Jump to content


Photo
- - - - -

Removal instructions for Trojan Ransom.NoExe


  • Please log in to reply
No replies to this topic

#1 Metallica

Metallica

    Elite Member

  • Moderators
  • PipPipPipPipPip
  • 818 posts
  • Gender:Male
  • Location:Netherlands

Posted 27 June 2010 - 08:00 AM

What is Ransom.NoExe?

The Malwarebytes research team has determined that Ransom.NoExe is a ransom malware application. These programs take control of key files or even an entire computer in order to extort money from the victims.

How do I know if I am infected with Ransom.NoExe?

This is how the main screen of the ransom infection looks:

Posted Image

This will cover your entire screen, so you can not see your desktop or taskbar.

How did Ransom.NoExe get on my computer?

Malware uses different methods for spreading themselves. This particular one was installed by a trojan.

How do I remove Ransom.NoExe?

Our program Malwarebytes' Anti-Malware can detect and remove this ransomware.
  • Please download Malwarebytes' Anti-Malware to your desktop or transfer it there from removable media.
  • Now make sure extensions are shown. To do this, please look here
  • Then rename the mbam-setup.exe: Posted Image to mbam-setup.com: Posted Image
  • Then launch mbam-setup.com in order to install Malwarebytes' Anti-malware
  • On some infected computers the WinKey is still functional. If this is the case you can use the combinations WinKey+R or Winkey+E to navigate to, and rename the installer.
  • If not you will have to do this part in safe mode as explained below.
    • Turn the computer on or Restart the computer
    • Start tapping the F8 key. The Windows Advanced Boot Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe mode option is selected, not Repair Your Computer
    • Press Enter. The computer then begins to start in Safe mode.
  • Once Malwarebytes' Anti-Malware is installed, navigate to your Program Files\Malwarebytes' Anti-Malware folder and locate the mbam.exe in there:

    Posted Image
  • rename it to mbam.com:

    Posted Image
  • Now doubleclick mbam.com to launch Malwarebytes' Anti-malware.
    • Click the "Update" tab and click the "Check For updates" button.
    • Once the program has loaded and updates were downloaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart, so please allow MBAM to restart.
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • This should get rid of your problem.
  • You will be prompted to reboot the computer. Once this has been done, please rename mbam.com back to mbam.exe.
  • You'll see that it will be able to run again.
Is there anything else I need to do to get rid of Ransom.NoExe?
  • No, Malwarebytes' Anti-Malware removes Ransom.NoExe completely.

How would the full version of Malwarebytes' Anti-Malware help protect me?

We hope our application has helped you eradicate this malicious software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes' Anti-Malware for additional protection.

As you can see below the full version of Malwarebytes' Anti-Malware would have protected you against the Ransom.NoExe trojan. It would have warned you before the trojan could install itself, giving you a chance to stop it before it became too late.


Posted Image

Technical details for experts

Signs in a HijackThis log:
O4 - HKLM\..\Run: [explorer.exe] C:\WINDOWS\explorer.exe

Alterations made by the installer:
File System
  ===============
	In the existing folder C:\Documents and Settings\{username}\Local Settings\Temp
	  Adds the file tmp1.tmp"="12:50 20/06/10 3072 bytes
	In the existing folder C:\WINDOWS
	  Adds the file NoExe.exe"="19:25 19/06/10 14848 bytes

  Registry
  ===============
	[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
	  "(Default)"="'C:\WINDOWS\NoExe.exe'"
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
	  "explorer.exe"="'C:\WINDOWS\explorer.exe'"

Malwarebytes' Anti-Malware log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4217

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

6/20/2010 12:59:55 PM
mbam-log-2010-06-20 (12-59-55).txt

Scan type: Quick scan
Objects scanned: 110270
Time elapsed: 3 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\NoExe.exe (Trojan.Ransom) -> Quarantined and deleted successfully.

As mentioned before the full version of Malwarebytes' Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Pieter Arntz
Malwarebytes Blogger

Posted Image

Follow us: Twitter, Become a fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users