Wednesday, May 8, 2019

Malware Removal 101: Worm (Files.bat)

I got this sample a few days ago from a customer's USB drive:

Virustotal

User's files and folders are replaced with shortcuts. Files are hidden and moved to Files folder.

Manual Removal

Using System Explorer, terminate the running malware process. If you have multiple running instances of the worm, select the parent process and End Process Tree instead.

Locate the files using CCleaner. Select Start.lnk | Right click and click on File Directory Explore.

Delete all files including the parent folder.

Using Explorer, delete at shortcut in your USB drive.

Unhiding the files. You can use Attrib or Explorer.

Attrib

Launch CMD and type the following:

CD drive:

ATTRIB -S -H /S /D

Replace drive: with the corresponding drive assignment of your USB drive. Ex. F:

Explorer

At Folder Options enable Show hidden files, folders and drives

Navigate to Files folder

Move all files and folders to your root directory

Select all hidden folders and unhide using Properties

Delete Files folder

Back at System Explorer delete Start.lnk

Note: If you have multiple instances of the malware running in memory, do not use TaskMan to terminate its process because there is a chance that your PC would reboot. Use System Explorer instead. Suspend all processes first then end them one by one.

POST: Scan your system and USB drives with an updated Antivirus.

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

The Information is provided on an "as is" basis. WinXPert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, WinXPert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2019 WinXPert. All rights reserved. All other trademarks are the sole property of their respective owners.

To GOD be the glory!

Sunday, May 5, 2019

Malware Removal 101: Facebook Worm

I think you are familiar with this post.

Virustotal

Your PC would only be affected if you do the following:

You clicked and downloaded the file. (The sample I got is video_68080.bz. Note that filename may vary)
You extracted or clicked on the archive and launch the file (play_29732727.mp4.com)

Correction: It's a .com file.

Running the worm creates the following files.

Starts with Windows via registry entry.

What it does is post Wow videos post in different Facebook groups without the user's knowledge.

Other changes in the registry:

Keys added:

HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations
HKU\S-1-5-21-628660338-905938160-2927024020-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
HKU\S-1-5-21-628660338-905938160-2927024020-1000\Software\Unzip

Values added:

HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32\EnableFileTracing: 0x00000000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32\EnableConsoleTracing: 0x00000000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32\FileTracingMask: 0xFFFF0000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32\ConsoleTracingMask: 0xFFFF0000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32\MaxFileSize: 0x00100000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASAPI32\FileDirectory: "%windir%\tracing"
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS\EnableFileTracing: 0x00000000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS\EnableConsoleTracing: 0x00000000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS\FileTracingMask: 0xFFFF0000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS\ConsoleTracingMask: 0xFFFF0000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS\MaxFileSize: 0x00100000
HKLM\SOFTWARE\Microsoft\Tracing\play_29732727_RASMANCS\FileDirectory: "%windir%\tracing"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes: ".exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ggle Updater: "C:\Users\Arnel\AppData\Roaming\Arnel\app.exe"

Files added:

C:\Users\Arnel\AppData\Roaming\Arnel\7za.exe
C:\Users\Arnel\AppData\Roaming\Arnel\app.exe
C:\Users\Arnel\AppData\Roaming\Arnel\background.js
C:\Users\Arnel\AppData\Roaming\Arnel\config.json
C:\Users\Arnel\AppData\Roaming\Arnel\files.7z
C:\Users\Arnel\AppData\Roaming\Arnel\manifest.json
C:\Users\Arnel\AppData\Roaming\Arnel\update-x64.exe
C:\Users\Arnel\AppData\Roaming\Arnel\update-x86.exe

Folders added:

C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low
C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5
C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\2LXBY3LA
C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\2YQU29T2
C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5KFJB9OR
C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZL3SUC12
C:\Users\Arnel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized
C:\Users\Arnel\AppData\Local\Temp\Low
C:\Users\Arnel\AppData\Roaming\Arnel

Note: I got this error message because I don't have chrome on my PC. Plus I have to turn off my antivirus because the worm is detected by McAfee Internet Security and never got pass the extraction stage.

Removal Instructions:

Terminating the running process:

Note: Since I am testing this malware, I'll be terminating the file I've run. Terminate app.exe instead since it's the file that starts with Windows..

Let's use CCleaner to remove the worm.

Launch CCleaner
Goto Tools | Startup
Highlight Ggle Update
Right Click and Select Open Containing Folder
Still on CCleaner, click on Delete button on the right

At Explorer, select all files and delete.

Restart your computer.

On boot scan with an updated antivirus.

POST: Clean your temps

I'll try to run this file on Windows 10 and report the changes it made on this OS.

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

Copyright © 2019 WinXPert. All rights reserved. All other trademarks are the sole property of their respective owners.

To GOD be the glory!

