Rootkit.KInject is a sexy new virus. Let's talk about notable viruses we have recently encountered

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Rootkit.KInject is a sexy new virus. Let's talk about notable viruses we have recently encountered

brc64: Mar 21, 2008; I wear my sunglasses at night.

Casao posted:

You might've been running SP3, but unless these Chinese gold farmers know of some jpg exploit that nobody else in the universe does, you didn't get it via a jpg, you got it from doing something else. Probably something stupid, too.

I vaguely remember reading that the gdiplus.dll file that's at risk is used by a lot of 3rd party apps as well, so I guess it's possible if he was using a 3rd party image viewing application with an unpatched DLL... yeah, I dunno.

My least favorite question to answer clients is "how did I get infected?" There's never a good way to answer that.

# ¿ Dec 17, 2008 14:56

Adbot: ADBOT LOVES YOU

# ¿ May 21, 2024 00:36

brc64: Mar 21, 2008; I wear my sunglasses at night.

hyperborean posted:

Oh drat, explorer.exe is a backdoor! You better delete that right away!

# ¿ Dec 18, 2008 17:13

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

I have a text file somewhere of the fake-chkdsk results that some malware put out. At first glance the formatting was all correct, but the results give him something like twelve petabytes of disk storage, eighteen petabytes of which (yes, I know) is "dirty" and needs to be "e-cleaned".

I hope he has a fast harddrive, because that's going to take a while.

# ¿ Dec 18, 2008 17:53

brc64: Mar 21, 2008; I wear my sunglasses at night.

hyperborean posted:

avast!, Avira, Antivir, AVG (in order of my personal preference). Someone linked this site in another thread, it's great for making your own pick based on hard numbers from extensive testing.

I've been liking VIPRE Enterprise in my tests, but the decision makers don't want to invest a new product (that's less expensive, easier to manage and would make us more money), so we're stuck with a product that's only compatible with Windows Server 2008 if you use the beta. Yay!

# ¿ Dec 18, 2008 19:28

brc64: Mar 21, 2008; I wear my sunglasses at night.

Hillridge posted:

I'd flatten and reinstall if it didn't take so long to get everything back to the way it was. First you have to install the OS and apply all the updates, which includes what seems like 50 reboots. You can save a little time by slip streaming in the latest service pack to the install disc, but it still sucks. Then you have to reinstall drivers. Then you have to reinstall all the applications and possibly update them. Then you have to reconfigure all the applications and little tweaks you've setup since the last reformat. I'd estimate that it takes me the better part of a week to rebuild my system and get it back to how it was just before infection.

I once used some software years ago to make an image of my computer after installing everything. Then I tested it. Format to up and running in 20 minutes. Awesome! And then I realized how utterly useless it was going to be once I REALLY needed to use it. I also don't know why I keep a stash of installers around because I ALWAYS end up downloading a newer version (and keeping that around, for whatever reason) when I reformat.

Computers are fun :downs:

# ¿ Dec 18, 2008 22:08

brc64: Mar 21, 2008; I wear my sunglasses at night.

I was onsite yesterday trying to figure out wtf was wrong with this Windows Server, and to kill time while it was updating (completely unpatched server, awesome), I decided to check Windows Update on a few of the PCs. I noticed that on this one Win2k box, Windows Update wouldn't load. Because the browser was so slow, I say it attempting to open 127.0.0.1.

Let me tell you, that HOSTS file was great. It was no only blocking Windows Update and a variety of Microsoft download servers, but it also had a pretty comprehensive list of different antivirus update servers as well. So I fixed the HOSTS file and since they don't have any local antivirus software ( :suicide:

) I loaded up Housecall to see what came up.

I think the final count was somewhere around 4500 infections found. Most of them appeared to be :filez:

hidden various places around the PC. I suspect that the doctor was probably responsible for the initial infection, but I kind of doubt he's smart enough to have a huge cache of installers and keygens hidden deep within his user profile. I suspect the bulk of that was due to one or more of the infections.

It always fills me with warm fuzzies when I come across crap like this in a medical environment. I'm glad my confidential patient information is in safe hands.

Edit: here's a blurry pic of the scan in progress (sorry, my cell phone camera doesn't have a macro mode)

# ¿ Dec 23, 2008 14:48

brc64: Mar 21, 2008; I wear my sunglasses at night.

abominable fricke posted:

I'm sure I don't need to tell you that disinfecting a win2k machine is a waste of your time. It's just going to get reinfected the very next time it touches the internet. You should recommend that he upgrade his machines to XP, there is absolutely no reason not to at this point.

