How I Survived A "Windows XP Recovery" Attack

Let me stay first that I believe any hacker who writes hijacker programs, viruses, trojans, malware of any kind or who snoops around in my private files should be stripped naked, hog-tied and branded on his forehead and his butt with a big letter "H" by the hairiest, smelliest cowboy we can find (on who's been out on the prairie way to long and thinks the hacker has a "purty mouth".  Then he should be dipped in honey and dropped on a tiny deserted island infested with fire ants, somewhere not far from the arctic circle with lots of friendly crabs, scorpions and other assorted crustaceans - anything with pincers or stingers.

That said, I was working and doing a Google search for bananas and tomatoes and trying to find out if you could grow them together. Somebody on one likely looking site planted a trojan that opened a video file and when I tried to shut it down, it paused and installed a Trojan.

MacAfee kept deleting it to no avail.  It started giving me messages that said my SATA hard drive was failing. Well, my laptop doesn't use a SATA hard drive.  I discovered that a new "security" program icon had appeared in the lower right task bar calling itself Windows Recovery XP.  I began receiving ever more frantic messages that my computer was going to fail. I quickly saved my files I was working on. That was an early giveaway because a hard drive failure wouldn't have let me save files. To be certain, however, I saved my files to an SD disk and then rebooted.

Things got worse.  My wallpaper disappeared and a big "security" screen came up telling me I had 12 problems with my hard drive and that I should scan it with Windows XP Recovery. The program also uses several other variants of the same name. Whatever it calls itself, it is another of the fake Windows Security programs that have been so successful of late at getting past firewalls and security software.  Task manager was greyed out so I couldn't manually delete whatever process they had running.  So:

1. I went to my desktop computer and downloaded fresh versions of Norman Malware Cleaner  and Kapersky TDSSKiller Anti-Rootkit Utility onto a jump drive.

2.  I booted the infested laptop, plugged in the jump drive and started TDSSKiller right off the jumper.  It found nothing, but it's always smart to check first or the malware can reinstall itself every time you reboot.

3.  I ran Norman Malware and scaned the entire C: drive.  Norman Malware was busily deleting registry entries this nasty piece of business had installed when the computer shut down on its own.  This is something this particular malware does to protect itself. It hopes you'll give up and buy their "security software" to rid yourself of the problem.  Of course, then they'll have your credit card - I don't think so!

4.  Restarted the laptop and this time closed the "security screen" from the blue program bar. I started Norman Malware Cleaner again and checked the program bar again by right-clicking on it. This time Task Manager was operational. By now it was throwing hard drive crash notices at me again.  I opened the process tab in TM and found a bunch of copies of a program called "attrib"  - six or seven copies of it. I shut them all down quick.  Next, I found a program that I didn't recognize with a word salad name that no respectable programmer would ever use (ASduaswhIbMHgW.exe).  I shut it off.  The "notices" stopped and Norman was able to finish the scans and clean 4 malicious files.

5. Restarted the laptop and it was still there, but Task Manager still worked.  I again disabled the invading file to stop the phony "alerts" and shut off the "security window".  Went to the control panel and clicked "run" then typed "msconfig". Found the ASduaswhIbMHgW.exe file in startup so I disabled it.  I didn't try a restart it yet. Instead I ran my Advanced System Care Pro software's deep clean utility before restarting, hoping it would catch the file and eleminate it. ASC found two high risk programs and removed a bunch more malicious registry entries.

6. Restarted the laptop. and everything on my desktop and all the programs in my Start program menu were gone. Restarted the laptop and went to Save Mode with Networking by tapping F8 till the safe mode Window came up. I selected the "System Restore" option for bootup and restored from yesterday afternoon's system setting restore point. Everything looked fine till I noticed that my McAfee real time virus scan is turned off. When I try and turn it back on it won't do it. opened McAfee and ran the "check for updates" utility. Seems there's also a problem with McAfee when you do a system restore that McAfee sometimes loses any updates that happened after the restore point. Updating McAfee fixed the problem.

7. Ran Malwarebytes' Anti-Malware software. I couldn't update the malware database, but was able to run the program. Still acts like something's wrong. Malwarebytes scanned for over an hour and found 1 Malware file designed to restore the program and a tracer file.

8.  Restarted the laptop. Ran a full McAfee scan. For some reason Advanced System Care Pro self-destructed when it tried to update and I had to go to the control panel and remove all traces of it and reinstall it.

9.  Finished up about 2:30 am.  The laptop is working again and I am in a state where, if I met the hacker who came up with the Windows XP Recovery Malware, I fear I might have a great deal of difficulty obeying the golden rule. I would likely obey it, but the only comfort would be the thought that the lake of fire awaits evil people as their reward for their labors in this life. 

I figure it cost me $45 to $60 in lost time working at the pittance my lowest paying writing job pays.

 If it's still loggy in the morning, I'll run TDSSKiller and Norman Malware Cleaner again. For now I'm taking a shower and hitting the sack. I hope the anti-virus/anti-malware/anti-spam people figure out how to block this. After all we pay them quite enough protection money thank you.

ONE MORE PROBLEM:  When I opened Internet Explorer I discovered my Favorites (bookmarks) folder was empty.  Five years of bookmarks gone.  My Firefox browser still had its bookmarks, but IE's were missing in action - a serious PIA for someone who does research and writing for a living.

HOW I FIXED IT:  I found the favorites folder in my files under C:\Documents and Settings\Tom King\Favorites .  But every file was greyed out. They had all been marked "hidden".  I had to go to the favorites file, right click, select properties, left click on it to open "properties" and uncheck "hidden" as the attributes. Fortunately, it lets you unhide all the files in the folder at once, so I selected "all subfolders" when it gave me the options. In about 30 seconds it unhid my bookmarks.  I opened Internet Explorer and all my Fav's are back. 

