zrfon.exe

Delphi91

Hi all,

At work today, I was asked to look at a Win 95 PC which wouldn't let you start any applications. Everytime I tried to start one, it came up with a message that it couldn't find "zrfon.exe". I can only assume that its a result of a virus or something. The machine was checked yesterday and a number of infected files were found and deleted - usual suspects. I've tried googling for some help, but nothing.

Anyway, I eventually managed to get to see a list of the file associations. All the Application files are associated with zrfon.exe and you can't edit the connection, which you can do for all the other file types. I thought of using Regedit, but that won't start either. Neither will Add/Remove Programs.

So, anyone have any suggestions as to how I might proceed? I don't want to have to re-build the pc (its a last resort). Could I share the pc on its network and "attack" it from another pc?

Mike

ColmOT [MSFT]

This looks like a dodgy file to me...I don't have a Win95 machine to check, but that file doens't look familiar to me.

I'd bat that it's a 3rd party file that's messed up your system or a virus.

Weird that google doesn't have any info on it though....

ando

I've had a VERY similar problem yesturday on a windows 2000 machine. It was a home pc with no anti-virus on it. I ran a virus scan on the machine, it found 11 virus's and put them into quaranteen except one, w32.swen.a@mm. The file that was infected by it was something like 'myaopu.exe' in C:\Winnt. I decided to delete the file (stupid me, I should of ran the fix first from symantec). Once I deleted the file, no *.exe files would start. Basically every exe file needed 'myaopu.exe' to start. Now I cant even run the swen fix because its an exe.

SYSTEM F*CKED

I'm going to format the f*cker and reinstall if I dont find a solution over the weekend

Capt'n Midnight

You could try a floppy based antiivirus - many packages can run from DOS. Don't forget to write protect the disks and switch off the power for a wee while before you start it up again.

Delphi91

Originally posted by ando
I've had a VERY similar problem yesturday on a windows 2000 machine. It was a home pc with no anti-virus on it. I ran a virus scan on the machine, it found 11 virus's and put them into quaranteen except one, w32.swen.a@mm. The file that was infected by it was something like 'myaopu.exe' in C:\Winnt. I decided to delete the file (stupid me, I should of ran the fix first from symantec). Once I deleted the file, no *.exe files would start. Basically every exe file needed 'myaopu.exe' to start. Now I cant even run the swen fix because its an exe.

SYSTEM F*CKED

I'm going to format the f*cker and reinstall if I dont find a solution over the weekend

Sounds like exactly the same problem. In fact, I think that virus was picked up when the virus scan was performed yesterday. I got the user of the pc to delete any dodgy file that it found. Guess that was the problem!

Now no application will start without this bloody zrfon.exe file. ARGGGGGHHHHHHHH!
I've actually noticed that McAfee picks up a similar virus on my pc when I'm checking e-mail. It seems to be connected to this e-mail message that going around purporting to be a security patch from Microsoft, 'cos it usually happens everytime I get one of these mails. And I know we had a few of them at work. Hmm, maybe the person who uses the pc opened one of them?

So, at the moment, it looks like I'm gonna have to rebuild. *SIGH*

Delphi91

Just went to McAfee.com and under their current threats, it mentioned the w32.swen.a@mm worm. It gives a method for killing and reversing its changes:

http://us.mcafee.com/virusInfo/default.asp?id=helpCenter&hcName=swen&cid=9060

Gonna try it on Monday - hopefully it'll work.

Mike