Virus Warning!?

[PRicho]

We've been infected by something! member of staff came in with an error message, stating a 16bit MS DOS app cant run c:\windows\system32\2.exe, very suspicious name, 10mins later 4 other people had the same message. We packed 2.exe up and sent it to Sophos, we've not yet had any information back over the week however Sophos is now detecting the file as Troj/Agent-JBO so it must be new? Every machine and laptop on the network is infected with this, sophos now deletes it as soon as its created. however it just gets re infected later on. Its now also creating files in the startup folders and is rapidly getting out of hand.

 

Am not sure if this is a fresh virus, but we have it and have no idea how to contain it as we don't know the source! We have informed out LEA as to warn anybody in the county this might be on the loose. but any help would be greatly appreciated

[Michael]

Viewing your link, it states it creates an entry in the registry, so when the computer is restarted or someone logs on it's re-created.

 

It'll be referring to:

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

 

So for example, you may have Adobe Reader Speed Launcher (which is a common entry). To remove it, after the equals sign, delete everything after it and insert a minus sign. Save the file as removal.reg and then run in a logon script.

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-

 

Run silently in a logon script:

regedit /S \\SERVERNAME\NETLOGON\Removal.reg

[Sophos-Support-5]

Hi PRicho,

 

Please call us (24/7/365) if you require assistance. If you submitted a file sample (and included an email address) you should have received a email reply with a case reference in the subject line. Please quote this when calling.

 

From UK: 0844 767 4670 (0844 SOPHOS-0)

International: +44 (0)1235 465818

 

 

Regards,

 

Sophos Technical Support