C:\WINDOWS background image

Hello,

After removing the worms Win32:VB-FHP and Win32:Sohara-T on my PC then looking around at some folders, a repeated image is pasted at the background of C:\WINDOWS folder.

Because I did not check the content of C:\WINDOWS folder before the infection, does the worm persisting or this image have nothing to do with the worm?

Although using HiJack, Keylogger, Anti-virus scan results are back from normal after the infection, I still got second thoughts. Do I need to format?



cheers,
asptips

The ability to add wallpapers to folders in Windows XP was removed, but not entirely.

You can still do this via the desktop.ini file located in any system folder.

Just as you can add them, they may also be removed. Open the following file in any text editor. It is set to both hidden and system.

C:\Windows\desktop.ini

Now remove the lines similar to the following:You may optionally wish to delete the image file from the path you find.

Since JPG files can be used to transfer viruses, the possibility exists, however, unlikely. Still, be sure to run a full AV scan after removing the image, just in case.

Hi Nilpo,

This is the content of desktop.ini



Because the WinXP.ini is not an image file, I replace the extension to .JPG and indeed, it was the background image.
I know nothing about these INI files, so I will do a full system scan. Thanks!


Furthermore, the image was an anime character, Kenshin (Samurai X).


cheers,
asptips

Please post the contents of c:\windows\system32\WindXP.ini

For the record, this is a third infection. The W32.Mysamurai worm.

More info here.

Deleting the file alone will not remove this infection. It also creates a series of registry entries and edits other system files.

I will create a WSH script for you that will remove it. Will post back.

Hi Nilpo,

The moment you made the first reply, I deleted afterwards the WinXP.INI. Am I at lost now?

However, I did check the content and if I can remember, it has special characters and numbers in it and the first word in the line was either GIF or GIF32, sort of.

I appreciate your help and cannot wait when Kenshin will get slice from your sword Nilpo!


cheers,
asptips

It was full of weird characters because it's actually a binary jpg file that has been renamed with an INI extension. An no, it's okay that you deleted that. I'll make sure the script checks for its existence before moving on to remove the rest. I'm working on it now.

Just an update. This requires a lot of registry editing. This is quickly becoming a massive script.

In any case, I'm working on it and will post as soon as it's ready.