[28008] in resnet
Re: FBI Moneypak ramsonware
daemon@ATHENA.MIT.EDU (Randy Kouns)
Mon Oct 8 09:37:00 2012
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=047d7b10c94568e1b904cb8c4b29
Message-ID: <CAJ0ztaJDr=qRZv=+3Byrm-WtzqbdY1RaQ_OZfm7zL1F7Jf7mXQ@mail.gmail.com>
Date: Mon, 8 Oct 2012 09:35:27 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Randy Kouns <randykouns@gmail.com>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <9AF279DD359BD14DA5F7B23E04570DE029DAC0@exch-mbx01.exchange.upenn.edu>
--047d7b10c94568e1b904cb8c4b29
Content-Type: text/plain; charset=ISO-8859-1
Caroline,
you did not advise the OS.. so this may not be what your looking for, but
I just found it on answers.microsoft.com
It's actually really easy to remove this virus in windows 7 - system
restore not needed - three step process
Step 1:
Reboot, tap F8 when windows starts loading, select Safe Mode.
Step 2:
goto %userprofile%\appdata\local\temp
remove rool0_pk.exe
remove V.class
the virus can have names other than "rool0_pk.exe" but it should look like
it doesn't belong and should have a create date/time the same as a .class
file... if you sort by file mod/create time you'll find it.
Step 3:
goto %appdata%\microsoft\windows\start menu\programs\startup
remove ctfmon (ctfmon.lnk)
this is what's calling the virus on startup - some variants use the
registry to launch the virus but I found the launcher in my startup folder
and my registry was clean. If they've changed things and the file name
isn't ctfmon.lnk just look for a file in startup with the same create
date/time as the exe and class files you killed in step 2.
you may have to crack open the registry too in order to supress some funky
startup errors (I didn't have to) but removing the exe file will cure
things and removing the class file that, from what I could tell when I
decompiled, uses a java vulnerability to install the virus, is just for
good measure.
If you end up having to get into the registry just go to
HKLM\Software\Microsoft\Windows\CurrentVersion\Run and make sure there's
nothing in there invoking that exe you killed via rundll.
hope that helps.
Randy Kouns
On Mon, Oct 8, 2012 at 9:24 AM, Caroline Couture
<caroline@pobox.upenn.edu>wrote:
> Hi Folks!
>
> I knew such things existed but I've never seen this in person until now.
>
> We tried using some of the various "typical" tools for removal,
> SuperAntiSpyware and the AVG boot disk, had no luck, and the manual removal
> instructions don't match up with what we are seeing but this may be because
> we tried removing it with anti-virus applications first.
>
> Has anyone successfully cleaned a machine with this ransomware? Or should
> I not waste my time and just reformat. (Which will be painful since the
> student probably doesn't have her software since the computer is two year
> old.)
>
> Thanks!
> Caroline
>
> "We're all going to die, all of us, what a circus! That alone should make
> us love each other but it doesn't. We are terrorized and flattened by
> trivialities, we are eaten up by nothing." - Charles Bukowski
>
> Caroline Couture
> College House Computing
> 3702 Spruce Street
> 215.573.3887
>
> ___________________________________________________
> You are subscribed to the ResNet-L mailing list.
>
> To subscribe, unsubscribe or search the archives,
> go to http://LISTSERV.ND.EDU/archives/resnet-l.html
> ___________________________________________________
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--047d7b10c94568e1b904cb8c4b29
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Caroline,<div><br></div><div>=A0you did not advise the OS.. so this may not=
be what your looking for, but I just found it on <a href=3D"http://answers=
.microsoft.com">answers.microsoft.com</a></div><div><br></div><div><p style=
=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI',Arial,san=
s-serif;margin:0px;padding:0px;vertical-align:top;font-size:13px;background=
-color:rgb(255,255,255)">
It's actually really easy to remove this virus in windows 7 - system re=
store not needed - three step process</p><p style=3D"border:0px;color:rgb(5=
1,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0px;padding=
:0px;vertical-align:top;font-size:13px;background-color:rgb(255,255,255)">
=A0</p><p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI=
',Arial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size:=
13px;background-color:rgb(255,255,255)">Step 1:</p><p style=3D"border:0px;c=
olor:rgb(51,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0=
px;padding:0px;vertical-align:top;font-size:13px;background-color:rgb(255,2=
55,255)">
Reboot, tap F8 when windows starts loading, select Safe Mode.</p><p style=
=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI',Arial,san=
s-serif;margin:0px;padding:0px;vertical-align:top;font-size:13px;background=
-color:rgb(255,255,255)">
=A0</p><p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI=
',Arial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size:=
13px;background-color:rgb(255,255,255)">Step 2:</p><p style=3D"border:0px;c=
olor:rgb(51,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0=
px;padding:0px;vertical-align:top;font-size:13px;background-color:rgb(255,2=
55,255)">
goto %userprofile%\appdata\local\temp</p><p style=3D"border:0px;color:rgb(5=
1,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0px;padding=
:0px;vertical-align:top;font-size:13px;background-color:rgb(255,255,255)">
