蚂蚁小窝

Symantec提供的资料。
W32.Pinfi
Discovered on: October 11, 2001
Last Updated on: July 31, 2003 10:50:46 AM

W32.Pinfi is a memory-resident polymorphic virus that will infect the .EXE and .SCR files. This virus can also spread via mapped drives and network shares.

Also Known As: Win32.Parite.a [KAV], W32/Pate.a [McAfee], Win32.Pinfi.A [CA], PE_PARITE.A [Trend], W32/Parite-A [Sophos], Win32/Parite.A [RAV]

Type: Virus
Infection Length: ~177,917 bytes



Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, OS/2, UNIX, Linux

Virus Definitions (Intelligent Updater) *
October 12, 2001

Virus Definitions (LiveUpdate™) **
October 17, 2001

*
Intelligent Updater definitions are released daily, but require manual download and installation.
Click here to download manually.

**
LiveUpdate virus definitions are usually released every Wednesday.
Click here for instructions on using LiveUpdate.

Wild:

Number of infections: More than 1000
Number of sites: More than 10
Geographical distribution: High
Threat containment: Moderate
Removal: Moderate
Threat Metrics


Wild:Low
Damage:Low
Distribution:Medium
Distribution
Shared drives: Copies across mapped drives and network shares.

Upon executing a file infected with W32.Pinfi, the virus will perform the following:

1.Adds the registry value:

PINF

to the registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer

2. Appends itself to Explorer.exe to remain memory-resident.
Appends itself to all the .EXE and .SCR files that it finds on all the local and mapped drives. The virus contains an algorithm to slow the infection, so the virus will only infect a few files at a time.

3.W32.Pinfi will create a tempfile in the temporary folder. It will get the temporary folder by using a Windows API. The tempfile that this virus creates will always have the following name:

[3 random letters][4 random hexadecimal digits].tmp


The file that the virus creates is a UPX-packed executable file. The virus will execute the temporary file, and it is this file that will attempt to infect files over network shares.

网上找的解决方法，请参考。
防止WIN32.Parite.a和Win32.Parite.a.dll

1.将d:\system\windows目录下的所有exe文件不包括（flcess.exe 和sysexplorer.exe）
设为读取，将d:\bar目录下的exe文件设为读取;

2.将e:\profiles目录下的历史记录目录设为读取；

3.禁用文件系统对象FileSystemObject
　　
方法：直接查找scrrun.dll文件删除或者改名。

4.略。
5.在服务器安装防火墙（呵呵，不要认为不可能，选择一个无盘专用防火墙）；

以下为变态方法,作为杀毒方法的后续，如果想要安全可以加入：

6.专杀工具spant，可以加到启动组中，工作站启动随时可以杀病毒；

7.将所有文件设为只读（不包括网络游戏的EXE文件）；

8.删除IE浏览器，暂时避过WIN32病毒风头
权限控制

A Sample CACLS script to lockdown the filesystem permissions on new servers:

cacls c:\ /g administrators:f system:f users:r
cacls c:\*.* /t /c /g administrators:f system:f users:r
cacls c:\temp /e /p users:c
xcacls c:\winnt /e /t /g users:ex;ewx "creator owner":c
xcacls c:\winnt\repair /e /r users "creator owner"
xcacls c:\winnt\system32 /e /g users:ex;ewx "creator owner":c
xcacls c:\winnt\system32\spool /e /g "creator owner":f
xcacls c:\winnt\cookies /e /g users:c
xcacls c:\winnt\forms /e /g users:c
xcacls c:\winnt\history /e /g users:c
xcacls c:\winnt\occache /e /g users:c
xcacls "c:\winnt\temporary internet files" /e /g users:c
xcacls "c:\program files\microsoft office\office" /e /g users:ewxd;ewx
xcacls "c:\program files\microsoft office\templates" /e /g users:ewxd;ewx