Last week I was infected by a worm via a USB pen (UFO.EXE).
This is a variant of many similar backdoors/worms, these instructions
can be useful to understand how that attacks work.
These are the steps I made to remove the worm and related malwares
loaded from that backdoor.
1) first of all: disconnect the infected PC from any network
and internet connection.
The malware loads viruses and updates from internet sites
during your browsing:
cn911.org, , obutan.com, baidu8.com, 222.122.45.146,
eu.logon.worldofwarcraft.com, us.logon.worldofwarcraft.com
Try to block these sites with your firewall!
2) clean the USB pen
delete UFO.EXE (hidden file)
delete autorun.inf (hidden file that load the ufo.exe worm)
this files are created from infected PCs anytime you boot a USB pen
or removable harddisk
After you need create a fake empty autorun.inf file with READ-ONLY property
to block the loading of ufo.exe from a infected PC
3) removal actions
- Run the "process explorer" of Mark Russinovich (www.sysinternals.com)
and kill the svchost process at root level (It is the process that create
the UFO.EXE/AUTORUN.INF files any time you insert a removable disk)
- with regedit remove just the string ",C:\WINDOWS\system32\secpol.exe"
from the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\WinLogon
C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\secpol.exe,
need to be (don't remove the userinit.exe!):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\WinLogon
C:\WINDOWS\system32\userinit.exe
- delete the secpol.exe file from C:\WINDOWS\system32
- with regedit remove the fsmgmt key from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\WinLogon\Notify
- delete the fsmgmt.dll file from c:\windows\system32
Note: the product name shows: "Microsoft? Windows? Operating System"
- delete any files from the locations:
C:\Documents and Settings\<user>\Impostazioni locali\Temporary Internet Files
and
C:\Documents and Settings\<user>\Impostazioni locali\Temp
That's all. I removed also some unknown users *S-1-5-21..... from security policies.
Credits : I'd like to sincerely thank the folks at Sysinternals
