Also Known As: Win32.Parite.a [KAV], W32/Pate.a [McAfee], Win32.Pinfi.A [CA], PE_PARITE.A [Trend], W32/Parite-A [Sophos], Win32/Parite.A [RAV]
Type: Virus
Infection Length: ~177,917 bytes
Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Macintosh, OS/2, UNIX, Linux

TECHNICAL DETAILS

Upon executing a file infected with W32.Pinfi, the virus will perform the following:

1. Adds the registry value:

PINF

to the registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer

2. Appends itself to Explorer.exe to remain memory-resident.

3. Appends itself to all the .EXE and .SCR files that it finds on all the local and mapped drives. The virus contains an algorithm to slow the infection, so the virus will only infect a few files at a time.

4. W32.Pinfi will create a tempfile in the temporary folder. It will get the temporary folder by using a Windows API. The tempfile this virus creates will always have the following name:

[3 random letters][4 random hexadecimal digits].tmp

It will not get better, a new virus out
even before antivirus scanners are updated.

I like my computer, problem free.

Copied from another forum where they say this works.

First, run a full system scan. Then,
Click Start > Run > type regedit and click OK
Click the + next to the following keys:

HKEY_CURRENT_USER
Software
Microsoft
Windows
Current Version

Scroll down and click on the Explorer Folder (not the + sign) Look in the right hand window for PINF. Right click on this entry and click delete. Collapse the registry tree, close regedit and reboot.

Double click 'My Computer' icon and click 'Tools', 'Folder Options'.
Click the 'View' tab.
Check 'show hidden files and folders' and uncheck 'hide protected operating system files'.

Navigate to:
C:\Documents and Settings\joe\Local Settings\temp and delete the infected file.

daemon tools.exe, diablo 2 crack.exe, diet kazaa.exe, directx_9.exe, divx bundle +xvid.exe, battlefield1942_keygen.exe, aol_instant_messenger.exe, divx_bundle_package_crack.exe, icq hacks.exe, icq lite.exe, imesh 3.6.exe, kazaa hack v2.1.exe, kazaa lite (new).exe, kazaa lite 1.7.2.exe, kazaa lite_privacy_tool.exe, kazaa preview extractor.exe, KaZooM MP3 Kazaa Accelerator.exe, morpheus.exe, MSN_Messenger 5.0.exe, Nero Burning ROM 6.7.8.1.exe,
Nero Burning ROM_Keygen.exe, Net Pumper.exe
Pop-Up Stopper.exe, QuickTime_Pro_Crack.exe,
Serials_2003.exe, Spam Alarm.exe, Spybot-Search & Destroy.exe, Nero Burning ROM_Keygen.exe, Virtua Girls.exe, Winamp 3.8.exe, Windows Media player 9.5b.exe, Windows_2000_Keygen.exe, Windows_XP_Activation_Crack.exe, Windows_XP_Keygen.exe, WinMX.exe, WinRAR 3.5b.exe, Winzip_Crack.exe, WS_FTP_LE.exe, XBox Emulator.exe, XviD crack.exe, Yahoo Messenger.exe, ZoneAlarmPro_Crack.exe,
winrar_crack.exe

Like i said these are just some of the exe's that i jotted down. Almost sure that these were the source of my problems, I deleted them immediately. After that no *more* of my exe's were infected. I reinstalled what I could but IE still freezes all the time like the rest of yours do, and just today my WMP decided to stop working after reinstalling. And yes I did do the registry fix and delete the temp files, but as the theme around here seems to be, all my programs are permanently screwed and there is no way to fix what I can't reinstall. But nothing else is additionally being infected, nontheless, I still must face the dreaded reformat.

My point is basically to avoid any files that resemble these on kazaa, really avoid any exe's on kazaa, they are probably all screwed up. This may only be a win 98 se solution, I don't know, but see if your kazaa has the same 85 (hidden) shared files. If so, delete them immediately.

hope this helps...did for me ;)

Symantec needs to reclassify the w32.pinfi virus as "highly destructive", because I have the sinking feeling that the only solution is to order a restore disk (I have an HP pavilion that has the restore disk on a HD partition).

http://www.bitdefender.com

I'm not guaranteeing success, but i no longer have fluctuating free space.

Still thinking about that format though, just to be safe.

remove Parite.B

1,2mb

http://updates.pandasoftware.com/pq/gen/pariteb/pqremove.com

Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode (Windows 95/98/Me/2000/XP) of VGA mode (Windows NT).
Run a full system scan and repair all the files detected as W32.Pinfi.
Reverse the value that the virus added to the registry.

For specific details on each of these procedures, read the following instructions.

1. Disabling System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
"How to disable or enable Windows Me System Restore"
"How to turn off or turn on Windows XP System Restore"

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.

2. Updating the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:
Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

3. Restarting the computer in Safe mode or VGA mode
For Windows 95, 98, Me, 2000, or XP users, restart the computer in Safe mode. For instructions, refer to the document, "How to start the computer in Safe Mode."
For Windows NT 4 users, restart the computer in VGA mode.

4. Scanning for and repairing the infected files
Start your Symantec antivirus software and make sure that it is configured to scan all the files.
For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec corporate antivirus product is set to scan all files."
Run a full system scan.
If any files are detected as infected with W32.Pinfi, click Repair.

5. Reversing the value from the registry

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit, and then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

01. In simple terms, start in safe mode then go to my documents and setting, to the administratotrs folder and delete anything in temp folder.

02. Click Start, and then click Run. (The Run dialog box appears.)
Type regedit, and then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

In the right pane, delete the value: PINF
Exit the Registry Editor.

3. If you have Norton on a Cd-Rom do a fresh instal and scan your system. Delete all files in the quarantine folder.

4. Restart and unistal Norton and delte all files related to Norton.

5. Do another fresh instal of Norton and update t your virus definition if you dont have internet connection you can update from a friends pc with norton and copy that file and replace the old file.

how do you repair the files? (without having to delete them afterwards)

Kaaza didn't create and distribute this virus!

ALWAYS, ALWAYS, ALWAYS scan every file you download, executable or not, BEFORE you open them!! I actually use 2 or 3 different scanners before I do as a precaution.

If people are going to download and run programs such as the one guy on here who actually said he tried the WinRAR_Crack, you've got to expect that they'll be infected.

Now, with the recording industry going after people I wouldn't be suprised if they are distributing bogus, possibly virus infected matieral and programs.