Windows XP Recovery Malware

Have you guys seen an influx of this malware? The past week and a half we have been inundated with calls regarding this piece of malware. Thus far we have had them reboot into safe mode with networking, run iexplore.exe (since it hides all their icons), remote us into the machine, we install Malwarebytes (if it isn't already on the device), and clean the device. After that we run the unhide.exe tool to get the icons back, but we've had to recreate some short cuts. It's starting to become harder to remove, anyone do anything different when it comes to removing this?

All the machines thus far had had antivirus that was up to date. We've seen it affect Panda Endpoint Protection and Symantec Endpoint Protection (two antiviruses most of our customers use).

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Asif Dasl

Get better antivirus/antispyware like Vipre...

Bokeh

Yeah Ive seen this one as well, pain in the butt to get rid of.

Hypntick

the_Grinch wrote: »

Have you guys seen an influx of this malware? The past week and a half we have been inundated with calls regarding this piece of malware. Thus far we have had them reboot into safe mode with networking, run iexplore.exe (since it hides all their icons), remote us into the machine, we install Malwarebytes (if it isn't already on the device), and clean the device. After that we run the unhide.exe tool to get the icons back, but we've had to recreate some short cuts. It's starting to become harder to remove, anyone do anything different when it comes to removing this?

All the machines thus far had had antivirus that was up to date. We've seen it affect Panda Endpoint Protection and Symantec Endpoint Protection (two antiviruses most of our customers use).

Getting a ton of calls about this one in the last week or so as well. It is a particularly nasty pain in the butt to get rid of. Have had instances of removing it and it coming back, combofix has picked up some of them as root kits. Hopefully these die off pretty quick otherwise it's gonna be another busy week.

nimrod.sixty9

You guys happen to find out where the PC's are getting infected from? Sites, email, etc...
I hope to not run into this on Monday...

nhan.ng

attrib -h /s /d

run that command, if it's vista/7, make sure u run them as admin. Then reboot, and run tdsskiller/mbam full scan.

if you want to make sure, you can always run a 2nd scanner such as superantispyware. it usually pick up more stuff than mbam.

SteveLord

Antivirus are always 1 step behind...so it doesnt matter what you use. Infections can come from emails, using Google/Bing images or even embedded in ad banners.

steve13ad

We've been getting hammered with calls as well. We've found the easiest solution is to use System Restore to get rid of it. Works every time!

Bokeh

One I dealt with on Wed came from going to Anthem.com checking their health benefits.

it_consultant

the_Grinch wrote: »

Have you guys seen an influx of this malware? The past week and a half we have been inundated with calls regarding this piece of malware. Thus far we have had them reboot into safe mode with networking, run iexplore.exe (since it hides all their icons), remote us into the machine, we install Malwarebytes (if it isn't already on the device), and clean the device. After that we run the unhide.exe tool to get the icons back, but we've had to recreate some short cuts. It's starting to become harder to remove, anyone do anything different when it comes to removing this?

All the machines thus far had had antivirus that was up to date. We've seen it affect Panda Endpoint Protection and Symantec Endpoint Protection (two antiviruses most of our customers use).

There are 2 things you can do to prevent this from happening. First you can stop using IE - firefox or chrome don't seem to be affected by this virus. Second - tell your users that if they see ANY security software pop up that is not their company software (better let them know what that is) to not click on ANYTHING at all and call the help desk. If you catch it before your users click on anything - forcing a shutdown of IE from the command line (tasskill /f /im iexplore.exe) will prevent infection.

it_consultant

Bokeh wrote: »

One I dealt with on Wed came from going to Anthem.com checking their health benefits.

Here too, my client bills health insurance to Anthem. They must have weak security on their website, someone got in and put a malicious script on the site.