5

I discovered a file, named autorun.ini on my USB flash drive:

[AutoRun]
;FjYfoT
;jpId UagEbddsb PCjo
oPEn = efhcnu.exe
sheLl\open\DEfault=1
;utvDpsMqpT dDustbemW XyAy WeywFbvaVA eQnK
sHeLL\open\COmmanD = efhcnu.exe
;uRprWb
ShEll\expLore\coMmANd = efhcnu.exe
;kdtrelceNy uEeF gFTf
shEll\autoPLAy\commAND = efhcnu.exe

Both it and the accompanying efhcnu.exe are hidden under windows and are visible only after "Show system files" is enabled.

efhcnu.exe has size 168kB.

My priorities are:

  • identify which computers were infected and what is the damage
  • remove the malware
  • report this incident to the public

enter image description here

How should I proceed?

  • 3
    Could you please mail the exe to epsvpeqb@sharklasers.com I have some spare time today and could analyze it for you. – lynks Apr 9 '13 at 10:21
  • you are awesome lynks – open source guy Apr 9 '13 at 10:31
  • 3
    One AV IDed it. W32.Sality.AE; symantec.com/security_response/… – Vorac Apr 9 '13 at 10:53
  • 1
    @Vorac yeah I had a look, the only symptom that I was able to confirm from the W32.Sality definition was that it generates a random name for itself. It also changes a lot of registry keys relating to notepad, which is not mentioned anywhere regarding W32.Sality. Beyond that I was struggling; it's obfuscated and quite large. I will post my exact findings as an answer later, I'm away from them right now. – lynks Apr 20 '13 at 11:21
  • 1
    @lynks any news? – tbodt Jul 30 '14 at 2:02
12

Step 1 - Nuke your USB drive. Format the thing.

Step 2 - Nuke all the computers that you have used the USB drive with in the period which you suspect the drive has been infected.

Step 3 - Change your passwords.

Step 4 - Submit the malware to something like VirusTotal. It will ensure that most of the major antivirus vendors pick up on it.

Step 5 - Harden all Windows computers you work with by following guidelines posted by NIST, including disabling all autorun features for all types of media.

  • But how do I know if any of my online accounts are compromised? What about the backups? – Vorac Apr 9 '13 at 10:39
  • 1
    @Vorac Change all your passwords. Treat backups as you would a computer. If it has been in contact with the USB drive in the suspected period, it has to go. – user10211 Apr 9 '13 at 10:45
  • Can you specify which of those publications you're referring to? – Ploni Jul 7 '17 at 21:05
5

You can use a Linux OS (for example Ubuntu) to backup your files from USB and scan them with an antivirus, so you can save your files; then you will must format your USB stick!

  • 1
    Or alternatively, just make a permanent switch to a Linux OS (for example Ubuntu) rendering the virus on the USB stick (and any other Windows malware you come across) impotent. ;) – IQAndreas Sep 4 '14 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.