WARNING:  The vicious little punks who created the "Windows XP Recovery" malware program likely hid a lot more key files.  I'll be cleaning that up for weeks, but at least I know what they did.

Hiding files is an easy way to mimic a hard drive break-down.  Their phoney security software probably doesn't do anything except unhide the files that have supposedly "gone missing" on your computer. It's a fraud. Their software is what hid the files in the first place. I hope someone sends these pipsqueaks to prison for it. In the meantime.......

I BEAT THEM!

 Tom

P.S.  If anyone out there is like a super computer geek who wants to be a superhero, let me suggest something.  Track people that do this down and post their home addresses on-line. You could support your super-hero work by selling baseball bats on-line to people who have had hours and hours of their lives robbed from them by these villains. Or even more fun, track down every virus, malware program, trojan and herbal viagra spammer you can find, every Nigerian e-mailer, every phony lottery and create a database of their creator's names and the homes or basements they live in.  Put a "donation" link on your website. You'll make a killing.

If you'll do it, let me know. I'll buy you a genuine superhero cape!  Flame retardant.

Exterminating the Koobface Worm

 

Watch out for a fresh round of the Koobface worm on Facebook. You'll get a message from someone you trust that offers a link to a youtube video. It sends you to a fake youtube site.

A popup opens saying you need the latest version of Flash Player to play the video. DO NOT CLICK ON THE FAKE FLASH PLAYER LINK.

Do that and you won't get infected.  If you did click on the fake Flash Player link, you have the Koobface worm.  Here's how I cleaned it off my computer.  You can also watch a Youtube video that tells how to get rid of it.  I got to it done quickly before it brutalized my system, so all I had to do was run Malwarebyte's Anti-Malware software.  If you have had it for a while, watch the video for some extra steps you might need to take.

I cleaned it off my computer within hours. If it stays any time at all, it will harvest your name and some private info. If it stays long enough it will harvest your passwords and send it to the hacker.

Here's what I did. 

1. Go to  http://support.kaspersky.com/viruses/solutions?qid=208280684  and download the TDSS Rootkit removal tool.  It comes as a zip file.  Save it on your desktop.  Extract the file to your desktop.  Don't put the TDSS Killer program in a folder on the desktop.  Just extract it to the desktop. 
2. Run the tool, clean and repair following the prompts and then restart the computer.
3. Go to http://www.norman.com/support/support_tools/58732/en and download the Norman Malware Cleanter and place it on your desktop.
4. Run Norman Malware Cleaner and clean any installed malware from your computer.  Follow the cleaning prompts and then reboot your computer.
5. Go to CNET.com 
6. Download "Malwarebyte's Anti-Malware program (it's free). 
7. Install Anti-Malware, check for and download the latest updates and run the full scan. It will take a while. When it's done it will list the infected files. 
8. Leave the boxes checked and click on the repair link. 
9. Now go away for 15-20 minutes (don't mess with it). The program may appear to freeze. Just cut off the power and reboot when you come back. 
10. Rerun the Anti-Malware software. A scan should show you free of the worm. Check the last log file and it will show what was found and deleted.
11. First time you open your Firefox browser, don't go anywhere.  Click on Tools > Options > Advanced > Network > Settings.  Then change the settings to "No Proxy" and you should be okay. This worm hijacks the proxy settings on your computer.  If you don't do this, it will still redirect you to a bogus website and make your life miserable.
12. The first time you open your I.E. browser, click on Tools > Internet Options > Connections > LAN settings.  Uncheck the "Proxy Server" option and check "Automatically check settings".  I had to close I.E. the first time because it wouldn't let me select Internet Options, but the second time I opened it, I was able to fix it.  Don't know why - possibly because I hadn't used IE since I contracted the Koobface worm.  (Doesn't that sound just like something you'd pick up on a trip to a bordertown restaurant). 

Anyway, this ought to get you back up and running and keep your system clean. 

IF IT DOES NOT, GO GET ON THE "MY BLEEPING COMPUTER" WEBSITE AND SIGN UP FOR AN ACCOUNT: http://www.bleepingcomputer.com/

They have some very knowledgeable folk on the site who can talk you through a thorough cleanup. You may encounter recommendations to use a program called "Combofix" on other websites. Do not use this program without getting help from the Bleeping Computer folks. It fools around with key parts of the computer's operating system and if you don't know what you are doing, you can get really screwed up.

You'll need to set up an Account on "Bleeping Computer" and post a topic for your specific problem. There is a list of preparatory steps you'll have to take to get ready and the process may take a little time to work through. It's either that or pay some computer tech several hundred bucks to wipe and rebuild your hard drive and you still may lose data in the process.

One more note. If you try to search "Koobface Worm Removal" you will get links to a lot of sites that will actually give you the Koobface worm. Make sure you have a tool like "Web of Trust" or your anti-malware software running to warn you about untrustworthy sites. Try the above process and "Bleeping Computer" before you go stepping into that minefield. Doing a Google search to correct a "google redirect" virus that you have on your computer is asking for a trip through the looking glass.

One more note.  If you try to search "Koobface Worm Removal" you will get links to a lot of sites that will actually give you the Koobface worm.  Try the above process before you go stepping into that minefield.

Hackers who do this are thugs and bullies and no better than the punks who used to give them wedgies back in junior high school. I personally think we should catch them and hang them publicly in the town square -- by the back of their Fruit-of-the-Looms! Just let 'em dangle there for a while! Then we should put them all on a deserted island somewhere well north of the tropics where it gets really cold in the winter. Leave them no computers or electricity - nothing but farm tools and bags of turnip seeds.

Good luck.

Tom