Cleaning Up Malware... Manually!

** FOR HJT TRAINEES AND BEGINNERS **

After identifying the malware files either through an anti-malware scan or through helper tools, the next thing that comes to action is cleaning them from the system.

Manual cleanup is divided into the following:

1. Adware, PUP, foistware and bloatware: use add/remove programs if applicable. To check whether the unwanted program can be uninstalled, please see:

http://www.bleepingcomputer.com/uninstall/

2. File/Folder deletion: In safe mode, simply browse to the suspected files and then delete them. Make sure that the file extensions, hidden and system files are shown before locating the files. Stubborn files may require tools such as Killbox, File Assassin, Unlocker, etc.

3. ADS: A third-party tool is needed. You can use Hijackthis ADS removal or LADS software. Make sure that the ADS process is not active before removal. To learn about Alternate Data Streams see this: http://www.bleepingcomputer.com/tutorials/tutorial25.html

4. Ending Processes: I am not fond of ending processes manually. The only time it is needed is when dealing with rootkits. Task manager always fails so a third-party tool is needed. You can use killbox, hijackthis mult-process killing, icesword, etc.. Hopefully, in safe mode you will not need to end processes. However, if in safe mode a process is active, it is then best to use combofix and other semi-automated tools while in normal mode.

5. Win Services: To remove a service, you will need to stop it first. Three ways to stop a service without any additional tool:

a) using services.msc (not recommended since malware may not be listed there)

b) using sc stop dos command in windows XP/Vista.

c) using net stop dos command in windows 2K/XP/Vista

Please note that a windows service key name is different than its "display name" and description. HJT helpers should be able to identify the service key names from the display names in hjt logs.

To delete a service, the two easiest ways:

a) using sc delete dos command in windows XP/Vista.

b) using hijackthis delete an NT service option at the misc. tools section.

NOTE: There are some malware services that cannot be stopped manually. Only in this case, try deleting the service first and then reboot.

6. Registry keys and entries: There are three different ways of deleting or changing an arbitrary (can be located anywhere) registry item without the aid of a third-party tool.

a) Using a gui interface through regedit

b) Using the command-line reg.exe such as reg delete or reg add

c) Using scripts via .reg files

More information:

http://www.bleepingcomputer.com/tutorials/tutorial44.html

http://www.bleepingcomputer.com/tutorials/tutorial74.html

7. LSP entries: a third-party tool is needed such as LSPfix

http://www.bleepingcomputer.com/tutorials/tutorial59.html

8. Infected host file: you can use mvp hosts to simply replace the bad host file with a much better one. see: http://www.mvps.org/winhelp2002/hosts.htm

9. DLLs: if a dll file does not depend on the rundll32.exe, then it is preferred that they be unregistered before deletion. To unregister a dll, you can use the dos command:

regsvr32 /u

10. R3 entries that cannot be removed by hijackthis: use Registrar Lite to delete the key

11. Registry with embedded nulls: You will need to use tools such as regdelnull and SWreg. For more information about embedded nulls, please see:

http://technet.microsoft.com/en-us/sysinternals/bb897446.aspx

12. Infected System Restore files: Based on an old Microsoft KB article, it is best to turn off system restore. This

will clear up all restore files including the infected ones. Once the entire system is clear from malware by a thorough anti-virus scan, you can then turn on system restore and create a restore point.

http://spywarehammer.com/simplemachinesforum/index.php?topic=202.0

13. Policies that have been added by Malware: download and run fixpolicies.exe from here:

http://downloads.malwareremoval.com/BillCastner/FixPolicies.exe

14. Rootkits and MBR infections: please read Detecting and Removing Rootkits in a Nutshell

A. Elshafei

How to Import Your Messages from .OST Files

The common technique to import messages from .ost files is by first using outlook to export your messages to a .pst file. Then you can import the .pst files directly using the import and export wizard. However, what would happen if you cannot export your ost mail to pst or never had a chance to do so. This is exactly what happened to one of my colleagues at work. His OS died all of a sudden fail due to unknown causes. Safe mode, System restore, cd windows repair and repair install all didn't work.

Anyhow all his files were extracted from the hard-disk including his emails for a clean install. The outlook emails were in the form of pst and ost files. However, the ost file had all of his recent emails. According to an outlook MVP, you cannot import an ost file. Others would recommend that you use a commercial tool to convert the ost file to a pst file. I developed my own technique which is far more simpler to import ost messages. It has worked like a charm for my colleague, so you will need to follow these instructions carefully:

First, if you already have set your exchange settings on MS Outlook and had already synchronized with the exchange server, then you will need to export all your current messages to a pst file. Save this pst file in a safe location to be used afterwards.
If you haven't setup your exchange settings yet, then you will need to do so. Try not to synchronize with the server yet. But incase you do need to synchronize with the server, then you will need to export any new messages that you received during synchronization to pst file so you will not lose them.
NOTE: your current exchange settings should be exactly the same as the exchange settings you had for .ost file that you want to import.

Second, go to tools => account settings => data files => under file name, look for the outlook.ost file and take note of its full path.

