Virus information

Hi all,

I have two viruses which i need to know some more information about, i can't find much though, i have read about the sdbot.AFN in the archives in this site.


SDBOT.AFN
and
Rbot.YZ

anyone got any links to sites where info on these viruses that nod has picked up?
Or has anyone had any experience with these viruses before.

cheers

 

What files are NOD32 alarming on that it says are infected with these?

 

SDBOT.AFN try:

Also known as: W32.Randex.gen (Symantec), Backdoor/SDBot, IRC/SdBot.AFN (Eset), Backdoor.SdBot.jg (Kaspersky), W32/Sdbot.worm.gen.h (McAfee)

Gerard

 

Rbot.YZ look here here are the different variations

 

thanks for the quick repsonse, the files infected are:

msconfg.exe - sdbot.afn

atiphexx.exe - rbot.yz

 

I would run a scan with Nod32 in Safe Mode, if you find there are problems with System Files affected, then after this you can place your Windows CD in the drive, click start > run, type in CMD, type in "sfc /scannow".

SFC (System File Checker, a part of Windows File Protection) will replace any changed/damaged system files with a clean copy. SFC may not solve every problem, but it's a good start that anyone can do...

Hope this helps...

Cheers

 

maybe this works for YZ as well?

http://www.sophos.com/support/disinfection/rbotek.html

 

Where abouts did you get that information Gerard?

 

Try here: https://www.virusbtn.com/perlbin/vgrep/vgrep.cgi?terms=SDBOT.AFN&product=0

www.virusbtn.com > Resources> Vgrep

Cheers

 

What are the locations of these files? Upload these 2 files to Jotti's site HERE for a second opinion.

 

Win32.Rbot.H

 

i have removed both viruses now, computer is virus free, now i just have a problem with the OS, i will run the sfc and if not better i may try a win repair.

 

Another valuable resource for this kind of information :
Norman's searchable database of automatically generated
virus descriptions (sandbox outputs). Here :
http://sandbox.norman.no/live_5.html

msconfg.exe -->
http://sandbox.norman.no/live_5.html?logfile=9437&menulang=

atiphexx -->
http://sandbox.norman.no/live_5.html?find=atiphexx.exe&adv=true