All of the Win2k machines are going to be replaced in the near future, yes. I'm amazed they actually had a 2k3 server.

By the way, Housecall locked up on that machine trying to disinfect LONGHORN BETA LEAKED.EXE

# ¿ Dec 23, 2008 16:04

brc64: Mar 21, 2008; I wear my sunglasses at night.

Kaltag posted:

I keep my OS/programs and data on separate HDs so when I get this poo poo i just nuke the OS/programs HD.

The way I see it is if you take a poo poo on a plate, no matter how well you clean it you'll never want to eat off it again.

While I certainly appreciate the separate OS partition or drive, what's to stop a virus from infecting your data drive as well?

# ¿ Jan 6, 2009 19:02

brc64: Mar 21, 2008; I wear my sunglasses at night.

Luigi Thirty posted:

If you're really clever, you'll encrypt their files and try to get money like the Russian extortion virus.

I can think of all kinds of ingenious things for viruses to do. It's a good thing I'm not a programmer. :ninja:

# ¿ Jan 7, 2009 19:07

brc64: Mar 21, 2008; I wear my sunglasses at night.

abominable fricke posted:

But the geeks at Best Buy told me it's the best antivirus software there is...

Best? You mean there are others?

# ¿ Jan 9, 2009 20:18

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

At least this time around Microsoft is on top of it and the January MSRT will take out most versions of Conficker. The lesson today, as loving always? Update update update.

Wait, you mean the MSRT actually does something? I see it in Windows Update every month, but I've never seen it actually do anything, nor is it obvious how to even use it.

# ¿ Jan 15, 2009 16:28

brc64: Mar 21, 2008; I wear my sunglasses at night.

One of my coworkers who does some work on the side for a local hospital told me she was instructed not to log into the hospital network until further notice. Apparently there's been a crippling virus outbreak that they're still trying to contain, and they've instructed everybody on the hospital network to turn off their computers until they can clean up the mess.

Sounds like conficker or something, based on the description. Whoops.

# ¿ Feb 6, 2009 15:30

brc64: Mar 21, 2008; I wear my sunglasses at night.

Otacon posted:

This will help you when in 2 weeks, your brother says "Hey my Windows is hosed up again, time to do a system restore!" and the system is reinfected.

Good advice, but I've yet to come across anybody who has ever run system restore on their own. Most people don't know it's there or don't know what it is.

# ¿ Feb 9, 2009 14:57

brc64: Mar 21, 2008; I wear my sunglasses at night.

BorderPatrol posted:

Anyone here use Counterspy/VIPRE security software? I've been using them for a few years now and they are one of the most underrated security companies I've seen, their stuff is very good (they originally made the first versions of the Microsoft Antispyware product)

They just released a self-contained executable command-line scanner that does a pretty good job of removing a lot of junk, especially on systems that aren't loading up explorer. I'm currently looking at integrating it into my LiveCD system as well.

Their product is at called VIPRE PC Rescue and is at http://live.sunbeltsoftware.com/. Download includes latest definitions built in. Good one to throw on the flash drive, scan time took me all of 3-4 minutes.

I tested VIPRE Enterprise here and loved it. My boss proposed it to the owner as an alternative to OfficeScan (which STILL isn't Server 2008 compatible), citing better protection and management AND lower cost (which means we can make more money from it). Owner dismissed the idea without even giving it 2 seconds of thought.

# ¿ Feb 10, 2009 17:05

brc64: Mar 21, 2008; I wear my sunglasses at night.

Okay, I just spent 2 hours of my life battling the meanest winantivirus variant I've seen to date. This sucker appears to create some stealth software restriction policy that prevents me from installing anything that might get rid of it. MBAM setup just closes (and yes, I did try renaming the installer). HijackThis closes. Process Explorer closes, even under safe mode.

gpresult /v showed me, among other things:

code:

        Administrative Templates
        ------------------------
            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{7272edfb-af9f-4ddf-b65b-e4282f2deefc}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{8868b733-4b3a-48f8-9136-aa6d05d4fc83}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{191cd7fa-f240-4a17-8986-94d480a6c8ca}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\262144\Paths\{d2c34ab2-529a-46b2-b293-fc853fce72ea}
                State:   Enabled

            GPO: Local Group Policy
                Setting: Software\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs
                State:   Enabled

System log has a lot of stuff like this:

code:

Event Type:	Error
Event Source:	Userenv
Event Category:	None
Event ID:	1096
Date:		02/10/2009
Time:		10:36:17 AM
User:		NT AUTHORITY\SYSTEM
Computer:	DD7D5LB1
Description:
Windows cannot access the registry policy file, C:\Documents and Settings\All Users\tempntuser.pol. (Access is denied. ).

