Trojan/Worm Cridex Issue

Question

Currently we are receiving a surge in machines that are being attacked with Cridex.

We received several spam/infected emails that have used macros to we think deploy a backdoor trojan that is allowing Cridex to be pulled down.

This is the popup we get from SEP: https://i.stack.imgur.com/TaDR7.jpg

Also after installing malwarebytes on a few systems we would get a warning that C:\Windows\explorer.exe was trying to access malicious sites.

What is interesting is that we can remove all known instances of the virus, restart the machine run a full scan, and then still find the same or sometimes different objects.

One of the other major hurdles is that the virus is on multiple sites, however we are finding little consistency with how it operates and what trojans/ viruses are installed on the system.

Installed malwarebytes on a users machine whilst it was running the scan it continually prompted about C:\Windows\explorer.exe stating that it was trying to access a malicious website.

SEP has also started to recognise the edg(random No.).exe as part of the issue, possibly the carrier.

Currently our thinking is that the edg file is a trojan that is allowing cridex etc entry onto the system. However it appears SEP is blocking Cridex from fully activating, so the question is why isn't SEP finding and stopping this.

SEP says that you should be able to find files in the registry etc:

http://www.symantec.com/security_response/writeup.jsp?docid=2012-012103-0840-99&tabid=2

However personally been unable to find them thus far, but new machines have been infected here so will have a look.

The issue we have is that SEP didn't block the spam emails from executing their macros for a full day.

Sometimes a combination of SEP and Malwarebytes seems to remove all of the infected files etc. However this isn't always the case.

We have notices that Symantec have recently updated their signature for Cridex so does anyone have ideas or knowledge on how to tackle this effectively.

Any help is greatly appreciated.

UPDATE: We have found Norton Power Removal tool, seems to do the trick, you have to run the rootkit session but this seems to get it

Answer 1

The only realistic solution is to reimage any system that is known to be infected. You will want to take care to ensure the new image has every Windows patch on it. You will also need to examine your file sharing configuration on these systems as it looks like this worm will attempt to spread to those as well.