You are here: Home > Malware Photos from the Field – Issue #2

Malware Photos from the Field – Issue #2

By on September 1, 2009 in Anti-Malware HowTo

Well I’ve decided to post photos from at least one of my appointments each week along with a little story about the appointment. Here is this weeks.


Sally called me and said something got through her Avira and was preventing her from opening anything. At this point I knew she was infected with a rogue antivirus that prevents other .exe’s from loading. While this is fairly easy for me to get rid of it’s almost impossible for the average PC user.

When I arrived to Sally’s house I was greeted with a rogue antivirus screen.

Upon further inspection I can see the Rogue Antivirus has been installed to the All Users directory under application data. This is a very common installation path for exe terminating rogues (for now at least).

Let’s open that folder and take a look at the rogue inside…WOW! What a shock. A randomly named exe. Typical.

Next I proceded to load combofix…but wait…it’s not loading. Doh! We’re dealing with a rootkit. Lets rename combofix and try again. Still no dice. Ok…hmmm…lets reboot in safe mode. Nope. Fine…time to break out the anti-malware boot disc.

When my disc loads I immediately start SuperAntiSpyware and scan the System32 directory. SAS quickly lays waste to a few rootkits and some other malware. Once the rootkits are toast I reboot into safemode and peform my typical quick scans with SAS and MBAM.

Now that the malware has been removed from Sally’s PC we need to advise her to start using a sandbox when browsing the web because antivirus just isn’t enough right now (or ever again). I installed Sandboxie and configured the default sandbox to be emptied as soon as the browser closes. After a little training (like 5 minutes) Sally is a Sandboxie pro. I place two shortcuts on Sally’s desktop: Safe Internet and Non-Safe Internet.

Please +1 this post if you like me :)

About malwarekilla

View all posts by malwarekilla →

, , , , , ,

  • http://totalwebcontrol.blogspot.com/ Prasad

    Hey Matt am a fan of your anti-virus reviews. Good to see your line of action.hope to see some more of these in future.Btw am eagerly waiting for final release of avast, interface wise it just pawns every other free anti virus out there hope it outdoes others in terms of performance too ! Keep up the good work man !! God bless..

  • Vasilis

    Yeap,that’s the way to go.Sandboxie+a decent free antivirus.There is no need for heavy security suites and multiple security programs to get the job done.Simplicity and effectiveness.

  • Johan

    Hi Matt!

    I found another player on the cloud-based Antivirus market that you might would like to try out, Made by “Immunet”.
    Wich is FREE to use well.

    http://www.immunet.com/user/new

    They say you can install it “along-side” with ex AVG, Norton etc..
    Or use it alone.

    I would like to see how it stands up against the 10 URL’s…

  • http://t3chnophilia.blogspot.com Kaixi

    Cool! Dealing with rootkits is always fun (when it’s not your computer :) )

  • ryan

    she had some pretty nasty stuff… 3 rootkits im not sure if a computer can work after that o.o

  • Bo

    I’ve been putting GesWall free on client computers. It runs transparently and requires all but no training…and is free. I tell my computer illiterates that if they get infected, just reboot. That will cause Geswall to wipe whatever program (malware usually) is being isolated.

    The only problem is that clients with Geswall haven’t needed me again for virus removal. :(

  • 123zap

    Nice story with a good ending!

    @Johan, as far as I have tested, immunet really sucks. Detected zero of ten of my zero day malware.

  • malwarekilla

    @123zap – of course it does (for now and maybe forever). If the cloud is small then results will suck.

  • 123zap

    I think that there were only 70 people in the cloud when I saw it. There are only three guys behind the whole program though.

  • bogdan

    I’ve seen the malware in the 3-rd photo (Total Security rogue). It prevented any program to run unless it is named something like “explorer.exe”.

  • Dima

    Ahh i had almost the same problem 5 months ago when i were a newbie about malware and stuff i were getting tons of viruses and rootkits but now im in computers class now i didn’t got any malware passed my Avira AntiVir Premium + windows firewall :D on 1st computer and on my 2nd computer KAV2010 with windows firewall also nothing got passed them for 6 months now ;) now im learning how to use a Bootable Secure CD :)

    Good job Matt!! hope to see more videos from you.
    (sorry for the bad english)

  • Jonathan

    Hi,

    I am wondering how you would go about removing some thing like this in a remote session as a bootable CD is not an option, Would you use your “secret weapon (batch file)”?

    Jonathan

  • Johan

    @123zap

    Ok thanks for letting us know.
    Then let’s forgett about Immunet and focus on the other ones to come…

  • http://remotehelpexpert.com RHE

    So what do you do if the computer is running on Vista? Boot CD is only good for XP, right?

  • Jonathan

    @RHE – A Bootable will work on Vista, I have had trouble using it my new laptop with Vista but it works on my old laptop with Vista, i am not sure what the issue is with my new laptop it just goes to a “blue screen of death” on my new laptop when booting (strange?).

  • http://remotehelpexpert.com RHE

    @Jonathan: I guess I didn’t mention I meant the UBCD4Win bootable, which is what I assume Matt is using. Per UBCD4Win.com Vista is not in the list of supported OS… http://ubcd4win.com/faq.htm#require

  • Jimmy James

    The boot CD will work on anything it has the correct drivers for

  • Bo

    Yes, the UBCD4WIN will work on a Vista machine just fine… By ‘not supported’ they mean that you cannot use a Vista install disc as a source to create the UBCD4WIN.

  • http://remotehelpexpert.com RHE

    Oh OK, thanks for the clarification.

  • http://remotehelpexpert.com RHE

    TBH, I still prefer the method of extracting the hard disk and using my SATA/IDE to USB adapter to attach it to my laptop. With that I have the full range of utilities, av programs, online access, everything. And if I suspect my protection layers are not enough to keep my laptop from getting infected, I simply run the whole sanitation under a sandbox environment.

  • ThePro

    I remember installing that rouge for a test in a windows 2000 virtual machine, was fun to get rid of.

  • Joe

    Did this infection have the YOUR ARE INFECTED wallpaper?


Remove-Malware Traffic Stats