There's no option to delete the software restriction policy via secpol.msc (it shows it, but right-click option to delete). I tried deleting the actual 262144 key from HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers, but it came back on reboot. I even tried creating a domain level policy granting unrestricted access in an attempt to override the local one, but no go.

If the computer weren't offsite I might be more willing to try to beat it into submission, but for now I give up. I told them to call the local guy who installed the PC and have him deal with it.

# ¿ Feb 10, 2009 17:18

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

I guess the next thing to try is a boot CD with portable installations of scanners already present. After that I'd just flatten/reinstall, because goddamn once you're mucking around in phantom software restriction policies you're too far in.

Yeah, that's why I passed it on to another poor soul. Technically it wasn't even my responsibility to support this in the first place, since we just support a few of their apps but not their OS. They've got a local guy for that. I just saw what looked like WinAntiVirus, remembered how effective MBAM was against that, then I started running into this poo poo. At first it was morbid curiosity moving me forward, but now I'm ready to let somebody else deal with it.

# ¿ Feb 10, 2009 17:54

brc64: Mar 21, 2008; I wear my sunglasses at night.

GREAT BOOK OF DICK posted:

Is the owner some kind of OfficeScan fanboy?

My boss gave the owner a very nice proposal on VIPRE, but I'm told the owner just dismissed it off-hand saying that he "does not want to see us have to support something else". End of discussion.

There's a reason I started the Job thread...

# ¿ Feb 11, 2009 21:07

brc64: Mar 21, 2008; I wear my sunglasses at night.

Otacon posted:

It created a bunch of new drivers for devices I didn't even know existed. (Saitek Magic Bus? Who let the magic bus into my computer???)

There's a computer in the office here that used to try to install drivers for "Internet" every time you turned it on. That was my all time favorite.

# ¿ Feb 18, 2009 19:19

brc64: Mar 21, 2008; I wear my sunglasses at night.

lalala...

Customer calls describing a typical winantivirus type infection. I tried to do a webex session to run malwarebytes but the app keeps redirecting the webex join page to some "this page may be infected, click here to buy" screen. Awesome. Right now I'm in via RDP from the server, running the scanner.

Objects scanned: 82783
Objects infected: 9
Time elapsed: 55 minute(s), 38 second(s)

Surely it's almost done...

Also, apparently this client is too cheap to buy an enterprise-level antivirus software, so in addition to my mbam scan, I've got this lovely message on the side of the screen from "McAfee Personal Firewall Plus"

quote:

The application Windows Explorer has changed since you first gave it access to the Internet. Do you still want to let it access the Internet?

Path: C:\WINDOWS\explorer.exe

I'm just sort of ignoring that question for the moment.

58 minutes...

# ¿ Mar 2, 2009 17:06

brc64: Mar 21, 2008; I wear my sunglasses at night.

brc64 posted:

58 minutes...

Malwarebytes finally finished scanning, found a bunch of vundo but no winantivirus which is what I was expecting based on the descriptions. Should be a fun reboot. I hate computers.

# ¿ Mar 2, 2009 17:41

brc64: Mar 21, 2008; I wear my sunglasses at night.

Independence posted:

and softcore porn collection.

I don't think I've ever seen a computer like that before. It's either nasty homegrown crap, crazy fetish poo poo or nothing at all.

# ¿ Mar 2, 2009 19:44

brc64: Mar 21, 2008; I wear my sunglasses at night.

I've got an XP Virtual Machine running right now with a VIPRE Enterprise agent installed. I've been clicking on things from malwaredomainlist and following banner ads and honestly, I'm pretty amazed at the results so far. So far the only thing I've been able to successfully install is The Weather Channel Desktop, which, while a bit annoying, isn't really malware. Everything else that I've tried to install has either crashed or mysteriously vanished.

If somebody can provide me with a working link to some vundo, antivirus 2009 or other common nasty poo poo, I'd really like to test that out in my VM.

# ¿ Mar 9, 2009 14:17

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

AV2010 stuff

Funny enough, I'm having trouble actually finding this thing to install in my VM. av2010.net just redirects me Live Search results for removal instructions. I need to think like a user. I wonder if I can use my antivirus testing as an excuse to get paid to search for porn.

