C:\Program Files\Bifrost\server.exe

maddness · 30 Dec 2007 at 00:42

Hi there, has anyone come accross this trojan / virus

my cousin has had this on his PC a couple of days ago but nod32 didnt pick it up nor did avast. Only thing that picked it up was Spybot, adaware didnt neither.

Its a bit unusual because all the virus/antispyware programs were upto date

google is bringing it up as a serious threat, backdoor etc, but this was a fresh formatted Win XP system which was used for a week, has windows firewall and NOD32

has anyone come accross this threat before or care to comment on this?

thanks

modo77 · 30 Dec 2007 at 00:53

give this a try http://www.symantec.com/security_response/writeup.jsp?docid=2007-021911-0151-99&tabid=3

As for him getting infected, he's probably opened something dodgy.

tonyf1971 · 30 Dec 2007 at 02:02

sorry i havent come across this threat before

however i would recommend your cousins trys Spyware Terminator and the free version of Super Antispyware in place of adware and spybot ,and see what results you get.

Tony Williams · 30 Dec 2007 at 02:22

Delete the entries is your best bet. You say this is newly formatted, in that case I would 0-fill the hard disk and start over.

I'm both surprised and disappointed that NOD32 didn't pick it up, I remember it picking the client up for me a while back. (or it might of been AVG)

I'd 0-fill the drive, format and start over as it's not been long since you last did.

maddness · 30 Dec 2007 at 09:22

thanks for the response guys, i did purchase this dell pc on behalf of him from the very forums (see my posts), do you reckon someone installed something dodgy? but it had been formatted it after (win xp quick format upon installation) so i would have thought it would have been deleted then including all its traces, would this bifrose client still have been able to be retrieved after a format? as he doesnt really use the net / pc much so i really doubt he installed something dodgy.

yeah Nod32 has the definitions in its database (looking at the online database details) but it not being able to pick it up was a dissapointment, hes removed it now though.

teaboy5 · 30 Dec 2007 at 14:03

As said a few posts up, he has more than likely opened something on the web. Sure look the entry below, more spy ware.

rickyt · 30 Dec 2007 at 15:54

Take a brand new PC or laptop [branded .ie Dell , Packard etc] and run a registry checker , I use Wise Registry Cleaner and install Spybot & Ad-Aware and just see what comes up . I think you'll be supprised .
There was a page on my Teletext on TV a few years ago about this ,I think it was about 25 out of 30 new PC's/Laptops had installed suspisious software.This was years ago ,god knows what they install now.