NSVC.EXE Virus

Anyone have any experience removing this virus. It involves an autorun.ini file and a recycler folder coming up and damaging certain MS Office files and writing information to the registry. Symantec does not remove this in the virus scan and there is no indication that they are going to handle this.

We are not switching to another virus software program so we would need an independent program that we would be able to run to specifically deal with this issue and possibly prevent it in the future. Let me know if you have any ideas or programs we can run.

Thanks,
Joel

If symantec isnt catching it...how do you know you have it????

Usually practice is to disable system restore and scan in safemode

MLF

edit>this appears to be old...like from 2006???

maybe try something like malwarebytes??

what version of symantec do you have.....??

I know we have it because it acts, in some ways, similar to the MSN messenger virus in that it replaces the icon of a flashdrive with a folder icon...also because we are intelligent. It also replaces itself after you delete in regular mode.

It jumps from your flashdrive to the pc and vice versa. You must delete it in safe mode. Although, you must clean out the recycler in the c: drive first. Then delete the 'Recylcer' folder and the 'autorun.ini' file in the flashdrive in safe mode.

Thanks for the help.

.. No AV will catch all the malware out there..

If you know there is a malware on your machine and is harmful you can submit a copy of the file to Symantec, I am not going to deny the fact that Symantec support $ucks ! But that is one way to go..

You may go through other AV vendor website to see how it works (infects) and to ensure your machines are disinfected properly.


As for this malware :

http://www.prevx.com/filenames/15341.../NSVC.EXE.html

This is the only useful link I found *from AV vendors* there are couple of forum's out there talking about it.

I am sure your company has signed an agreement with Symantec. Depending on SLA signed upon you can claim for damages.

Very nasty, that one.

I inserted a flash disk of a friend into my system and it immediately hijacked the Admin rights and I couldn't use the Windows Explorer Folder Options anymore, particularly to view what invisible (system) files have inserted themselves into my HDD.

My AV then was Avast!. (Prior to that, I had Symantec NAV until it expired, then AVG). It failed to catch the intrusion attempt.

Anyway, what I did was to download Comodo Internet Security and after installing and reboot-scanning, the infection was removed... and I regained the Admin rights.

However, the removal is not complete. The Recycler and System Volume Information folders remain. I have long been trying to remove them (they were never there when you install a new system on a new PC or laptop or netbook) to no avail.

There's a problem in the Recycler folder; most especially when you are low in HDD available space. It always creates a mirror list and size of all the files you delete and send to the Recycle Bin. You can only remove those mirrors if you purge your Recycle Bin--hence caution must be exercised if you delete a file with plans to restore it later.

The presence of the Recycler and System Volume Information are like ugly scars of a past chicken pox infection. Couldn't get rid of it, it will stay there (and I hope someone will suggest how to eliminate them without reformatting and reinstalling software packages).

If you see the folder in the USB Flash Disks, you can easily remove them. But in a PC or laptop HDD, no can do.

The proliferation of autorun.inf files nowadays that are not always clean is the main source of virus, trojan and malware infiltration, IMHO. Hence, it is important to have an anti-virus that "realtime virus scanning" ability and will immediately halt the execution of any application or program until further user action. That is the attribute I found with CIS. I have a laptop with Symatec's Norton Antivirus 2009 installed but it hasn't been a good sentry and the Vista OS has already crashed twice when an infection/infiltration occurs.

-G

Have you tried to Shift+Delete the autorun.ini file and the Recycler folder? This bypasses the recycle bin and permanently deletes them. But, still no fix for preventing something like this from happening again.

mmmmmmm

cant you just disable autorun ???

http://support.microsoft.com/kb/967715/

MLF

Quote:

---

Originally Posted by jaustin

But, still no fix for preventing something like this from happening again.

---

Press and hold the Shift key while inserting the cd/pendrive/usb hd/whatever.

Or just disable autorun altogether.

http://support.microsoft.com/kb/967715

(MLF beat me to it :drink: )

Great minds think alike Sir Dice :p

hey...give me some of that vino

MLF

You know the more I read this thread...the less sense it makes??

How would you know the name of the virus....if it hasnt been caught??
How would you know its behaviour....unless you know the name???
Where did you guys gleen your info about this virus??...cause I am not seeing much info on it at all.....which all comes back to

How do you know you have this virus...

AFAIK System Volume Information and Recycler are normal windows files??? not remnants of a virus....although virii like to hide in there...thats why you disable system restore and scan in safe mode

Quote:

---

The System Volume Information folder is a hidden system folder that the System Restore tool uses to store its information and restore points. There is a System Volume Information folder on every partition on your computer.

