Trojan.Brisv.A! can't find file?

Norton Security | Norton Internet Security
21

Thanks for the tip! I tried running the program but kept getting the message -ERROR -invalid PE Image found.

I tried executing the program both as saved under a different name and as already named file.

 

Hope we haven't run out of remedies yet.

 

Reb

22

So do I Rebjen.  This one is making life very tough.  Quads will be along later in the day, due to time zone differences.  Try to be patient.

23

Will do!

Thanks Delphinium you've been keeping me optimistic.

 

24

Hi Rebjen:

 

Give this one a try.  Scan only, don't give in to temptation to fool with it.  Save the log in Notepad and attach as always via the link under the post button.

 

http://www2.gmer.net/catchme.htm

 

 

25

For a moment I thought it was working but “Scan Error” was the verdict.

26

That's okay:

 

Quads has already managed to defeat one of these things.  We will see if he has any other suggestions, or will try for it using a similar script. 

27

Rebjen:

 

Have you actually deleted the files in the Qbackup folder as per the instructions?

 

Also, did you disable system restore, dump your temp files and empty your browser caches.

 

Also once that is done, please run liveupdate again until no more updates are available and run another scan to see how many files are scanned in a manual scan.

28

My apologies if I sound a bit thick here but here goes;

 

1- Norton unresolved security shows me Brisv Trojan manual removal required.

 

2-Quarantine shows me it first came on in January and was removed. Then again on June 5 and was removed.

 

I see no removal button or option in either of these 2 views.

 

I've attached images of these.... just found out can't send just text files.

 

I first wanted to clarify that with you before I proceed because I may just not be seeing the removal option or this is as far as I can go and that I should move on to "THE FIX"?

 

Thanks

29

Just to be sure , how do I dump my temp files?

30

I would suggest that you proceed with THE FIX and apply it to the January incident (if you can) and the June 5th one.  After that run a full system scan in Safe Mode to see if there is any trace of this Trojan.

Click Start > Run and type %temp% and press ENTER.  In the explorer window, click on one file and press CTRL + A to select all the files.  Then press SHIFT and DEL to delete all the files and not send them to the recycle bin.

Message Edited by dbrisendine on 07-09-2009 09:50 AM
31

When deleting temp folder I get a warning that “desktop.ini” is a system file do I want to delete it?? Thought I’d check first.

32

I was just looking ahead to THE FIX , I don't see how I can remove the unresolved security risk without a button to press or other removal option. Which I just can't see?

 

Thanks

 

33

Rebjen:

 

When you are looking at the threats listed in the quarantine, click on one.  That should give you the options.  Choose remove. Then follow the directions given in the post on page one for the FIX.

34

Ahhhh , I see it now!!

 

At the top of the list I have 2 listings for BRISV  should I remove both?

 

I'm still performing the Temp folder clean up and put it on hold until I found out if it was safe to delete "desktop.ini"? then will proceed.

 

thanks, I'm feeling optimistic again!

35

Please read previous message first.

 

 

 

I did try to remove the most recent one and it WORKED!!

 

Should I remove the other one too?

 

 then what?

 

I feel I'm back at the beginning of the process but with a solution around the corner.

36

Yes; please remove the other one also.  After that, boot into Safe Mode and perform a full scan with Norton (double click on the desktop icon and follow the pop up to start a Full System scan).  Please post the results back here.  Thanks.

37

Hi,

I removed the other Brisv from Quarantine history.

I ran a full system scan in Safe Mode which scanned 3,465 files I don't know if that seems like too few files to be scanned.

Norton found nothing.

I returned to Normal mode ran a full system scan which was 5704 files. Found nothing. The January instance of Brisv. is still listed in  Unresolved Security risks but it is gone from Quarantine history.

 

There are several other things sitting in my quarantine from 2008 that I've never removed. Should I try and send a Quarantine log file to you?

 

Thanks 

38

To remove an entry from the Unresolved list you need to use the workaround to delete it from inside the Qbackup folder.

 

Workaround

 

THE FIX:
It is not necesary to erase the complete Qbackup folder, neither you need to boot in safe mode also.QBackup folder (Quarantine Backup) is used by Norton AntiVirus component to store backup recoveries of repaired and removed threats when you fix/remove threats during the scan. It may also contain information about threats detected and retains the remediated data in your computer itself. It will be automatically recreated by Norton program when you run scan next time.
So to FIX this problem. Just open NIS2009 history,  GO to "unresolved security risk" Press "Remove*" the item failed to remove, wait for the "failed to remove" status, this will update the "*.qbi" file which have the history of the unresolved items. Then go to NIS2009 settings, go to "miscellaneous setting" and disable the Norton Product Tamper Protection under Miscellanious Settings. Then open your windows explorer and go to
  "C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\QBackup"
and erase your most recently (updated, newly)  "*.QBI" file. The asteric it a long number as "{DDAB4332-ED04-4898-9C20-D231FDC4B0C5}.qbi" it will be a small file 1-10 KB. Only deleted this file. Close Windows explorer, go to NIS2009 reactived the  Norton Product Tamper Protection under Miscellanious Settings and you can enter to the HISTORY and you will find it is empty (clear).
Hope this will help to not erase the hole (complete) "Qbackup folder".
BEST REGARDS (SALU2 PARA LA RAZA)
TUFE (aka JC.WILCOX or SABROSO)

 

 

 

Quads  

39

Hi Quad,

 

I removed the item and it did just that removed it. I then went to Misc. settings and the tamper protection was already off. Don't know if that is of any concern.

 

Then went to documents and settings, I'm now in the QBackup folder looking at all these folders with no idea which is the most recent and then where to find the qbi file?

 

Am I suppose to be looking for a file with this title as mentioned in The Fix if so which folder?

"{DDAB4332-ED04-4898-9C20-D231FDC4B0C5}.qbi"

 

Thanks

Reb

40

Go to the View menu and "sort" by "Modified"

 

The character string given in the "FIX" is a for instance.

 

Once sorted by modified, go to the last file in the folder and delete each one until the "Unresolved" listing has gone in Norton.

 

.qbi or qbd is the extenstion of each file like with other files of different types.

 

Quads