5

I discovered a file, named autorun.ini on my USB flash drive:

[AutoRun]
;FjYfoT
;jpId UagEbddsb PCjo
oPEn = efhcnu.exe
sheLl\open\DEfault=1
;utvDpsMqpT dDustbemW XyAy WeywFbvaVA eQnK
sHeLL\open\COmmanD = efhcnu.exe
;uRprWb
ShEll\expLore\coMmANd = efhcnu.exe
;kdtrelceNy uEeF gFTf
shEll\autoPLAy\commAND = efhcnu.exe

Both it and the accompanying efhcnu.exe are hidden under windows and are visible only after "Show system files" is enabled.

efhcnu.exe has size 168kB.

My priorities are:

  • identify which computers were infected and what is the damage
  • remove the malware
  • report this incident to the public

enter image description here

How should I proceed?

Improve this question
11
  • 3
    Could you please mail the exe to [email protected] I have some spare time today and could analyze it for you.
    – lynks
    Apr 9, 2013 at 10:21
  • you are awesome lynks
    – open source guy
    Apr 9, 2013 at 10:31
  • 3
    One AV IDed it. W32.Sality.AE; symantec.com/security_response/…
    – Vorac
    Apr 9, 2013 at 10:53
  • 1
    @Vorac yeah I had a look, the only symptom that I was able to confirm from the W32.Sality definition was that it generates a random name for itself. It also changes a lot of registry keys relating to notepad, which is not mentioned anywhere regarding W32.Sality. Beyond that I was struggling; it's obfuscated and quite large. I will post my exact findings as an answer later, I'm away from them right now.
    – lynks
    Apr 20, 2013 at 11:21
  • 2
    @lynks any news?
    – tbodt
    Jul 30, 2014 at 2:02

2 Answers 2

Reset to default
12

Step 1 - Nuke your USB drive. Format the thing.

Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected.

Step 3 - Change your passwords.

Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it.

Step 5 - Harden all Windows computers you work with by following guidelines posted by NIST, including disabling all autorun features for all types of media.

Improve this answer
3
  • But how do I know if any of my online accounts are compromised? What about the backups?
    – Vorac
    Apr 9, 2013 at 10:39
  • 1
    @Vorac Change all your passwords. Treat backups as you would a computer. If it has been in contact with the USB drive in the suspected period, it has to go.
    – user10211
    Apr 9, 2013 at 10:45
  • Can you specify which of those publications you're referring to?
    – user125213
    Jul 7, 2017 at 21:05
5

You can use a Linux OS (for example Ubuntu) to backup your files from USB and scan them with an antivirus, so you can save your files; then you will must format your USB stick!

Improve this answer
1
  • 1
    Or alternatively, just make a permanent switch to a Linux OS (for example Ubuntu) rendering the virus on the USB stick (and any other Windows malware you come across) impotent. ;)
    – IQAndreas
    Sep 4, 2014 at 11:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .