How to remove Bifrost

Bifrost

Last Updated on Friday, 18 December 2009 05:24 Friday, 04 September 2009 08:06

Bifrost is a backdoor trojan horse family of more than 10 variants which can infect Windows 95 through Vista. Bifrost uses the typical server, server builder, and client backdoor program configuration to allow a remote attacker, who uses client, to execute arbitrary code on the compromised machine (which runs the server whose behavior can be controlled by the server editor). The visual indication of its infection is a folder named Bifrost on the infected computer. You can see the latest threatexpert sample analysis reports on this link

If you happen to have the virus installer, you can submit it to threatexpert site and get it analyzed. That will help you to get the precise information about the virus.

Trying system restore

If you know the duration since your computer is infected, you can try to restore your computer at a prior date, that will work like a miracle in removing the infection

Using system restore in windows XP
- Using system restore in windows Vista

Free removal tools

Special tools to remove a single virus or a family of virus.
Free Online virus scanners
Fully functioning antivirus/ antispyware

All these tools are listed below

Free tools for windows XP
- Free tools for windows Vista

Manual Removal

These are the steps to be taken, if you want to or need to remove the infected files manually

Boot in safe mode

Sometimes you will not be able to delete a file even if you find it, in that case you should boot in safe mode and then try to delete it/ them.

How to boot in safe in windows XP

How to boot in safe mode in windows Vista

Remove Processes from Task Manager

Press Ctrl Shift Esc to open Task Manager. See in the list of the processes for a processe/s named "server.exe" select if found and press the End Process button, confirm and then close the Task Manager.

Optionally you can use Windows Defender to see the path of a currently running program/ process and its publisher, so as to differentiate malware processes from windows genuine processes.

How to use Windows Defender in windows XP
- How to use Windows Defender in windows Vista

Removing entry from windows startup

The system configuration can be started in xp and in vista by typing msconfig in the run box/ start menu search box. In xp by clicking on Start > run . The windows startup is reversible, therefore you can check / uncheck any entry from windows startup any number of times.

After the system configuration window is open, Click on the Startup tab, that will list all the programs that are scheduled to start with windows. Expand the middle column using your mouse pointer so that you can see the full path of the program. Locate and uncheck "C:\Program Files\Bifrost\server.exe" "C:\Windows\Bifrost\server.exe" (look for any other suspicious names) Press Apply , Press Close/Ok , Select "Restart the computer" at the next prompt.

View Hidden Files

Before you could delete Bifrost and its associated files you need to search for them, and before doing that you need to enable to view hidden files and folders

How to Enable to View Hidden Files and Folders in Windows XP
- How to Enable to View Hidden Files and Folders in Windows Vista

Deleting files

After restarting the computer, use the windows search utility to search for "Bifrost". This search will find all its folders on the hard disk , delete the folders from the hard disk.

Variation1) see the threatexpert report
Created the following folder (delete it)
C:\Program Files\Bifrost\

Variation2) see the threatexpert report
C:\Windows\System32\Computers

Variation3) see the threatexpert report
C:\Windows\Bifrost

Delete all the above folders if found.

Run CCleaner

After deleting Bifrost and its associated files , as there will be leftover entries in the windows regitry. CCleaner is a free temp files/registry cleaner, that will automatically clean the registry as well as remove the temp files . Click here to read more

Edit Registry

if you are comfortable in using the regedit command. You can find the registry modifications in the reports given above

How to edit registry in windows XP
- How to edit registry in windows Vista

More Problems

If you are unable to open Task Manager, registry editor, system restore, Folder Options etc

If the virus has disabled them. There are free tools and techniques to solve this problem. They are listed here.

Tools for Windows XP

Tools for Windows Vista

Use the system file checker

If you want to make sure that the windows system files are not altered by the virus, and in case if they are altered then to repair them.

How to run System File checker utility in windows XP
- How to run System File checker utility in windows Vista

Unable to access security related sites

It can happen if your Hosts file has been altered. To repair/ edit the hosts file. Login as administrator. open the following file in notepad
C:\ WINDOWS \system32 \drivers \etc \hosts
remove anything other than 127.0.0.1 Localhost, and save and close the file.

Using Firewall

Check your firewall for any suspicious communication from your computer to the internet and block it using firewall. One of the sites that this virus tries to access is http://slog.bestsystemprotection.com/

Reference of threatexpert reports with permission from ThreatExpert.com