0

Is it dangerous for me to connect via rdp to my vps to try and clean off this worm? What threats does it pose?

I have used MBAM to quarantine the worm, it has infected a memory module and several temp files (it repaired the temp files but not the memory module).

Is there some sort of removal tool?

Why the heck did my vps have the worm on it the second I got it? The instant I got the vps I installed MBAM and ran a scan.

Thank you for your help. This worm appears to have almost no removal documentation, and is classified as low risk on McAfee security center. However, does that mean it does no damage or that it simply is rare?

Improve this question
2
  • Well...telling us what worm would be a start...
    – Bobby
    Dec 11, 2009 at 19:55
  • 1
    Read the title: "Parite worm on windows vps"
    – Cyclone
    Dec 11, 2009 at 19:58

2 Answers 2

Reset to default
1

The reason you got infected right away is most likely because the VPS was connected directly to the internet without a decent firewall, combined with not having all patches / security updates installed before connecting directly to the internet.

Most likely some other VPS or server in the same datacenter is infected, meaning it can very quickly find and attack any unprotected servers in the same area.

Improve this answer
4
  • Is it a danger to my computer? I know for a fact another vps is infected. I enabled Windows Firewall and basically locked it down except for what I need.
    – Cyclone
    Dec 11, 2009 at 20:42
  • Probably is a danger. Will waste your bandwidth attempting to hack other user's computers. Could possibly even user your server for illegal activities, getting you on blacklists, etc. The only way to be 100% sure it's off is to reinstall the OS from scratch.
    – davr
    Dec 11, 2009 at 23:24
  • Its quarantined and it does not have internet access AFAIK
    – Cyclone
    Dec 12, 2009 at 0:17
  • It appears to be idling, I have downloaded a removal toolkit and will try it ASAP.
    – Cyclone
    Dec 12, 2009 at 0:32
0

Upon further googling, I stumbled upon a free tool from Avast! which says directly on the info page that it can remove this worm.

http://www.avast.com/eng/avast-virus-cleaner.html

When run, it scans everything for certain known worms, and it was able to repair all infected files (in this case, every single .exe and .scr file).

The worm, which is also known as "Pinfi", spreads with .exe and .scr files, but does not do much damage.

The tool was able to repair everything, and now all scanners return absolutely no trace of the virus.

I have enabled a strong firewall.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .