A coworker today ended up with a virus on his box while trying to find a javascript. I'm not entirely sure what he did but before he knew it his box was infected and throwing some some nasty little messages telling him to pay for software to remove it. The virus, once running, executes some pretty thoughtful techniques to stop you from getting rid of it. I haven't found much online to really help since apparently this has only been out a few days (going by when the most recent postings I found were dated) so I am typing this up just in case it should be helpful. We initially thought that it was the Smitfraud virus but most of the known fixes didn't seem to work on getting rid of it. Here are the characteristics of the virus:
- No access to run in the start menu
- No access to control panel in the start menu
- No access to task manager, even when trying to execute from the system folder
- Homepages in IE and FF are changed
- Search results, such as google, will return porographic material instead of actual results
- Running the smitfraud removal tools disabled unless the folder has been renamed
- Annoying popup every so often telling you there is a "Windows Security Alert" with a warning reading "Your computer is making unauthorized copies of your system and Internet files. Run full scan now to pervent any unauthorised access to your files! Click YES to download spyware remover ..."
The fix? Well since we couldn't access the task manager to shut off the executable we downloaded three applications to gain access to shut down the processes. You can download them here:
I suggest you reboot the machine and log in using safe mode (mash F8 when the computer is booting). We logged in with the normal account experiencing the issues since we did not have an actual machine account. What you need to do is first shut down the executables running in memory, here is a list of applications to kill (using Process Explorer's kill tree command).
- infos.exe
- winter.exe
- proper.exe
- autos.exe
- there is also a .reg file containing winter.exe that was installed telling the computer to add it to the autorun application list (sorry, we don't happen to have the name)
Next you want to kill the autorun entries for the following using autorun (right click each entry and delete them all):
- infos.exe
- winter.exe
- proper.exe
- autos.exe
- skun.dat
- bronto.dll
Once you have completed the above go into your C:\WINDOWS\system32 folder and delete these files from your hard drive so they cannot run again. You can sort by date to find the ".reg" file I mentioned. If you open it with notepad you will see where it added an entry to run winter.exe when your machine is started.
Now run the combofix executable listed above and let it go through all the cleaning processes. Lastly, we completely deleted the prefetch folder that had a few references to these files in C:\windows\prefetch. We rebooted the machine and TADA no more issues...
I hope this helps someone.
