After having removed the scardstp.dll file from my system 32 folder and doing a full scan of my drives yesterday, I was relieved but still a bit worried. I’m aware that i have to edit my registry and delete the values added by Backdoor.Coreflood. I didn’t do it yesterday. I was too tired. I finally got around to doing it today.
Before doing anything to my registry I decided to check the Backdoor.Coreflood information page at Symantec Security Response again. I have checked that page so many times in the past few days but i checked the page again nevertheless just to see if i had somehow missed something. To my surprise,i saw that the technical information and removal instructions had been updated on the 8th, i.e yesterday. It was not updated yesterday when I had checked that info page. :confusion: Then again, it is the Symantec United States website. Mauritius is about 8 hrs or more ahead. ( time zone differences)
I notice that they modified step 4:
4. Run a full system scan.
If any files are detected as infected with Backdoor.Coreflood, write down the full path to and the file name of the infected file or files.
Important: Do not skip this step. You will need the file names later in the removal.
Click Delete.
If your Symantec antivirus product reports that it cannot delete an infected file, proceed to section 5 (modifying the registry), then restart the computer and manually delete the file.
< -- This part has been added.
I did step 5 today, Reversing the Changes Made to the Registry.
5. Click Start > Run. Type regedit ,then click OK.
Navigate to the key:
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run
In the right pane, delete any value that refers to any files that were detected as Backdoor.Coreflood.
< -- This was in the original Backdoor.Coreflood page. In fact, it was the only thing they said to delete in the registry. Since i did not have any registry entries which was pointing to the dll file, I was quite a loss of what to do the other day.
The updated part:
Note: All the variants do not add an entry to this key.
Navigate to and select the key:
HKEY_LOCAL_MACHINE/Software/Classes/CLSID
Click Edit > Find.
In the “Find what” box, type the file name of the .dll file that was detected as Backdoor.Coreflood in section 4.
If you find an entry of the form:
“(Default)”=”%System%/< detected file name >.dll in the registry key:
HKEY_LOCAL_MACHINE/Software/Classes/CLSID/{< random clsid >}/InProcServer32 then write down the < random clsid > value >
Then, in the left pane, delete the subkey:
HKEY_LOCAL_MACHINE/Software/Classes/CLSID/{< random clsid >}
Next, click Edit > Find to repeat the search, as there may be more than one such key. Delete any that are found.
I found 05DCA568-15BF-76C1-DED2-FC2A429F800D on my first search
and
52F82601-784E-5F74-268B-21BF713CF7AA1BF713CF7AA on my second search.
I deleted them promptly.
I did the Search again and in ComDlg32/OpenSave/MRU/*, I found the value i with path referring to that scardstp.dll file. I deleted that registry entry i and did another search. This time in ComDlg32/OpenSave/MRU/dll, i saw another registry entry with path to scardstp.dll I deleted this one too. There was nothing mentioned about these two in the information page but I’m confident i did the right thing. -crossed fingers-
Navigate to and delete the key:
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/
Explorer/Browser Helper Objects/{< random clsid >}
where {< random clsid >} matches one of the values found and deleted in the previous searches.
In my case, it was
52F82601-784E-5F74-268B-21BF713CF7AA1BF713CF7AA
.
Navigate to and delete the key:
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/
Explorer/ShellIconOverlayIdentifiers/< detected file name >
Note: < detected file name > should match the name of the infected dll file.
Mine was scardstp.dll so i deleted
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/
Explorer/ShellIconOverlayIdentifiers/scardstp
Exit the Registry Editor.
Restart the computer.
If you could not delete any files in section 4, use Windows Explorer to locate and delete them.
< -Since I had already deleted the dll file in system 32, I did not have to do this again.
Now the next thing I’m gonna do is download ZoneAlarm. In the free version i get the option of trying ZoneAlarm Pro for 15 days and then switching to the free version after those 15 days trial. Maybe I’ll keep on using ZoneAlarm Pro. I really need a good firewall. My brother David and my friend James recommended ZoneAlarm.
my previous entries related to this:
link 1
link 2