Jump to content


Photo
- - - - -

Cleaning up after Trojan.Ransom


  • This topic is locked This topic is locked
6 replies to this topic

#1 OCTurbine

OCTurbine

    New Member

  • Members
  • Pip
  • 4 posts
  • Gender:Not Telling

Posted 22 September 2012 - 03:29 PM

(Oops; misposted in the General Forum.)

Howdy, y'all,

One of my neighbors has an HP laptop running Win 7 Pro SP1 x64. Somehow it became infected with the Trojan.Ransom virus that took control of the machine and demanded "200$" from the "FBI" because of "illegal" downloading, etc. I ran the Windows Defender Offline utility in full-scan mode from a bootable USB stick. WDO didn't seem to work the first time; I ran it again, followed by a full scan with MBAM with the latest signatures.

MBAM reported 0 objects detected. I then ran RogueKiller that detected ZeroAccess, but registry entries and folders and files only. Lastly, I ran Gmer that found Bluetooth registry entries only, but didn't actually name a virus.

Here's the output from RogueKiller:
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 13 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND
[ZeroAccess][FILE] @ : C:\Users\Lindy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\@ --> FOUND
[ZeroAccess][FOLDER] U : C:\Users\Lindy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Users\Lindy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess ¤¤¤

Gmer's output:
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef@0007e034c3ea 0x69 0x10 0xBB 0x3A ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef@001a45fe6925 0xD1 0x86 0xFD 0x6E ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef@0007ab308052 0xE6 0xF9 0x4D 0xAE ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef@0007e034c3ea 0x69 0x10 0xBB 0x3A ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef@001a45fe6925 0xD1 0x86 0xFD 0x6E ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef@0007ab308052 0xE6 0xF9 0x4D 0xAE ...
---- EOF - GMER 1.0.15 ----

Can I manually delete everything that is reported here? Otherwise, the system is operating as expected.

I discovered an older Java JRE that's known to be vulnerable, so I uninstalled it. And I installed all of the pending Windows critical updates, including the latest Cumulative Update for IE8 discussed in Security Bulletin MS12-063.

Thanks for your suggestions.

#2 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,222 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 22 September 2012 - 05:00 PM

Welcome to the forum.

Can you post the complete log from RogueKiller, MrC

Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#3 OCTurbine

OCTurbine

    New Member

  • Members
  • Pip
  • 4 posts
  • Gender:Not Telling

Posted 25 September 2012 - 02:41 PM

Thanks for your reply, MrC.

Here's the output of RogueKiller. I copied and pasted from the text file created by RK after I last ran it:

RogueKiller V8.0.4 [09/19/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com
Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Andy [Admin rights]
Mode : Scan -- Date : 09/22/2012 10:51:14
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 13 ¤¤¤
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND
[ZeroAccess][FILE] @ : C:\Users\Andy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\@ --> FOUND
[ZeroAccess][FOLDER] U : C:\Users\Andy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Users\Andy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD5000BPVT-24HXZT3 ATA Device +++++
--- User ---
[MBR] 827f867b506c5053f3bd9a475507ae61
[BSP] 2789fe94f9d61be91673cd426a557e25 : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 452353 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 926828544 | Size: 24387 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: Sony Storage Media USB Device +++++
--- User ---
[MBR] 8d2f0b46608a6efebe70e59febe7e9f1
[BSP] 397f8d0a5c6094c0652366d6485dc9fb : Windows 7 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 32 | Size: 7628 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[1].txt >>

#4 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,222 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 25 September 2012 - 03:51 PM

Run RogueKiller again and click Files
When the scan completes > click on the Registry tab
Put a check next to all of these and uncheck the rest: (if found)

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND
[ZeroAccess][FILE] @ : C:\Users\Andy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\@ --> FOUND
[ZeroAccess][FOLDER] U : C:\Users\Andy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Users\Andy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOU


Now click Delete on the right hand column under Options

~~~~~~~~~~~~~~~~~~~~~~~~~

Then................


Please read the directions carefully so you don't end up deleting something that is good!!

Please download the latest version of TDSSKiller from here and save it to your Desktop.
  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    Posted Image
  • Put a checkmark beside loaded modules.

    Posted Image
  • A reboot will be needed to apply the changes. Do it.
  • TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  • Then click on Change parameters in TDSSKiller.
  • Check all boxes then click OK.

    Posted Image
  • Click the Start Scan button.

    Posted Image
  • The scan should take no longer than 2 minutes.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.

    Posted Image

    Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

    Posted Image

    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  • A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
  • Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:


If a suspicious object is detected, the default action will be Skip, click on Continue
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

MrC

Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#5 OCTurbine

OCTurbine

    New Member

  • Members
  • Pip
  • 4 posts
  • Gender:Not Telling

Posted 27 September 2012 - 01:44 PM

Good news, Mr. Chalee: Kaspersky TDSSKiller reports "No threats found."

I appreciate your assistance. I'll run TDSSKiller periodically on my own systems, and will recommend it to my friends.

I'll also try to find out why MS Security Essentials didn't detect the Trojan.Ransom.Gen when it was pushed to the laptop in question.

Nice-looking dogs.

#6 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,222 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 27 September 2012 - 02:33 PM

OK..........

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#7 Maurice Naggar

Maurice Naggar

    Staff

  • Moderators
  • PipPipPipPipPipPip
  • 14,550 posts
  • Gender:Male
  • Location:USA
  • Interests:Security, Windows, Windows Update, malware prevention

Posted 28 September 2012 - 07:48 AM

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!
Maurice Naggar
Product Support

staff.png

Follow us: Twitter, Become a fan: Facebook

I close my threads if there is 5 days without a response.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users