[nukkad] Removal of Trojan/IconDance

["Nami TVL" <>]

----------------------------------------------------------------------------
Tip of the day:  "It is well to remember that the entire universe, with
one trifling exception, is composed of others." -- John Andrew Holmes
----------------------------------------------------------------------------


Dear Nuks,

My system got infected with Joke.Troj.Icondance.  It was really a pain to work on a system infected with this trojan.  Basically this irritates the user my suffling the icons on the desktop.

I think this trojan puts a line in win.ini 
start=location.exe

Please note that location.exe is the file name which may vary from system to system.  Remove this line.  Reboot the system.  Arrange the icons you feel like!!

For this virus analyst aspirants giving below the details of virus.  

If any one of you got any other easier way of doing it, please let me know.

Bye
-newperson

Trojan/IconDance is a Trojan that works on Windows 9.x and Windows NT systems. When it is run it minimizes all open windows and moves all the icons on the Windows desktop. These icons will be arranged in a line that will move across the screen. Then, this line will follow the mouse pointer.


Means of Propagation
The file reaches the system as a file called ZAF_DANSE.EXE. However, occasionally, this name might be different at times. This files is 308224 bytes long and its icon is common to Delphi programs (a torch on a blue circle).

Symptoms of Infection
When the ZAF_DANSE.EXE file is run all open windows are minimized. Then, all the icons on the desktop will be arranged in a line and will start to move about the screen
 



------------------------------------------------------------------------------
To Subscribe [Unsubscribe] send a blank message to
        nukkad-list-request@mumbai-central.com
with the word 'subscribe' ['unsubscribe'] (without quotes) in the Subject
of your message.
The list is archived at  http://www.mumbai-central.com/nukkad/archive.html