Dingy

We are currently experiencing a large number of virus reports from customers regarding a virus that comes in to the network as marioforever.exe, which all AV vendors (including trend micro) are currently unable to quarantine/clean.

Nash_mr2

http://www.precisesecurity.com/files...rioforeverexe/

looks like it sends random print jobs over the network

Dingy

Yeah and down's your network by deleting random dll files from workstations and servers.

5t1g

Handy

Seademon

From that link its been going round since May so not that new!

Dingy

Maybe not that new then but we have experienced a large number of people being infected yesterday for some reason......

Not sure why.

Turbocabbie

marioforever.exe is also known as W32.Mariofev.A and you can remove it as follows :

1. Temporarily Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Reboot computer in SafeMode
4. Run a full system scan and clean/delete all infected file(s)
5. Find and stop the service.
Click Start > Run.
- Type services.msc, and then click OK.
- Locate and select the service that was detected.

Service name: SCNa
Display name: SCNa Service

- Click Action > Properties.
- Click Stop.
- Change Startup Type to Manual.
- Click OK and close the Services window.

6. Delete/Modify any values added to the registry. [how to edit registry]
Navigate to and delete the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\[NUMBER]\”[34 DIGIT HEX NUMBER]” = “[RANDOM DATA]”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
\”ztpInit_Dlls” = “nvrsma”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\”ccnt” = “[NUMBER OF INFECTION ATTEMPTS]”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\”mid” = “[RANDOM HEX DATA]”

Navigate to and delete the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SCNa

7. Exit registry editor and restart the computer.

Dingy

Could be a new strain out then cause its not that easy to remove LOL.....

foreigneRS

what kind of idiot would execute a file like that? if you are in charge of a corporate network where such people exist, i would think that you should make sure that any .exe file is blocked. easier said than done i expect?