Usually viruses infecting boot and executable files are automatically disinfected by F-Secure Anti-Virus (FSAV). In some cases, when automatic disinfection is not possible due to file corruption or overwriting virus, a user can select disinfection action by him/herself to make FSAV rename or delete an infected file. In some special cases it is recommended to use specific disinfection tools provided by F-Secure. They can be downloaded from our web or ftp sites:
F-Secure Anti-Virus can be purchased from our webshop or from our authorised distributors. A trial version F-Secure Anti-Virus, limited to 30 days, can be downloaded from our website:
All the latest versions of FSAV can download anti-virus database updates automatically. However, these updates can be also downloaded and installed manually from our web or ftp sites:
It is not recommended to manually disinfect files and boot sectors from viruses as it can cause damage to a system and make it unbootable.
System Restore issue and file viruses
If Windows ME or XP is used, it is recommended to disable System Restore feature of these operating systems to prevent a computer from re-infection by an already removed malware. The fact is that System Restore feature of these operating systems might save an infected file into the special folder and copy it back to a hard drive it every time it's been renamed or deleted by F-Secure Anti-Virus or by a user. Instructions on how to disable System Restore feature are here:
It is recommended to re-enable System Restore after disinfection in order to restore stable system configuration in the future, if any crash or incompatibility issue occurs.
Gnil.A may arrive in the system as an executable with an icon that depicts an alien.
Sample screenshot:
Once the execution of Gnil.A has been initiated, it will drop the following files into the Windows System directory:
xrtnyo.exe - Loader of the .dll component
xrtnyo.dll - Contains most of the payload
It will delete the executed copy of itself with the help of a batch file created in the temporary folder:
~Lying!.bAt
Gnil.A injects its .DLL component to the following processes:
explorer.exe
services.exe
winlogon.exe
It terminates the following processes related to Viking and Fujacks variants:
c0nime.exe
iexpl0re.exe
FuckJacks.exe
Logo1_.exe
Logo_1.exe
nvscv32.exe
Rundl132.exe
spoclsv.exe
svch0st.exe
Note: String comparison is case sensitive.
It infects binary files of the following extension:
.exe
.scr
Moreover Gnil.A also infects script files with the following extension:
.asp
.css
.htm
.html
.js
It avoids infecting folders with the following strings:
ComPlus Applications
Common Files
Delphi
Internet Explorer
Messenger
Microsoft Frontpage
Movie Maker
NetMeeting
Online Services
Outlook Express
RECYCLER
System Volume Information
System32
WINNT
WinRAR
Windows
Windows Media Player
Windows NT
Note: String comparison is case sensitive. This is why most system files are still infected.
Gnil.A will append a code at the end of the script file to point to a malicious website:
http://www.lovesa.info/l[BLOCKED].gif
Note: As of this writing the site is no longer available
Gnil.A may also use Internet Explorer to download from the said site. It gets the location of Internet Explorer by querying the following registry entry:
Aside from infecting binary and script files as a way to propagate, it can also spread via network shares using a combination of the following strings as username and passwords:
