Ranky.W do not quarantine

[kelvinq]

the Ranky.W trojan seems new (29Apr04) NT4 v6.22
(dont ask why we are running that old beast)
Nod32 detected it, cannot fix.
do NOT quarantine becuase affected files are involverd in Explorer
so NT wont start.

files involved:
\WINNT\system32\fqebfsa.exe 99667
gwcbvwot.ext
qvdsafs.exe
dbfavcws.exe - this one NOT quarantined, still sick so NT explorer cant run

does anyone have a repair for Ranky.W on NT4?
cheers
Kelvin Kline

 

[wb]

You might try this, I've used it successfully in the past. Ask someone with
the same operating system to email you explorer.exe. renamed explorer.txt
save it in the same directory as your original explorer.exe.
boot up with a dos system disk, write protected. Go to the directory with
the explorer files.
type
rename explorer.txt explorer.exe
Click on the ok to overwrite.
you can do the same for any other files in question.
re-boot in safe mode and run the virus checker and drive the thing out.
no guarantees but it could work
wb

Of course, there is a small issue that those files are copyrighted and
should not be transferred through email

 

[wb]

Sorry you have said NT... it may not be possible with NT.
I don't know.

wb

 

[null]

the Ranky.W trojan seems new (29Apr04) NT4 v6.22
(dont ask why we are running that old beast)
Nod32 detected it, cannot fix.
do NOT quarantine becuase affected files are involverd in Explorer
so NT wont start.

files involved:
\WINNT\system32\fqebfsa.exe 99667
gwcbvwot.ext
qvdsafs.exe
dbfavcws.exe - this one NOT quarantined, still sick so NT explorer cant run

does anyone have a repair for Ranky.W on NT4?
cheers

If you're comfortable with using the command line, try this little
utility:

http://www.invircible.com/news/news_details.php?id=80

Boot up into command line mode and Run your av scanner from the
command line. You should also be able to access the internet and other
applications.


Art
http://www.epix.net/~artnpeg

 

[someone]

You might try this, I've used it successfully in the past. Ask someone
< snip ><

no guarantees but it could work
wb

Of course, there is a small issue that those files are copyrighted and
should not be transferred through email

Just a thought: why not save your own explorer.exe on a floppy or on a
different partition, before any problem happens. Then there will be no
issue with copyright if you need to copy it back, as wb instructs

s.