Saturday, May 4, 2019

Malware Removal 101: Rotinom

Problem: Drive C is running out of disk space every time you insert an external HDD or a USB drive? Chances are you are infected with Rotinom.

Virustotal

What it does to your computer:

Starts with windows

Makes a copy of all files from USB drive to Rotinom folder on Drive C: thus reducing its free space.

Infects USB or external drives. Hides all folders and replaces them with shortcuts.

Notice the difference in the icons.

Changes in the registry:

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Name: Startup
Value: C:\Users\admin\AppData\Local\Start

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Name: Startup
Value: C:\Users\admin\AppData\Local\Start

Manual Removal Instruction:

Since TaskMan is not disabled, we can use it to terminate update.exe.

Navigate to "%LocalAppData%\Start" and delete update.exe

Search for Rotinom folder. Easiest way to do that is search using Everything.

Delete the folder. Also delete its parent folder. Empty you Recycle Bin

Cleaning USB and external drives:

Delete all files associated with Rotinom. All *.exe files with folder icon and also the Usb 2.0 Driver folder.

POST:

Scan with an updated Antivirus/Antimalware.

Unhide files and folders at the CMD prompt.

ATTRIB -S -H /S /D

Repair the registry. Replace the value indicated in blue.

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Name: Startup
Value: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu

Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Name: Startup
Value: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

Copyright © 2019 WinXPert. All rights reserved. All other trademarks are the sole property of their respective owners.

To GOD be the glory!

Portable Antivirus: Avira PC Cleaner

On yesterdays post I mentioned about Avira PC Cleaner. Here is a guide for those not familiar with this program.

Download the program

Launch avira_pc_cleaner_en.exe

After finishing the download, you'll be greeted with this screen. You the option of scanning or copying to a USB Device

Scanning

Copying to USB Device

Now that you have a copy in your USB drive, all you need to do is run Cleaner-launcher.exe located at the root directory of your USB drive. It will update before first before you can scan. I regularly update this program just in case I use it in a PC without internet connection due to malware.

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

Copyright © 2019 WinXPert. All rights reserved. All other trademarks are the sole property of their respective owners.

To GOD be the glory!

Thursday, May 2, 2019

Malware Removal 101

It's been a long time since my last post so here goes.

Here are the lists of techniques you can do to remove malwares. Some of these are easy no brainer, to moderately difficult to extremely hard (for the average Joe, and some technicians included).

Here are the easiest solution though you need some preparations for these to work like downloading the iso and burning or making a bootable USB drive.

Using a Bootable CD/DVD/USB of any AntiVirus. Advisable to update the antivirus signatures before scanning. Here are a few examples:

Booting on a Live Windows environment and running an updated Portable AV like Avira PC Cleaner or Emsisoft Emenrgency Kit

Performing a scheduled Boot Scan (Ex. Avast!)

Booting in Safe Mode with Networking and running MBAM Chameleon

I'll add Hiren's Boot CD. Unless you have the latest version of an antivirus with the option of updating the AV signatures, you might miss a zero-day malware or newer strains by scanning with an outdated AV. (Note: I use HBCD ver. 10 so I never use it for scanning)

Scanning the infected HDD as a slave on a clean system with updated antivirus

This one requires that you know where to look for malwares

Booting with Live Windows CD/DVD or any Linux distro and manually deleting the malware that starts with Windows. With Windows, I'd start with the registry (research offline registry editing) and work my way in reverse. If you don't know your way around the registry, you can use programs like Autoruns. For Linux, I'll look for the usual places where a malware may reside. Temp folder is a good place to start.

There are times when malware will not let you boot in Safe Mode, in cases that you can, you can try the following:

Boot in Safe Mode with Networking so you can update your antivirus prior to scanning.

Last is removing the malware while it is active in memory in Normal Mode. The steps are simple.

Search and Destroy

Search - Using Tasklist, TaskMan or any similar program to look for suspicious running processes. Or other suspicious programs that starts with Windows

Mostly these are processes with gibberish filename (Ex. sfhkewj.exe)
Something that looks like a legit Windows file but in the wrong place (Ex. C:\Windows\System\csrss.exe)
Shortcuts, *.pif or *.vbs/vbe in Startup folder
Other programs that starts from AppData or Temp folders

Destroy - Terminating the running malware processes using TaskMan or similar app and deleting the malware plus other drop files.

Another way to look for malware file location is to look at the registry. Here are some of the key locations:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Using enumerators or AV tools to look for malware. You base your search on the report logs

OTL
RunScanner - Some say this is obsolete but I still use it and still works for me
Farbar Recovery Scan Tool (FRST)
HiJackThis Fork - Still works for low to medium risk malware
Spyderman - A short script I wrote to look for Brontok worm

After you terminated the malware from running, it's time to do a scan using an updated antivirus/antimalware

Scan also all external/USB drives. Unhide all folders and files in case you were infected with a shortcut worm like Ramnit.