Third, close outlook and then browse to the folder where the current ost file is located. Copy and paste this ost file in a safe place as a backup in case something goes wrong. Place the ost file that you would like to backup into the same folder (the ost file that you would like to import should replace the current ost). Make sure the name of the ost file is outlook.ost

Fourth, open outlook and start synchronizing. If successfully, you should be able to restore your emails from the ost files. As for the messages that you already had in your outlook, they can be restored by using the import and export wizard to import the pst file you created and saved earlier.


A. Elshafei

Does my RootkitRevealer log show a Rootkit?

Well there isn't much more to add on how to determine rootkits using rootkitrevealer. The authors of rootkitrevealer provide an excellent tutorial on how to use the tool: http://www.sysinternals.com/Utilities/RootkitRevealer.html

But to keep things simple and succinct, here is a good tip on how to detect a rootkit regardless on how many discrepancies and unconfirmed false positives were found:

Most rootkits register themselves as services in the windows registry. Therefore a rootkit exists if rootkitreveler finds one or more of the following entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\xxxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\xxxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\xxxx
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xxxx

where xxxx is an arbitrary service name given by the rootkit. So to make this clear, if you find any one of these entries in the rootkitrevealer results, then you have a rootkit. If you have none of these entries in your log then most likely you dont have a rootkit.

Detecting Rootkits in Windows Millennium/98/95

Detecting rootkits in windows 98 and ME is very difficult. There are no tools existing today that can detect or remove active rootkits for windows 98 and ME. If you contracted a rootkit in windows 98 or ME then the only guaranteed solution is to format/reinstall. For those who avoid formats at all cost, I have created a procedure that can be used as a guideline for detection. However these guidelines should be used only for those who have a high level of expertise with computers.

Background: Basically, the procedure is to compare a list of files/folders in the root drive (c:) drive that are visible in windows with a list of files of root drive in dos. Any files that show up in the dos list that were not visible in windows could be potential rootkits. The reason for disabling any active processes in windows before generating the list is to minimize the number of temporary files to ease up comparison and false positives. Active processes use temp files that my appear in dos and not in windows.

First, do you have a windows 98 boot disk? If not please do the following:
1. get a clean floppy disk and place it in your floppy drive.
2. Click Start -> Point to Settings and click Control Panel -> Click Add/Remove Programs -> Click the Startup Disk tab -> Click the Create Disk button
-> When finished, click OK
3. do not remove the floppy disk, keep it in there.

Second, please shut-down all running applications including the browser you are reading this from.
Try to turn off or disable as many applications as you can.

Third, clean up the clutter in the computer using ccleaner:
http://wiki.battlespam.info/index.php?title=Malware_Removal:_Clean_out_the_Clutter

Do not open or run anything once you are done with ccleaner.

Fourth, click start -> run -> type: command and press enter
Please type the following commands each followed by an enter key:
cd \
dir /s /b /a-d > files1.txt

Fifth, when the commands are done, please shutdown the computer with the floppy drive inside

Sixth, turn on the computer and make sure that your computer is booting from the floppy drive. Otherwise, you may have to enter the bios and set the boot sequence.

If booting from the floppy is successfully, at the first screen, select the second option that says something like: 'start the computer with out cd-rom support'

Once the command line appears, try to determine the drive letter of your hard-disk that was assigned by the boot disk. If the drive letter is not C and you are not sure which drive was assigned to the hard-disk, then please do the following through trial and error:
step1: type the following command:
C:
press enter
step2: then type dir and enter. You should be able to see the windows folder along with other directories somewhere at the end of the list. If no directories appear, then repeat step1 with a different letter such as D: or E:

Seventh, once you are in the correct hard-drive letter, please type the following command and press enter:
dir /s /b /a-d > files2.txt

Once done, remove the boot disk and restart your computer normally into windows.

Eighth, now we need to compare the files files1.txt with files2.txt .

The best way to compare the files is to use an automatic diff program. Two good programs are:
- Compare-It: http://www.grigsoft.com/wc3setup.zip

- Examdiff: http://www.prestosoft.com/edp_examdiff.asp

Compare-It has an advantage is that it will color in red the exact difference within common line in the two files. This is an advantage because it will make it easy to recognize and skip the lines with file names that were shortened in DOS. You can also generate an htlml report of the results.
ExamDiff has the advantage that you can only display the line differences from the two files. Compare-It also has that feature, but isnt as effective since it will also display common lines between two files that were ordered differently.

If you decide to use Compare-It, download, unzip and install the program.
Start the program-> browse the text file you generated from dos and click open:
files2.txt
> browse the other text file you generated from windows and click open: files1.txt
Now In the left pane, the lines that are colored in green are the files that appeared in DOS but not in windows.
The lines that are colored in blue are files that exist in both files but with some changes such as shortening the file names. Within the blue lines you will notice the difference colored in red.
You can simply skim quickly through the blue lines.
The lines colored in red in the right pane, are files that appeared in windows but not in dos. You can ignore these files.
The lines colored in black are common lines between the two files and these should be ignored.

Rootkits will likely be any files that show up in files2.txt that does not exist in files1.txt. If any of these lines are found, then double-check by actually trying to browse to these files while in windows and see if you are unable to locate them. Also make sure these files are not legitimate.

Ninth, if a rootkit file is suspected. You can rename the file while in dos. Boot the computer from the floppy disk as performed earlier. Perform the following command:
ren path/filename.xxx path/emanelif.bak

Reboot into windows and make sure everything is running fine.