# ¿ Mar 9, 2009 18:08

brc64: Mar 21, 2008; I wear my sunglasses at night.

Cojawfee posted:

It all comes down to people admitting that they are retarded and refuse to learn the basics of computer use. And don't realize that internet explorer opened up a fake My Computer window and My Computer is performing a function that it never has before (scanning for viruses).

Most novice users are instructed to follow the instructions on the screen, and all they know about viruses is that they are all over the Internet (you hear about them on the news and everything). Combined with the fact that new computers are bundled with all kinds of crap these days, including programs that don't use the standard Windows UI, most users have no idea if a window that pops up is legitimate or not, so they just do what they've been trained to do... follow the instructions on the screen.

# ¿ Mar 16, 2009 20:54

brc64: Mar 21, 2008; I wear my sunglasses at night.

Cojawfee posted:

All of the examples he gives are of people who simply refuse to learn anything. They think they are smarter than the guy who gets paid to work on whatever they have and won't listen. His examples of people being victims of bank fraud or theft don't really apply. Those people had something happen to them that they had no reason to expect. Blindly clicking things away is figuratively childish in that they just want to get to whatever boring website they want to see and will click yes to anything that comes across their path.

You must enjoy making old ladies cry

# ¿ Mar 17, 2009 13:51

brc64: Mar 21, 2008; I wear my sunglasses at night.

GREAT BOOK OF DICK posted:

When I find Limewire installed on infected machines, I've only had to explain to teenagers/parents once not to use it because that's the likely source of their infections. They seem to listen to the person fixing the computer (as they should.)

Really? I always hear:
"I don't know how that got on there"
"Oh I don't use that anymore"
"What's limewire?"

or they agree not to download it again only for it to show up again just a couple of weeks later

# ¿ Mar 18, 2009 05:18

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

Conficker Network Signature Discovered

For those of you freaking out about Conficker, now you can use nmap to do large-scale infection-checks. There's officially no longer an excuse for not knowing whether you're infected or not, and not knowing whether your enterprise is infected or not.

I don't know much about nmap, so if anybody can clue me in on how exactly I'm supposed to use it to scan for conficker, that would be nice. The article isn't very specific on that.

# ¿ Mar 30, 2009 15:14

brc64: Mar 21, 2008; I wear my sunglasses at night.

Drighton posted:

Put in your IP address range in the Target field. I'm not sure which scan to do though, and I'm not sure what you will see if you are infected. Big red CONFICKER label on the IP address or maybe you're looking for a specific port, I don't know.

That's sort of why I was asking. The article talked about updated "definitions" being available mid-Monday, so maybe the nmap folks are going to release an update or something. I don't know.

# ¿ Mar 30, 2009 15:25

brc64: Mar 21, 2008; I wear my sunglasses at night.

I had this lovely email (slightly edited) when I came in this morning. The time on the email was 3:21 AM.

quote:

I initiated the Trend Scan on all machines. PC05 computer is INFECTED!!!! [emhpasis hers] Notice states "0 files cleaned, 11 infected and unable to fix".

WORM_WALEDAC.CN UNABLE TO DELETE
TROJ_TDSS.DB UNABLE TO DELETE
TROJ_BHO.VW UNABLE TO DELETE
TROJ_TDSS.FA UNABLE TO DELETE
TROJ_TDSS.NP UNABLE TO DELETE
TROJ_TDSS.EB UNABLE TO DELETE
TROJ_TDSS.FB UNABLE TO DELETE
TROJ_TDSS.FC UNABLE TO DELETE
TROJ_TDSS.NP UNABLE TO DELETE

Please Help ASAP!!! I did not perform back up for fear of infecting anything further [wtf!]... Please call my cell when you receive this email.

Funny thing is, I checked the OfficeScan Server Console and found the virus reports, but when I checked the locations via c$, none of the files reported were present. I hate Trend.

I never called her, either.

# ¿ Apr 3, 2009 14:50

brc64: Mar 21, 2008; I wear my sunglasses at night.

BillWh0re posted:

The Virut family are all IRC backdoors.

Maybe I don't understand what you're saying here. Isn't the point of a backdoor to give yourself covert access to a system? If that's the case, why start breaking other stuff and increase your chances of getting noticed?