---

http://support.microsoft.com/kb/309531

Am I the only one confused on this??

MLF

MLF I agree, there are spots in this thread, for me I was reading this thread too early in the morning... especially the comment about sending things to the Bin with the intention of restoring..?!?
And RECYCLER is the folder that the Recycle Bins (one for each user) are kept.. so your copies of your deleted files will be stored here (it is normally a system hidden/protected folder.

There a re a couple of "AutoRun" or "USB KEy" Virus's out there that create a fake recycler folder I have not encountered the fake SVI folder as yet.. but..

There are a few standalone tools for the task of removing these.. My preference is as mentioned earlier in the thread.. MALWAREBYTES
Importantly: INSTALL in Safemode, and conduct a scan in safe mode.. before restarting and doing an update and a scan in normal mode:
While the machine is in Safe mode.. be sure to have Hidden and system files viewable - as well as "Hide Protected system files" disabled.
1/ You will find a "System - Hidden" executable in the root of the USB drive/stick delete it .. It can any name.. so watch out
2/ View the Autorun file.. it sometimes includes a number - the ID of the viruses recycle bin S-21-...... take note of this number..
3/ Open Regedit and search for this number take not of the locations.
4/ run the Malwarebytes scan.. when finished check the logs.. that ALL the keys you identified are mentioned in the registy part of the scan.

And just for the hell of it.. in safemode.. delete the recycler folder.. or delete all the contents of said folder.. (Shift - Delete)
Also cycle System restore off and back on.. to clear the SVI folder.. I have had a machine that I needed to do this a couple of time.. so check that the the folder is empty before re-enabling system restore.

Check ALL your usb devices..
ALso change the default (double click) option for these device to Explore.. rather than Open..(L)users open anything..never thinking and blame others for their stupidity..
IF your machine is part of a win 2k3 or 2k7 domain.. set it in your policies

REALISE that once these buggers get in, you have not one, but several infections.. so do several restarts and scans, use several tools to confirm clean..

Greetz.

To the OP follow these instructions and say by by resycler:D

Quote:

---

Originally Posted by t34b4g5

I recently had to fix a friends computer that was doing the same thing..

here's the way that i was able to fix it.


try going to my computer.
Click the folder button and make sure view hidden files/folders is turned on and check your drives for "resycled" and "autorun.inf" files/folder
They will appear in the root directory..

If they are there then go to a command prompt and change the attrib settings to the "resycled" folder and the “autorun.inf” file

attrib -r -s -h

then while still in the command prompt just use the del command on both.

then do a search for autorun.inf on your drives and after the scan just right click on each one and open with notepad or wordpad and check each one, and if any happen to have "boot.com" before a string of jumbled letters numbers then delete.
the "boot.com hides in the “recycled” folder and when the “autorun.inf” files is loaded it loads the “boot.com” file and your browser will continually get redirected.

restart computer and then go to my computer and click folder and check to make sure there both gone..

this thing was not only not letting me access the computers drives it also decided that it would re-direct the browser to www{X}copy-book{X}com {Note don't click site got active malware} all the time a little and i did the above and it should solve the issue.


Also
Start Windows in safe mode, then click Start -> Run. Type in regedit and click okay.

Now at the top of the registry editor,
click Edit -> Find.
Type boot.com and click Find Next. Every time it finds a new boot.com, press the delete key and then enter. It should find a dozen or so copies.

Now, plug in any external drives or flash drives you have used with this computer.
Open
My Computer. Click Tools -> Folder Options -> View and select "Show Hidden Files and Folders" and click okay.

For each drive, open it and delete the “recycled” folder and “autorun.inf”. Back up each “autorun.inf” before deleting them off external drives, because they might be important.

Restart the computer and the problem should be gone.

Any removable usb drives you've plugged into that computer will also be infected with the virus, so make sure you clean them out too (note if you clean your comp, then plug-in the usb drives it'll re-install itself)
any computers you've plugged that usb drive into are also infected

a summary of what this thing does - its installed itself as a windows driver with a random dll file name, you'll have to track down ALL instances of it and eradicate it completely. Booting in safe-mode will assist, the drivers wont show up in control panel or admin tools either as its hidden

other things you will need to remove this damn virus
malware-bytes anti malware
SmitFruadFix Scan
hijack this
gmer

this thread should help you: http://www.bleepingcomputer.com/forums/topic191577.html

if you download and install the latest version of those programs they should work fine without and update, the virus re-directs the update URL's as well. You will find its system-wide not browser specific!

---