBS virus which appends itself to HTM, HTT, VBS and JS files. It also attaches itself to MS Outlook"s default stationery files and sets the Blank.HTM as the default stationery.

    Details : Any mail composed with MS Outlook subsequently will contain this virus and will infect the mail reciepients computer.

    So prob won't affect anyone with VB scripting turned off and doesn't use Outlook - can't ID it on the usual sites so probably an alias or variant of others.


  • Options
    #4
    Dr Bolouswki
    Registered Users Posts: 1,333 ✭✭✭Dr Bolouswki


    I'm using 'command anti-virus' by F-Prot...

    It picks it up but won't clean it. I saw the smart-cop site definition also - doesn't give any details on how to clean though....

    I'm trying other AV's - I'll see what happens...


  • Options
    #5
    BoB_BoT
    Registered Users Posts: 1,835 ✭✭✭BoB_BoT


    I remember coming across a removal method or program back around 7 months ago, had a customer with major problems and almost lost a lot of data due to redlof. I remember norton quarentined the files, then I took a look at the code and saw the virus code at the bottom of the code of the html files. I'm pretty sure I didn't clean over 2000 files manualy so i'll take a lookie to see if i can find the program at work.

    *edit* take a lookie here http://securityresponse.symantec.com/avcenter/venc/data/html.redlof.a.html read it all!! plus if you can get your hands on a copy of norton, update it and it might be able to clean the files, better yet go here http://housecall.trendmicro.com/ and you might be able to sort out your problem for free.


  • Options
    #6
    Dr Bolouswki
    Registered Users Posts: 1,333 ✭✭✭Dr Bolouswki


    Nice!

    Yep - currently downloading the trend micro fix... the symantec fix looks pretty comprehensive - I'll try that - thanks folks - I'll let you know how I get on...


  • Advertisement
Advertisement