win32.jacksuf.a

Hello.

This is a two-part file infector. What I mean by that that the code which actually does the infection is not contained in the infected file (and thus the infected files do not replicate by themselves). The infected files drop an executable to c:\RBFZ.XNS of size 16.6 Kb, which copies itself to %WINDIR%\system\wdfngr.exe. This file (also detected with the same name) is downloader.

What I would like to ask is for you to send more samples (because we only have one "part" of the malware and can not replicate it) to make the removal tool more secure. Unfortunately the infection process seems to be rather dumb (in the sense that it has the possibility to overwrite certain parts of the executable) and you should expect executables (mainly setups - more precisely, those which have "overlay") to be damaged beyond repair. For example the Winrar kit you've attached is such an example.

In conclusion, please send more samples (as many as you can) and I'll provide a removal tool ASAP.

Hello,

We have just been hit by this virus and it appears to come in 3 parts the original Virus is in a file called wdfngr.exe this can be found in the \winnt\system directory and may well be hidden this file runs and looks for ALL exe files on all drives other than C it then infects all the ones it can and logs all the exe files into a new file called "mciwace.inc" it then sits quietly for 30-40 minutes and runs again.

The infected exe files will then infect a new PC firstly by copying itself to a file with a 4.3 character filename this file will firstly try and deactivate your Antivirus software then replicate the wdfngr.exe file as above.

In our network there did not appear to be any malicious payload it was just very annoyingly causing hundreds of virus alerts when our definitions were updated.

It can be very misleading as we thought we had 2 seperate probs the wdfngr.exe and the 4.3 files and they may not both show up on the same pc ??

The viruses that it might be called are W32.Jacksuf, W32.Mumawow.F or Cekar depending were you look.

We use a Symantec Antivirus which now does have a set of definitions which appear to be cleaning our EXE files OK so far.

Thanks

Sean Barnes

Unisys

If you have HDD problems, bad clusters etc. than there could occure read errors. However, it is practicaly imposibile that chunks of all the virus copies on your hDD to be located in bad clusters, except if you have really big problems with it.

Andrei

Hello. I've sent both of you (WeazzeL and SeanB) PM (Private Message) with the disinfection tool (I couldn't post it publicly, because only virus researchers can download the public attachments). Did neither of you get my PM?

(The removal tool will also appear on the official site, but that takes time and I wanted to get it to you as quickly as possible)

The disinfection routine is not added to the AV yet (it has to undergo a series of QA tests, which can take up to a couple of weeks, depending on the complexity of the code). Releasing removal tools is much faster, which is why that optin has been chosen.