Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it dangerous for me to connect via rdp to my vps to try and clean off this worm? What threats does it pose?

I have used MBAM to quarantine the worm, it has infected a memory module and several temp files (it repaired the temp files but not the memory module).

Is there some sort of removal tool?

Why the heck did my vps have the worm on it the second I got it? The instant I got the vps I installed MBAM and ran a scan.

Thank you for your help. This worm appears to have almost no removal documentation, and is classified as low risk on McAfee security center. However, does that mean it does no damage or that it simply is rare?

share|improve this question
    
Well...telling us what worm would be a start... –  Bobby Dec 11 '09 at 19:55
1  
Read the title: "Parite worm on windows vps" –  Cyclone Dec 11 '09 at 19:58

2 Answers 2

The reason you got infected right away is most likely because the VPS was connected directly to the internet without a decent firewall, combined with not having all patches / security updates installed before connecting directly to the internet.

Most likely some other VPS or server in the same datacenter is infected, meaning it can very quickly find and attack any unprotected servers in the same area.

share|improve this answer
    
Is it a danger to my computer? I know for a fact another vps is infected. I enabled Windows Firewall and basically locked it down except for what I need. –  Cyclone Dec 11 '09 at 20:42
    
Probably is a danger. Will waste your bandwidth attempting to hack other user's computers. Could possibly even user your server for illegal activities, getting you on blacklists, etc. The only way to be 100% sure it's off is to reinstall the OS from scratch. –  davr Dec 11 '09 at 23:24
    
Its quarantined and it does not have internet access AFAIK –  Cyclone Dec 12 '09 at 0:17
    
It appears to be idling, I have downloaded a removal toolkit and will try it ASAP. –  Cyclone Dec 12 '09 at 0:32
up vote 0 down vote accepted

Upon further googling, I stumbled upon a free tool from Avast! which says directly on the info page that it can remove this worm.

http://www.avast.com/eng/avast-virus-cleaner.html

When run, it scans everything for certain known worms, and it was able to repair all infected files (in this case, every single .exe and .scr file).

The worm, which is also known as "Pinfi", spreads with .exe and .scr files, but does not do much damage.

The tool was able to repair everything, and now all scanners return absolutely no trace of the virus.

I have enabled a strong firewall.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.