.jeefo should go at the end of your name, or win32. at the beginning, or both, or none. Lightning-Galba deserves all the credit for the idea of this group.

A clan to support the awareness of Win32.jeefo! Don't let it get you!

Win32.Jeefo.A is a virus that infects PE files.

Once activated, it copies itself as SVCHOST.EXE to the Windows directory, launches it as a separate process, then passes control back to the host program. The virus then installs itself as a service to stay in memory. The following registry key is created on Win9x systems:

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\PowerManager, = "%Windows%\SVCHOST.EXE"

On Win2k, the service name is "Power Manager":

HKLM\System\CurrentControlSet\Services\PowerManager\ImagePath, "%Windows%\svchost.exe"

Note that SVCHOST.EXE is a valid system filename that exists in the System directory. The virus-created SVCHOST.EXE contains only the virus itself and is 36,352 bytes in size.

The virus searches drive letters C to Z for fixed disks. Once found, all directories are searched for suitable PE file to infect. Infected files increase 36,352 bytes in size, but the last modified date and time remains the same.

The virus body contains the following hidden message (although this is never displayed to the user):

"Hidden Dragon virus. Born in a tropical swamp."

Note: The virus may corrupt some files. Such files may not work correctly after cleaning and removal of the virus code. The corrupted programs will need to be restored from backups or the original installation packages.

*note* we do not support win32.jeefo or any part of this virus. In fact, most of the people in the SouthWest clan were infected by it. if you read the above article the virus infects all executables it deems usable and corrupts them. It may not be noticeable in some programs, other times it may cause them to stop working. it spreads throughout your hard drive and must be stopped as soon as there is any sign of it. this clan is not made for support of the virus, but rather a clan to support awareness. i thought most people had a mind to know that by themselves, but some people are so overprotective and insecure, that they cannot even use a little common sense in a situation like this.


Thank you,
~Butternut~

If you have a question, ask an admin. Also, if you actually do get infected with win32.jeefo, then really, REALLY get the help of an admin ASAP.

Win32.Jeefo virus information[ca.com]