Note: For other high risks malware/worm (Ex. sality, virut) always use a dedicated removal tool.

Other tools for malware removal worth mentioning that I still use:

File Assassin - Use this to delete stubborn malware
Unlocker - Same function as File Assassin
Blitzblank - My Go tool when File Assassin or Unlocker failed to delete malware. Must have prior knowledge of files and registry items to delete.

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

Saturday, September 3, 2016

How to remove ramnit

Type of file: exefile
Description: Random filename
Location: Startup Folder
Size: 101872 b
MD5: F3873258A4258A6761DC54D47463182F

What it does:

Starts with Windows
Infects exe, dll and html files
Worm spreads via the default web browser
Create 4 shortcuts on external drives
Create copies of itself at the RECYCLER folder on external drives

Manual removal instructions

These instructions are specific to this variant of Ramnit.

1. Terminate the malware process using Taskman or Taskkill

TASKKILL /F /IM FIREFOX.EXE*

* Replace filename with your default web browser

2. Delete the worm located at the Startup folder. Filename is random.exe.

3. Delete all shortcuts and RECYCLER folder on external drives.

4. Scan with an updated antivirus.

Note: DO NOT SCAN while malware is active in memory.
Do not use Smadav (Very low detection with high False Positive)

To GOD be the glory!

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.

The Information is provided on an "as is" basis. WinXPert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, WinXPert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.

Copyright © 2016 WinXPert. All rights reserved. All other trademarks are the sole property of their respective owners.

How to Remove Microsoft

by WinXPert

Analysis:

Type of file: exefile
Description:
Location: C:\WINDOWS\Microsoft\
Size: 3911179 b
MD5: 089D11B01A4C81EDEAB6C582D297D2E9
Attributes: Archive, Hidden, System, Read-Only
File Version: 1.00.0003
Company: By: Morgan Haueisen
Copyright: Copyright (c) 2003
Product Name: USA Quiz
Product Version: 1.00.0003
Original File Name: New.exe
Trademarks:
Internal Name: New
Comments:

Disables Registry Editor

Known system changes:

C:\Documents and Settings\Owner\Application Data\logs.dat
C:\Documents and Settings\Owner\Local Settings\Temp\UuU.uUu
C:\Documents and Settings\Owner\Local Settings\Temp\XxX.xXx
C:\WINDOWS\Microsoft\Microsoft.exe

C:\Documents and Settings\All Users\Application Data\TEMP
C:\WINDOWS\Microsoft

HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\Implemented Categories
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\Implemented Categories\{00021492-0000-0000-C000-000000000046}
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\InProcServer32
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{FHC6186D-X430-3B61-3HFS-4K1554TSXEV6}
HKLM\SOFTWARE\Licenses
HKCU\Software\nagato

HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\: "&Links"
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\MenuTextPUI: "@browselc.dll,-13138"
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\InProcServer32\: "%SystemRoot%\system32\SHELL32.dll"
HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}\InProcServer32\ThreadingModel: "Apartment"
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{FHC6186D-X430-3B61-3HFS-4K1554TSXEV6}\StubPath: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKLM\SOFTWARE\Licenses\{K7C0DB872A3F777C0}: random data
HKLM\SOFTWARE\Licenses\{I054347D90A928356}: 06 00 00 00
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\System: "C:\WINDOWS\Microsoft\Microsoft.exe"
HKCU\Software\nagato\FirstExecution: "31/08/2014 -- 12:24"
HKCU\Software\nagato\NewIdentification: "nagato"

Visit WinXPert's BubbleWS Page

Manual Removal Instructions for Microsoft:

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

Make sure you create a System Restore point before proceeding:

1. Download Kill_Microsoft.bat and copy it to your Startup folder

2. Log-off and log-on. The batch file will run in an endless loop. Allow it to run for a few second until no more Microsoft.exe processes are being terminated.

3. Delete the following files.

    del "%appdata%\\logs.dat" /f
    del "%\Temp%\UuU.uUu" /f
    del "%Temp%\XxX.xXx" /f
    del "%windir%\Microsoft\Microsoft.exe" /f

4. Repair the system registry using the following commands.

    reg delete "HKLM\SOFTWARE\Classes\CLSID\{24AA3079-047E-4182-047E-4182047E4182}" /f
    reg delete "HKLM\SOFTWARE\Licenses" /f
    reg delete "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{FHC6186D-X430-3B61-3HFS-4K1554TSXEV6}" /f
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /f
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System" /f
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "System32" /f
    reg delete "HKCU\SOFTWARE\nagato" /f

5. Delete the following folder. Clean your temps using TFC or CCleaner

rd "%WINDIR%\Microsoft" /s /q

6. Update your antivirus/antimalware program and perform a full scan of the computer.

All content ("Information") contained in this report is the copyrighted work of WinXPert: Virus and Malware Removal.