Backdoor BREPLIBOT.C

This memory-resident backdoor arrives on a system as an attachment in spammed email messages. It may also arrive as a dropped or downloaded file from a remote malicious user. Upon execution, this backdoor drops a copy of itself in the Windows system folder.This backdoor uses Digital Rights Management (DRM) Software, which is a form of rootkit technology, in an attempt to hide malware-related files, folders, and processes.

Read More

Hacking Tool

Rootkits are used to hide system information, such as running processes, files, or registry entries. This technology is used in creating a tools that helps in hacking other machines. First 4 Internet Ltd has developed a tool that is a valid Digital Rights Management Software package. As a standalone application, it is non-malicious but some of the malicious application use it to hide their infiltrated files and auto start registry entries thus making the detection more difficult.

This rootkit is  installed in :C:" that is system folder and in windows sub-folder using a file name ARIES.SYS. The said rootkit is then executed as a service by an installation package and is configured to execute at every system startup by creating the following registry entries

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\$sys$aries 

This hides files folders and registry keys the begin with the string $sys$ in the Windows operating system. This prevents the user from viewing any files, folders and registry keys that begin with the said string.

There are two malware that will utilize this tool BKDR_BREPLIBOT.C , BKDR_BREPLIBOT.D. 

Removal: 

Take a back up of registry before you edit any thing in registry for this tool. Disable System Restore.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services
3. Still in the left panel, locate and delete the subkey:
   $sys$aries
4. Close Registry Editor.

Scan your computer in safe mode with a good anti-virus like Trend Micro, Symantec to remove the files that are installed by malware that uses this tool and also this tool. Even online scanners like Housecall, Rootkit revealer, avast online scanner etc will detect this tool and will remove it.

Read More

Removal of NETSKY

This is a Email virus that comes in email attachments and just opening the email will affect the system.We have to find the malware program first. There are many automatic cleaner programs from Trend Micro, Symantec, or Kaspersky etc but preferably manual removal will give us a better cleaning of the file.

Read More

Net Sky Worm

This NETSKY variant spreads via email as a .PIF attachment and gathers email addresses from the files with Different extensions on all the drives.The email message it sends out has varying subjects, message bodies and attachment file names. This worm also deletes several autorun registry entries associated with the following malware in an attempt to prevent their automatic execution.

Read More

TSPY_ARDAMAX.HR

This is the additional infection that infects as a result of exploit HTML_SHELLCOD.SM which will be as a result of IE vulnerability. It steals information and sends it to FTP servers from where some malicious codes that run multiple routines on the infected systems. It logs keystrokes and accesses certain sites and chat logs, which further compromises a user’s privacy.

Read More

Virus that infects Executable Files

This is a virus that will spread  through computers. This file infector may be downloaded by other malware/grayware/spyware from remote sites. This comes with HTML_SHELLCOD.SM exploit that will allow 6more infections along with this. It drops a file that contains the main malicious code and is detected as PE_PARITE.A-O.

Read More

TROJ_GAMETHI.FMS

This is a Trojan Horse that will come in disguise of the users. Trojans are usually downloaded from the Internet and installed by unsuspecting users with or without their consent.Trojans typically carry payloads or other malicious actions that can range from the mildly annoying to the irreparably destructive. They may also modify system settings to automatically start. Restoring affected systems may require procedures other than scanning with an anti-virus program.

This comes in a combination of malware when there is an exploit HTML_SHELLCOD.SM. It brings 8 infections out of which Troj_GAMETHI.FMS is one of them. 


Effects:
This trojan drops copies of itself in system32 folder with a name

• fqtkz.exe

It creates the following registry keys 

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\Internet Explorer\Main
  TabProcGrowth = "0"
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\URL
  SystemMgr = "Del"

Removal:

1) Disable system restore.
2) Use Process explorer tool to find the processes that are related to the Trojan.
3) If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode.
Search and delete the registry keys

• In HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
  Internet Explorer\Main
  • TabProcGrowth = "0"
• In HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\
  Windows\CURRENTVERSION\URL
  • SystemMgr = "Del"
   

Delete the files that are dropped by the trojan in the system 32 folder. Uncheck Hide protected operating system files in Folders Option>View tab, and then check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result as the trojan may apply the hidden attributes to the files it dropped.

Read More