# ¿ Apr 7, 2009 19:16

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

New Vundo Behavior

Yeah, you thought you were having fun before? Now there's a new Vundo variant that's replicating over mapped network drives.

Fun fact: our worst vundo-offending client shares a mapped drive on the server between all of the PCs.

I don't quite get why that's a problem in this case, though... what is so bad about dropping a randomly named vundo DLL on a mapped drive? I mean, that's not going to magically infect anybody who uses that drive, is it?

# ¿ Apr 23, 2009 18:11

brc64: Mar 21, 2008; I wear my sunglasses at night.

abominable fricke posted:

Is it not dropping an autorun.inf there to? Otherwise that would be silly.

I never thought about that... does Windows process autorun upon connection to a mapped drive?

# ¿ Apr 23, 2009 22:23

brc64: Mar 21, 2008; I wear my sunglasses at night.

One of my coworkers has been battling something nasty on her laptop for the last couple of weeks that I haven't had any time to look into. A couple weeks ago she told me that her computer "lost" her audio device. Last week she started getting bluescreens and error messages on startup referencing chkdsk.dll (it was in Start Menu/Programs/Startup), and I noticed that OfficeScan was not only outdated but the real time scanner wasn't even running anymore.

I've been at a local hospital every day last week so I haven't had any time to look closer into the problem. I downloaded VIPRE rescue to see if it would have any more luck than Trend crap, but her computer couldn't browse the network. Burned it to a CD instead, started it up, then went to the hospital. When I got back she said it didn't do anything when it finished but try to open some website that never loaded (and based on the URL I'm pretty sure VIPRE didn't launch it).

I'm pretty sure I'm just going to have to nuke the laptop. I just hope I have some time to look into it this week. Last week was hell.

# ¿ Jun 1, 2009 00:57

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

Erm.

They really need to change their name to something that sounds less like malware.

# ¿ Sep 4, 2009 14:55

brc64: Mar 21, 2008; I wear my sunglasses at night.

Midelne posted:

Maybe something like UltraSpywareKiller2010.

Point taken.

# ¿ Sep 4, 2009 15:49

brc64: Mar 21, 2008; I wear my sunglasses at night.

fishmech posted:

At least Comic Sans is legible, if informal.

It's funny you say this. My wife works for a credit reporting bureau, and when she was in training before they put her on the phones, her job was to process letters people sent in the mail disputing credit issues.

She told me that she once received a letter, claiming to be some sort of legal proof that a particular debt had been taken care of or something. The letter was printed in Comic Sans.

# ¿ Sep 6, 2009 23:49

brc64: Mar 21, 2008; I wear my sunglasses at night.

fishmech posted:

They're trying to kill lovely "free" antivirus. Their attempt to kill paid antivirus ended back in summer when OneCare was canceled.

I played with OneCare when it was in testing but never really cared for it, certainly not enough to spend money on it. I like Essentials well enough, though. It's quiet and unobtrusive. I still have no idea how "good" it is, but then I never really got any warnings from AVG, either.

# ¿ Dec 9, 2009 16:24

Adbot: ADBOT LOVES YOU

# ¿ May 21, 2024 00:36

brc64: Mar 21, 2008; I wear my sunglasses at night.

m2pt5 posted:

Many viruses and malware will refuse to "function" if they detect that they are running inside a VM.

This sounds like more reason to push my "everybody at works runs a prebuilt VM image" agenda. It sounds like a completely awesome idea, and there's probably some standard implementation for it already. I think the biggest concern would be bandwidth to pull the image each morning.

But my idea is roughly this:
Create a virtual machine image that includes everything the client needs (I assume this would require volume licensing for the Microsoft apps). Have the physical computer effectively be a thin client that does nothing but load this image at startup. Have documents redirected to a share on the server to preserve changes. When they reboot the computer, the same base image is loaded again, so it effectively acts as Deep Freeze as well (undoing any malicious changes since the past reboot). This method would also make keeping things up-to-date easy, since you only have a single image to update.

The downsides I can think of are that it might make things like antivirus definitions and windows updates slightly more tedious, and the obvious aforementioned bandwidth issues with loading the image at startup.

BangersInMyKnickers posted:

If you are on Vista/7, enable SEHOP.

I had to look this up because I've never even heard of it. What's the downside of enabling it? Potential for compatibility issues? I'm guessing there's a reason it's not turned on by default.

# ¿ Feb 16, 2010 15:39

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > Rootkit.KInject is a sexy new virus. Let's talk about notable viruses we have recently encountered