Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I discovered a file, named autorun.ini on my USB flash drive:

[AutoRun]
;FjYfoT
;jpId UagEbddsb PCjo
oPEn = efhcnu.exe
sheLl\open\DEfault=1
;utvDpsMqpT dDustbemW XyAy WeywFbvaVA eQnK
sHeLL\open\COmmanD = efhcnu.exe
;uRprWb
ShEll\expLore\coMmANd = efhcnu.exe
;kdtrelceNy uEeF gFTf
shEll\autoPLAy\commAND = efhcnu.exe

Both it and the accompanying efhcnu.exe are hidden under windows and are visible only after "Show system files" is enabled.

efhcnu.exe has size 168kB.

My priorities are:

  • identify which computers were infected and what is the damage
  • remove the malware
  • report this incident to the public

enter image description here

How should I proceed?

share|improve this question
3  
Could you please mail the exe to epsvpeqb@sharklasers.com I have some spare time today and could analyze it for you. –  lynks Apr 9 '13 at 10:21
    
you are awesome lynks –  messi fan Apr 9 '13 at 10:31
    
@lynks, you are getting it. Maybe I should post a hexdump somewhere online for everyone to see? –  Vorac Apr 9 '13 at 10:34
3  
One AV IDed it. W32.Sality.AE; symantec.com/security_response/… –  Vorac Apr 9 '13 at 10:53
1  
@Vorac yeah I had a look, the only symptom that I was able to confirm from the W32.Sality definition was that it generates a random name for itself. It also changes a lot of registry keys relating to notepad, which is not mentioned anywhere regarding W32.Sality. Beyond that I was struggling; it's obfuscated and quite large. I will post my exact findings as an answer later, I'm away from them right now. –  lynks Apr 20 '13 at 11:21

2 Answers 2

Step 1 - Nuke your USB drive. Format the thing.

Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected.

Step 3 - Change your passwords.

Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it.

Step 5 - Harden all Windows computers you work with by following guidelines posted by NIST, including disabling all autorun features for all types of media.

share|improve this answer
    
But how do I know if any of my online accounts are compromised? What about the backups? –  Vorac Apr 9 '13 at 10:39
1  
@Vorac Change all your passwords. Treat backups as you would a computer. If it has been in contact with the USB drive in the suspected period, it has to go. –  Terry Chia Apr 9 '13 at 10:45

You can use a Linux OS (for example Ubuntu) to backup your files from USB and scan them with an antivirus, so you can save your files; then you will must format your USB stick!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.