remove rool0_pk.exe<br>remove V.class</p><p style=3D"border:0px;color:rgb(5=
1,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0px;padding=
:0px;vertical-align:top;font-size:13px;background-color:rgb(255,255,255)">
the virus can have names other than "rool0_pk.exe" but it should =
look like it doesn't belong and should have a create date/time the same=
as a .class file... if you sort by file mod/create time you'll find it=
.</p>
<p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI',A=
rial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size:13px;ba=
ckground-color:rgb(255,255,255)">=A0</p><p style=3D"border:0px;color:rgb(51=
,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0px;padding:=
0px;vertical-align:top;font-size:13px;background-color:rgb(255,255,255)">
Step 3:</p><p style=3D"border:0px;color:rgb(51,51,51);font-family:'Sego=
e UI',Arial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-s=
ize:13px;background-color:rgb(255,255,255)">goto %appdata%\microsoft\window=
s\start menu\programs\startup<br>
remove ctfmon (ctfmon.lnk)</p><p style=3D"border:0px;color:rgb(51,51,51);fo=
nt-family:'Segoe UI',Arial,sans-serif;margin:0px;padding:0px;vertic=
al-align:top;font-size:13px;background-color:rgb(255,255,255)">this is what=
's calling the virus on startup - some variants use the registry to lau=
nch the virus but I found the launcher in my startup folder and my registry=
was clean.=A0 If they've changed things and the file name isn't ct=
fmon.lnk just look for a file in startup with the same create date/time as =
the exe and class files you killed in step 2.</p>
<p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI',A=
rial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size:13px;ba=
ckground-color:rgb(255,255,255)">you may have to crack open the registry to=
o in order to supress some funky startup errors (I didn't have to)=A0bu=
t removing the exe file will cure things and removing the class file that, =
from what I could tell when I decompiled, uses a java vulnerability to inst=
all the virus, is just for good measure.</p>
<p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI',A=
rial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size:13px;ba=
ckground-color:rgb(255,255,255)">If you end up having to get into the regis=
try just go to HKLM\Software\Microsoft\Windows\CurrentVersion\Run and make =
sure there's nothing in there invoking that exe you killed via rundll.<=
/p>
<p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe UI',A=
rial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size:13px;ba=
ckground-color:rgb(255,255,255)"><br></p><p style=3D"border:0px;color:rgb(5=
1,51,51);font-family:'Segoe UI',Arial,sans-serif;margin:0px;padding=
:0px;vertical-align:top;font-size:13px;background-color:rgb(255,255,255)">
<br></p><p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe U=
I',Arial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size=
:13px;background-color:rgb(255,255,255)">hope that helps.</p><p style=3D"bo=
rder:0px;color:rgb(51,51,51);font-family:'Segoe UI',Arial,sans-seri=
f;margin:0px;padding:0px;vertical-align:top;font-size:13px;background-color=
:rgb(255,255,255)">
<br></p><p style=3D"border:0px;color:rgb(51,51,51);font-family:'Segoe U=
I',Arial,sans-serif;margin:0px;padding:0px;vertical-align:top;font-size=
:13px;background-color:rgb(255,255,255)">Randy Kouns</p><p style=3D"border:=
0px;color:rgb(51,51,51);font-family:'Segoe UI',Arial,sans-serif;mar=
gin:0px;padding:0px;vertical-align:top;font-size:13px;background-color:rgb(=
255,255,255)">
<br></p><br><div class=3D"gmail_quote">On Mon, Oct 8, 2012 at 9:24 AM, Caro=
line Couture <span dir=3D"ltr"><<a href=3D"mailto:caroline@pobox.upenn.e=
du" target=3D"_blank">caroline@pobox.upenn.edu</a>></span> wrote:<br><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #=
ccc solid;padding-left:1ex">
Hi Folks!<br>
<br>
I knew such things existed but I've never seen this in person until now=
.<br>
<br>
We tried using some of the various "typical" tools for removal, S=
uperAntiSpyware and the AVG boot disk, had no luck, and the manual removal =
instructions don't match up with what we are seeing but this may be bec=
ause we tried removing it with anti-virus applications first.<br>
<br>
Has anyone successfully cleaned a machine with this ransomware? Or should I=
not waste my time and just reformat. (Which will be painful since the stud=
ent probably doesn't have her software since the computer is two year o=
ld.)<br>
<br>
Thanks!<br>
Caroline<br>
<br>
"We're all going to die, all of us, what a circus! That alone shou=
ld make us love each other but it doesn't. We are terrorized and flatte=
ned by trivialities, we are eaten up by nothing." - Charles Bukowski<b=
r>
<br>
Caroline Couture<br>
College House Computing<br>
3702 Spruce Street<br>
<a href=3D"tel:215.573.3887" value=3D"+12155733887">215.573.3887</a><br>
<br>
___________________________________________________<br>
You are subscribed to the ResNet-L mailing list.<br>
<br>
To subscribe, unsubscribe or search the archives,<br>
go to <a href=3D"http://LISTSERV.ND.EDU/archives/resnet-l.html" target=3D"_=
blank">http://LISTSERV.ND.EDU/archives/resnet-l.html</a><br>
___________________________________________________<br>
</blockquote></div><br></div>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--047d7b10c94568e1b904cb8c4b29--
