Spyware Warrior

ipl_001 · Posted: Sat Dec 16, 2006 3:15 pm Post subject: CurePCSolutions

Hi everyone,

We've got 3 cases of CurePCSolutions on Zebulon (my French forum) so far!
For example CurePCSolutions, ads .exe to files

Oodles of files (.AVI, .MP3, .DOC, etc.) are renamed to .ext.EXE (ext being the former extension).
Renamed files show the same special icon.

~Mark · Posted: Sat Dec 16, 2006 10:38 pm Post subject:

Hi Gérard, everyone;

I think it is a "ransomware" redesign, from what I read here :

http://info.drweb.com/show/2747

That was written last January. From what I can see this time around, the "ransom" has been dropped in favor of a rogue...

Dr.Web released a free decoder for the variant that came out almost a year ago, based on the RSA algorithm which was used to encrypt the files. They now detect this latest one as "Trojan.Encoder.10", and it will be interesting to see if the algorithm is the same ; if it is a new encrytion method, then I hope we'll see a new tool out very soon, so that people infected with this don't go running to buy CurePCSolutions Evil or Very Mad

Cheers all,

Mark.

ipl_001 · Posted: Sun Dec 17, 2006 2:23 am Post subject:

Hi Mark,

Nice to see you here! Thanks for your post!

ipl_001 · Posted: Sun Dec 17, 2006 8:42 am Post subject:

Hi everyone,

Nasty beast! Sad

There's another discussion with the same malware (plus others) at TechSupportGuy ( http://forums.techguy.org/security/526934-blank-htm-hijacker-advanced-keylogger.html ) and Derek asks for reformatting!

dvk01 · Posted: Wed Dec 20, 2006 11:17 am Post subject:

it wasn't the curepc & mht entries that suggested format as any encrypted files do, stand a chance of decrypt & the av companies should be able to deal with it but

O4 - HKLM\..\Run: [system spool] C:\WINDOWS\System32\syspools.exe
O4 - HKLM\..\Run: [MSConfig]
O4 - HKLM\..\Run: [mstds.exe] c:\windows\system32\mstds.exe
O4 - HKCU\..\Run: [system spool] C:\WINDOWS\System32\syspools.exe

which really muck up system settings & file associations etc and testing by others on a vm prove that reinstallation seems the only way to go

syspools.exe on it's own is bad enough but mstds is worse

ipl_001 · Posted: Wed Dec 20, 2006 1:07 pm Post subject:

Hi Derek, hi everyone,

Phew!
Thanks a lot for your response here, Derek! Smile

Thanks a lot for your explanations which relieve us as, obsessed by the .mht, I didn't see the other lines and didn't understand the sudden post saying to reformat.

~~ edit: A victim of ours uploaded the .DLL file to TheSpyKiller (of course, you know as you came here).
I'm asking him to, if possible, upload a file before and after being renamed.
I hope he also wrote to DrWeb and we count on them to help us decrypt the files.
_________________
Gérard

Don't give up... that is what they want us to do... Budfred!

~Mark · Posted: Wed Jan 10, 2007 6:29 pm Post subject:

Hello Gérard, Derek, all ;

Some good news, finally Very Happy

We never did hear back from the Dr.Web support people, after one of our visitors contacted them directly (and uploaded a file). Our second active visitor was prescribed a few tools for other infections, and files were eventually sent for analysis. Some of those files were related to the CurePCSolutions situation, so we got the ball rolling again. My thanks to AndyManchesta on this one Wink

It turns out the files weren't totally encrypted, as I first suspected from reading on older variants. After testing by some kind experts, it was discovered that the Dr.Web CureIt tool was able to repair the files almost completely. The user does need to manually rename/remove the extra .exe extension, on each file, after running CureIt. Since the number of infected files on the PCs doesn't appear to be too large, this technique is viable.

To those involved who might read this : Thank You Big Thumb Up

Cheers,

Mark.
_________________
Member of ASAP