2

I am using Windows XP Professional and what happens is that when I try to connect any gadget like a pen drive or a mobile through USB, all my data gets hidden and it shows a 1 kb file which is a .lnk file and if I try to find the target of that .lnk file it shows:

C:\WINDOWS\system32\cmd.exe /c start qfstynchuh.vbs&start explorer USB&exit

Where USB is my file name.

I tried doing research in regarding this and I got one idea of showing hidden files using CMD by changing to F:/ and typing this code

attrib -s -h USB

It successfully worked but again the files got hidden. I have the qfstynchuh.vbs file but when I open it with CMD it shows around 10000 lines of encrypted words. I can't paste this code here so the real code is in this link: http://hackinginjections.blogspot.nl/2014/08/qfstynchuhvbs.html

I also tried deleting that file but again it appears and I tried changing and deleting all those codes and again saving it but nothing happens. If it comes to the anti-virus then it is not detecting and by the way if it detects it move this to chest and saves there. I am using Avast anti-virus.

Please help as all my pen drives are getting infected and it is also infecting my friends' PCs who are using Windows 7.

  • Try downloading Sysinternals' ProcExp, there you can suspend the script's process, and maybe see who triggers it. – EliadTech Jun 15 '14 at 13:00
3

That isn't encrypted, it's only encoded - base64. The decoded file for your link is pasted here:

http://pastebin.com/CQBymSqJ

Considering it dials home to the attacker and allows them to download and run files (as well as upload your own), I would just consider those machines lost and reinstall, and use Linux or Mac to delete the infected files from the USB and unhide the others.

Then don't give your USB disks to anyone you know, nor plug theirs into your machine!

If you really want to try to salvage it (I strongly recommend you just reinstall windows) then take EliadTechs advice, delete the registry keys mentioned in the pastebin script, and remove the shortcuts from startup.

I'd be quite surprised if they haven't put further malicious programs on your computer by now though.

Best of luck.

| improve this answer | |
  • Thanks for the answer ... and can you tell me where i can learn more about these things because these things are new to me. – Shashank Jun 17 '14 at 8:50
  • Learn more about what specifically, malware analysis? Generally it involved reverse engineering; debuggers, and assembly language are very important, you might get away with just decompliers though. In this case, it is just a script so any rudimentary programming experience would be a big help – user2867314 Jun 17 '14 at 10:54
5
+50

Your computer has been infected with H-Worm by Houdini.

The VBS file on your computer consists of two parts; first, the actual malware, encoded as Base64 as said by user2867314; second, the code to Base64-decode the malware.

Step by step:

  1. The first line is a comment.
  2. The next line calls the function deCrypt with the Base-64 encoded malware and assigns the return value to a variable with the name Safa7_22:

    Safa7_22 = deCrypt("(…)")
    
  3. The third line executes the value of the variable Safa7_22 as VBScript:

    EXECUTE (Safa7_22)
    
  4. Line 4-6 contain a function named deCrypt that, when called, calls another function named decodeBase64 with the data passed as the first argument to the deCrypt function and returns the value returned by the decodeBase64 function. It is redundant, as the malware author could just have called the function decodeBase64 directly at line two. Since VBScript first makes all functions in a script available before it starts with the execution of the other code, it is available at line two.
  5. Line 7-49 contain a function to decode Base64, apparently copied from here.

The malware is encoded to hamper detection by AntiVirus solutions.

Here is the original malware with the correct syntax highlighting: http://pastebin.com/ne1fnwKx

And here is the the decoded malware: http://pastebin.com/7qS5rEEQ

At the top at the decoded malware is the configuration: it is configured to communicate with its C&C at al-ahlii17.no-ip.org.

Right now, this subdomain points to a server at 101.61.156.113, a server hosted by an ISP in Mumbai, India.

It will use port 1155 and is configured to hide both folders and files and replace them with shortcuts.

When the malware is base64-decoded and executed, it performs the following actions.

  1. It first calls the function instance. This function checks if the computer already has a flag in the Windows registry. If not, it will store the following:

    a. If the script is in the root directory of a drive, it will set store the value "true" and the current date. b. If the script is not in the root directory of a drive, it will set store the value "true" and the current date.

  2. After that, the function instance calls another function, upstart. This function creates a key in the Windows registry under HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\ to ensure the script is started each time when you're logging in to your account if you weren't logged in yet. It also copies itself to the Startup folder.

  3. Then, this function ends and the function instance resumes execution. It checks if it is already installed at the configured install location and, if so, starts WScript in Batch mode with the script's name and exits.

  4. It then uses the OpenTextFile function to try top open a copy of the script at the install location. If opening fails, the script is already executing, meaning there is no need to reinstall it. Thus, if there is an error, it quits.
  5. The function instance has now stopped execution, and the scripting engine resumes at line 42, where it encounters the following instruction:

    while true
    

    This is the beginning of an infinite loop, meaning the script will stay running until it breaks out of the loop (or the script is terminated).

  6. After that, it calls the function install. This function first calls the upstart function, described above, again. After that, it will do the following for each drive:

    • If configured so, it hides files and / or folders and replaces them with a shortcut that will first execute the malware and then open the original file / folder using Windows Explorer.
  7. Then, it will send an HTTP POST request request to the C&C server. It can perform various actions: downloading and executing arbitrary programs, updating itself, executing CMD commands, kill processes, send information about the drive and running processes to the attacker and more. It also contains an action to uninstall itself. All of this happens over an unencrypted (HTTP) connection.
  8. Once it has executed the attackers commands, if there were any, it will halt execution for a specified amount of time (in this case, 5 seconds). Then, it encounters the instruction wend, after which it will start over at the beginning of the while loop (see point 5).

How to remove:

  1. Terminate wscript.exe using Task Manager or Process Explorer.
  2. Show hidden folders if you haven't done so already.
  3. Remove any malicious .lnk files left behind by the script.
  4. Delete the script's entry under HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\. It will be the script's name without .vbs.
  5. Remove the script from the windows startup folder.
  6. Clean the other registry keys left behind by the script as well if you want.
  7. Remove the script file from the root of each portable disk drive and the install directory (%temp%).
  8. Make the hidden files and folders visible again.
  9. Malware almost never comes alone. Run a full system scan with an antivirus and a second opinion scanner (such as MalwareBytes and HitmanPro). Also, consider a full reinstall of your system.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.